# Suricata Antiphishing rules # Created by github.com/julioliraup/Antiphishing # Last updated: 2026-07-07 00:28:18 GMT-0300 # SID range: 6000000-6100000 # alert dns $HOME_NET any -> any any (msg:"AT DNS query to suspicious domain - Phishing"; dns.query; dataset:isset,phishing_domains,type string; reference:url,github.com/julioliraup/Antiphishing; classtype:social-engineering; sid:6000000; rev:1; metadata: signature_severity Major, created_et 2025_02_19;) alert tls $HOME_NET any -> any any (msg:"AT TLS SNI to suspicious domain - Phishing"; tls.sni; dataset:isset,phishing_domains,type string; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000001; classtype:social-engineering; sid:6000001; rev:1; metadata: signature_severity Major, created_et 2025_02_19;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro .9723781284750 .click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.9723781284750.click"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000004; classtype:social-engineering; sid:6000004; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie .pl-7464234 .click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalnie.pl-7464234.click"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000005; classtype:social-engineering; sid:6000005; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (43 .156 .7 .24/v3/signin/identifier?amp%3Bcontinue=https%3A%2F%2Faccounts .google .com%2F%3F&%3Bfollowup=https%3A%2F%2Faccounts .google .com%2F%3F&%3Bxrealip=35 .243 .23 .226&dsh=S1527374606%3A1778382188285022&passive=1209600&xrealip=138 .197 .91 .206&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2Pav_Nn-b0Gw_sqvRPSZkiUf-s9iwU9uhQ1T1dkFz9XLazUAHgQgikxetlFayuNreemUvQsSOHw)"; flow:established,to_server; http.uri; content:"/v3/signin/identifier?amp%3Bcontinue=https%3A%2F%2Faccounts.google.com%2F%3F&%3Bfollowup=https%3A%2F%2Faccounts.google.com%2F%3F&%3Bxrealip=35.243.23.226&dsh=S1527374606%3A1778382188285022&passive=1209600&xrealip=138.197.91.206&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2Pav_Nn-b0Gw_sqvRPSZkiUf-s9iwU9uhQ1T1dkFz9XLazUAHgQgikxetlFayuNreemUvQsSOHw"; startswith; fast_pattern; http.host; content:"43.156.7.24"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000006; classtype:social-engineering; sid:6000006; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (43 .159 .37 .67/v3/signin/identifier?amp%3Bifkv=AWnogHdTmwE6pzNz8JKc4z1CAjgAu5Vr1qTb7MJv_EtyYaaxHYaV9oicPzQvBLv9e1kmsQcKLtUiLQ&%3Bxrealip=107 .178 .232 .181&continue=https%3A%2F%2Faccounts .google .com%2F%3F&xrealip=138 .197 .91 .206&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2PavqFOr6bZ-o3vAN8FVHVGQNcTVF_kQXkohVP2TzMxPdqQ09U9FVEBo_9v3fVDE40Ao8PPZaCg&dsh=S118084090%3A1778382919654149)"; flow:established,to_server; http.uri; content:"/v3/signin/identifier?amp%3Bifkv=AWnogHdTmwE6pzNz8JKc4z1CAjgAu5Vr1qTb7MJv_EtyYaaxHYaV9oicPzQvBLv9e1kmsQcKLtUiLQ&%3Bxrealip=107.178.232.181&continue=https%3A%2F%2Faccounts.google.com%2F%3F&xrealip=138.197.91.206&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2PavqFOr6bZ-o3vAN8FVHVGQNcTVF_kQXkohVP2TzMxPdqQ09U9FVEBo_9v3fVDE40Ao8PPZaCg&dsh=S118084090%3A1778382919654149"; startswith; fast_pattern; http.host; content:"43.159.37.67"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000007; classtype:social-engineering; sid:6000007; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (center-1 .com/mmjfhy/)"; flow:established,to_server; http.uri; content:"/mmjfhy/"; startswith; fast_pattern; http.host; content:"center-1.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000008; classtype:social-engineering; sid:6000008; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (43 .159 .37 .67/v3/signin/identifier?amp%3Bfollowup=https%3A%2F%2Faccounts .google .com%2F%3F&%3Bifkv=ASKXGp3Pk-F4ZNULN9DP1cVGMMnDGEmPgcEXaKaRWszoUzsn6CSeViyYmRxRIQEEZUcV1AQdIba45Q&%3Bpassive=1209600&%3Bxrealip=35 .203 .245 .116&continue=https%3A%2F%2Faccounts .google .com%2F%3F&xrealip=138 .197 .91 .206&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2Pavm93o1UCT-KBGKoZSASEiIKws31Jm9ano7cwhTZXgQLrg4eeH2FBT3jsqN0xIzS9kn5mGU&dsh=S185019762%3A1778382235249673)"; flow:established,to_server; http.uri; content:"/v3/signin/identifier?amp%3Bfollowup=https%3A%2F%2Faccounts.google.com%2F%3F&%3Bifkv=ASKXGp3Pk-F4ZNULN9DP1cVGMMnDGEmPgcEXaKaRWszoUzsn6CSeViyYmRxRIQEEZUcV1AQdIba45Q&%3Bpassive=1209600&%3Bxrealip=35.203.245.116&continue=https%3A%2F%2Faccounts.google.com%2F%3F&xrealip=138.197.91.206&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2Pavm93o1UCT-KBGKoZSASEiIKws31Jm9ano7cwhTZXgQLrg4eeH2FBT3jsqN0xIzS9kn5mGU&dsh=S185019762%3A1778382235249673"; startswith; fast_pattern; http.host; content:"43.159.37.67"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000009; classtype:social-engineering; sid:6000009; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (43 .156 .0 .130/v3/signin/identifier?amp%3Bfollowup=https%3A%2F%2Faccounts .google .com%2F&%3Bifkv=AaSxoQyQEeCdGiNQploah5nAij7vrMqrlVIHby1Q4v_ARx9kttGkmffM4ARVCnkvjXQyGpUqW4kQNA&%3Bpassive=1209600&continue=https%3A%2F%2Faccounts .google .com%2F&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2PatJe8CuUZFInjCIsMMyB_S5WIcHcV9_Ey3zgariI7prCGZUZVfP7wWF1q-cB7Syky4URhMs0w&dsh=S356223092%3A1778382971411969)"; flow:established,to_server; http.uri; content:"/v3/signin/identifier?amp%3Bfollowup=https%3A%2F%2Faccounts.google.com%2F&%3Bifkv=AaSxoQyQEeCdGiNQploah5nAij7vrMqrlVIHby1Q4v_ARx9kttGkmffM4ARVCnkvjXQyGpUqW4kQNA&%3Bpassive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2PatJe8CuUZFInjCIsMMyB_S5WIcHcV9_Ey3zgariI7prCGZUZVfP7wWF1q-cB7Syky4URhMs0w&dsh=S356223092%3A1778382971411969"; startswith; fast_pattern; http.host; content:"43.156.0.130"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000010; classtype:social-engineering; sid:6000010; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie .aukcja2119658 .cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalnie.aukcja2119658.cfd"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000011; classtype:social-engineering; sid:6000011; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ul60ezvizj2 .wixsite .com/my-site-1)"; flow:established,to_server; http.uri; content:"/my-site-1"; startswith; fast_pattern; http.host; content:"ul60ezvizj2.wixsite.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000012; classtype:social-engineering; sid:6000012; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (43 .156 .7 .24/v3/signin/identifier?amp%3Bfollowup=https%3A%2F%2Faccounts .google .com%2F%3F&%3Bifkv=AQMjQ7R3RU9uRsKgwPva2FtOUIg2u42Jvh6lxZEImmqrg78zMB78lA2h8R0plQ3O7gHZcj5aMizPlw&%3Bpassive=1209600&%3Bxrealip=107 .178 .200 .220&continue=https%3A%2F%2Faccounts .google .com%2F%3F&xrealip=138 .197 .91 .206&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2Pavj4_djjqeQGj0s7jDhdE43N6ksOmNAoM11zlKXHEHoKUpLyu_4qrZTxdQ2dv5VyhgFE3mgjQ&dsh=S-567168735%3A1778382722976118)"; flow:established,to_server; http.uri; content:"/v3/signin/identifier?amp%3Bfollowup=https%3A%2F%2Faccounts.google.com%2F%3F&%3Bifkv=AQMjQ7R3RU9uRsKgwPva2FtOUIg2u42Jvh6lxZEImmqrg78zMB78lA2h8R0plQ3O7gHZcj5aMizPlw&%3Bpassive=1209600&%3Bxrealip=107.178.200.220&continue=https%3A%2F%2Faccounts.google.com%2F%3F&xrealip=138.197.91.206&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2Pavj4_djjqeQGj0s7jDhdE43N6ksOmNAoM11zlKXHEHoKUpLyu_4qrZTxdQ2dv5VyhgFE3mgjQ&dsh=S-567168735%3A1778382722976118"; startswith; fast_pattern; http.host; content:"43.156.7.24"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000013; classtype:social-engineering; sid:6000013; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro .po823902-12 .lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.po823902-12.lat"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000014; classtype:social-engineering; sid:6000014; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (43 .156 .0 .130/v3/signin/identifier?amp%3Bfollowup=https%3A%2F%2Faccounts .google .com%2F&%3Bifkv=AaSxoQyQ_ZSuXpSvue0UfKrOXnU6mQAuN0RcLmvWGTqSCzhKlOsPyDT7wQQH6ra2Rhdw1PE87iTB&%3Bpassive=1209600&continue=https%3A%2F%2Faccounts .google .com%2F&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2PascutWXoup5bw52pd_4EGvh3-Yme6QV5nxP4snN-QobXseYgih9mxtRFDsT25d0hObT3ty-4A&dsh=S1528442115%3A1778382985730338)"; flow:established,to_server; http.uri; content:"/v3/signin/identifier?amp%3Bfollowup=https%3A%2F%2Faccounts.google.com%2F&%3Bifkv=AaSxoQyQ_ZSuXpSvue0UfKrOXnU6mQAuN0RcLmvWGTqSCzhKlOsPyDT7wQQH6ra2Rhdw1PE87iTB&%3Bpassive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2PascutWXoup5bw52pd_4EGvh3-Yme6QV5nxP4snN-QobXseYgih9mxtRFDsT25d0hObT3ty-4A&dsh=S1528442115%3A1778382985730338"; startswith; fast_pattern; http.host; content:"43.156.0.130"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000015; classtype:social-engineering; sid:6000015; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (microsoft761login .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"microsoft761login.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000016; classtype:social-engineering; sid:6000016; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (43 .159 .37 .67/v3/signin/identifier?amp%3Bcontinue=https%3A%2F%2Faccounts .google .com%2F%3F&%3Bfollowup=https%3A%2F%2Faccounts .google .com%2F%3F&%3Bxrealip=107 .178 .237 .10&dsh=S252333957%3A1778382830062800&passive=1209600&xrealip=138 .197 .91 .206&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2PatfoUApcCMx3elfFp9nIfgpvx69SGo8I1fN-DsEoy34AGTqdauDaOZSpUFOUj53nRoCv-bMXA)"; flow:established,to_server; http.uri; content:"/v3/signin/identifier?amp%3Bcontinue=https%3A%2F%2Faccounts.google.com%2F%3F&%3Bfollowup=https%3A%2F%2Faccounts.google.com%2F%3F&%3Bxrealip=107.178.237.10&dsh=S252333957%3A1778382830062800&passive=1209600&xrealip=138.197.91.206&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2PatfoUApcCMx3elfFp9nIfgpvx69SGo8I1fN-DsEoy34AGTqdauDaOZSpUFOUj53nRoCv-bMXA"; startswith; fast_pattern; http.host; content:"43.159.37.67"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000017; classtype:social-engineering; sid:6000017; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (43 .159 .37 .67/v3/signin/identifier?amp%3Bcontinue=https%3A%2F%2Faccounts .google .com%2F%3F&%3Bfollowup=https%3A%2F%2Faccounts .google .com%2F%3F&%3Bxrealip=35 .203 .245 .179&dsh=S-1943207600%3A1778381078527604&passive=1209600&xrealip=138 .197 .91 .206&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2Pavof7v66M-Tk6taNn-kCPJiPXAgnY-WBuxIlUz9GLnmxIuVBVKGOJ66rZkUsno-P9hWp-oH2g)"; flow:established,to_server; http.uri; content:"/v3/signin/identifier?amp%3Bcontinue=https%3A%2F%2Faccounts.google.com%2F%3F&%3Bfollowup=https%3A%2F%2Faccounts.google.com%2F%3F&%3Bxrealip=35.203.245.179&dsh=S-1943207600%3A1778381078527604&passive=1209600&xrealip=138.197.91.206&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2Pavof7v66M-Tk6taNn-kCPJiPXAgnY-WBuxIlUz9GLnmxIuVBVKGOJ66rZkUsno-P9hWp-oH2g"; startswith; fast_pattern; http.host; content:"43.159.37.67"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000018; classtype:social-engineering; sid:6000018; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (crejizo .auction/lxR2jtTWdKz92f!YltbA/)"; flow:established,to_server; http.uri; content:"/lxR2jtTWdKz92f!YltbA/"; startswith; fast_pattern; http.host; content:"crejizo.auction"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000019; classtype:social-engineering; sid:6000019; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mystical-garden .com/verify-update/)"; flow:established,to_server; http.uri; content:"/verify-update/"; startswith; fast_pattern; http.host; content:"mystical-garden.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000020; classtype:social-engineering; sid:6000020; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (recaptcha .cloud/?template=cpg&server=198 .251 .89 .144&ip=138 .197 .91 .206&http=&host=swiftsecurebnk .com&real_ip=&proto=&url=/home/)"; flow:established,to_server; http.uri; content:"/?template=cpg&server=198.251.89.144&ip=138.197.91.206&http=&host=swiftsecurebnk.com&real_ip=&proto=&url=/home/"; startswith; fast_pattern; http.host; content:"recaptcha.cloud"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000021; classtype:social-engineering; sid:6000021; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (projects247 .agency-partner-operations .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"projects247.agency-partner-operations.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000022; classtype:social-engineering; sid:6000022; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gfgfgvfvdesigloginjfhfh .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gfgfgvfvdesigloginjfhfh.weebly.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000023; classtype:social-engineering; sid:6000023; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .fgxscvx .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fgxscvx.weebly.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000024; classtype:social-engineering; sid:6000024; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support-wallet-ledger-live-login-cd-five .vercel .app/ledger%20form/verify .html)"; flow:established,to_server; http.uri; content:"/ledger%20form/verify.html"; startswith; fast_pattern; http.host; content:"support-wallet-ledger-live-login-cd-five.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000025; classtype:social-engineering; sid:6000025; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .2 .wne001 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.2.wne001.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000026; classtype:social-engineering; sid:6000026; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nnewsdana-lyanindonx .safaather .biz .id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nnewsdana-lyanindonx.safaather.biz.id"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000027; classtype:social-engineering; sid:6000027; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-credential .bussines-partner-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-credential.bussines-partner-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000028; classtype:social-engineering; sid:6000028; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rilvax-biz-kantor-1425 .pages .dev/form_submit_appeal/)"; flow:established,to_server; http.uri; content:"/form_submit_appeal/"; startswith; fast_pattern; http.host; content:"rilvax-biz-kantor-1425.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000029; classtype:social-engineering; sid:6000029; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .ivorytowertattoo .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ivorytowertattoo.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000030; classtype:social-engineering; sid:6000030; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sathya-the-bot .github .io/netflix_landing_page/)"; flow:established,to_server; http.uri; content:"/netflix_landing_page/"; startswith; fast_pattern; http.host; content:"sathya-the-bot.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000031; classtype:social-engineering; sid:6000031; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreibwsnxxk4m4ekdloenmjbzyt2r6hj4hkkyt6qh2x4bvsjj4pbmlpe .ipfs .dweb .link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreibwsnxxk4m4ekdloenmjbzyt2r6hj4hkkyt6qh2x4bvsjj4pbmlpe.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000032; classtype:social-engineering; sid:6000032; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (invoice-meta .busines-help-center .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"invoice-meta.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000033; classtype:social-engineering; sid:6000033; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xht .dbh .mybluehost .me/wp-content/time/metas/main .html)"; flow:established,to_server; http.uri; content:"/wp-content/time/metas/main.html"; startswith; fast_pattern; http.host; content:"xht.dbh.mybluehost.me"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000034; classtype:social-engineering; sid:6000034; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tiktokshop101ng-sketch .github .io/tok)"; flow:established,to_server; http.uri; content:"/tok"; startswith; fast_pattern; http.host; content:"tiktokshop101ng-sketch.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000035; classtype:social-engineering; sid:6000035; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-submission .agency-manager-support .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-submission.agency-manager-support.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000036; classtype:social-engineering; sid:6000036; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f .digitalmaillane .com/igit/4/1e7swd5Wr719y6p0gaW5hrWbfpt80aW4dfWbc4Wn0WgW9)"; flow:established,to_server; http.uri; content:"/igit/4/1e7swd5Wr719y6p0gaW5hrWbfpt80aW4dfWbc4Wn0WgW9"; startswith; fast_pattern; http.host; content:"f.digitalmaillane.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000037; classtype:social-engineering; sid:6000037; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ashton564 .github .io/BT .html/)"; flow:established,to_server; http.uri; content:"/BT.html/"; startswith; fast_pattern; http.host; content:"ashton564.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000038; classtype:social-engineering; sid:6000038; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (assistgrowth-aidpush-q2z4u6 .pages .dev/business .html/)"; flow:established,to_server; http.uri; content:"/business.html/"; startswith; fast_pattern; http.host; content:"assistgrowth-aidpush-q2z4u6.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000039; classtype:social-engineering; sid:6000039; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sreedevz .github .io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"sreedevz.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000040; classtype:social-engineering; sid:6000040; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sammyjay239 .github .io/AIRBNB-PROJECT/otherhtmlpages/trend .html)"; flow:established,to_server; http.uri; content:"/AIRBNB-PROJECT/otherhtmlpages/trend.html"; startswith; fast_pattern; http.host; content:"sammyjay239.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000041; classtype:social-engineering; sid:6000041; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .help-ledger-live-loginwallet-suppor .vercel .app/ledger%20form/verify .html)"; flow:established,to_server; http.uri; content:"/ledger%20form/verify.html"; startswith; fast_pattern; http.host; content:"www.help-ledger-live-loginwallet-suppor.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000042; classtype:social-engineering; sid:6000042; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support-space .credit-agency-meta .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"support-space.credit-agency-meta.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000043; classtype:social-engineering; sid:6000043; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .robiox .com .py/users/151582181478/profile)"; flow:established,to_server; http.uri; content:"/users/151582181478/profile"; startswith; fast_pattern; http.host; content:"www.robiox.com.py"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000044; classtype:social-engineering; sid:6000044; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sammyjay239 .github .io/AIRBNB-PROJECT/otherhtmlpages/beach .html)"; flow:established,to_server; http.uri; content:"/AIRBNB-PROJECT/otherhtmlpages/beach.html"; startswith; fast_pattern; http.host; content:"sammyjay239.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000045; classtype:social-engineering; sid:6000045; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (caf .bcv .mybluehost .me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"caf.bcv.mybluehost.me"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000046; classtype:social-engineering; sid:6000046; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (identifiez-vous9910 .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"identifiez-vous9910.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000047; classtype:social-engineering; sid:6000047; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s3-external-2 .amazonaws .com/rtsrtgfsgvhgvjhsd5211gvvxtcj .069 .udjhss .jnxjnnjn/index .html)"; flow:established,to_server; http.uri; content:"/rtsrtgfsgvhgvjhsd5211gvvxtcj.069.udjhss.jnxjnnjn/index.html"; startswith; fast_pattern; http.host; content:"s3-external-2.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000048; classtype:social-engineering; sid:6000048; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (case0405twrqpm .syncpath-connectsrv .com/public/index?ref=business-support-center-DASDFDSYUYEE43FJDSHFSDFsetting%25popup%3fclient_id=889943718806-ual26tplnot2ea8b7n5t4p77keo8eb)"; flow:established,to_server; http.uri; content:"/public/index?ref=business-support-center-DASDFDSYUYEE43FJDSHFSDFsetting%25popup%3fclient_id=889943718806-ual26tplnot2ea8b7n5t4p77keo8eb"; startswith; fast_pattern; http.host; content:"case0405twrqpm.syncpath-connectsrv.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000049; classtype:social-engineering; sid:6000049; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro .oef10943920 .shop/lokalnie/?id=3Q8k0x8h9E6P3y0I5u0Y8l4f7M3B5E5Y)"; flow:established,to_server; http.uri; content:"/lokalnie/?id=3Q8k0x8h9E6P3y0I5u0Y8l4f7M3B5E5Y"; startswith; fast_pattern; http.host; content:"allegro.oef10943920.shop"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000050; classtype:social-engineering; sid:6000050; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-billing .bussines-partner-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-billing.bussines-partner-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000051; classtype:social-engineering; sid:6000051; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (customer-sp-brantison1 .pages .dev/help/contact/326334055910889)"; flow:established,to_server; http.uri; content:"/help/contact/326334055910889"; startswith; fast_pattern; http.host; content:"customer-sp-brantison1.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000052; classtype:social-engineering; sid:6000052; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17611 .invoice-ads-manager .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17611.invoice-ads-manager.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000053; classtype:social-engineering; sid:6000053; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso--en-uphold-help .typedream .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sso--en-uphold-help.typedream.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000054; classtype:social-engineering; sid:6000054; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (process-meta .busines-help-center .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"process-meta.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000055; classtype:social-engineering; sid:6000055; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .robiox .com .py/users/146417613437/profile)"; flow:established,to_server; http.uri; content:"/users/146417613437/profile"; startswith; fast_pattern; http.host; content:"www.robiox.com.py"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000056; classtype:social-engineering; sid:6000056; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (payment-meta .accounts-admin-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"payment-meta.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000057; classtype:social-engineering; sid:6000057; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mike7418 .github .io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"mike7418.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000058; classtype:social-engineering; sid:6000058; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aicc108-demo .pages .dev/title/80104198 .html)"; flow:established,to_server; http.uri; content:"/title/80104198.html"; startswith; fast_pattern; http.host; content:"aicc108-demo.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000059; classtype:social-engineering; sid:6000059; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suite-core .credit-agency-meta .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"suite-core.credit-agency-meta.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000060; classtype:social-engineering; sid:6000060; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aicc108-demo .pages .dev/title/80035684 .html)"; flow:established,to_server; http.uri; content:"/title/80035684.html"; startswith; fast_pattern; http.host; content:"aicc108-demo.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000061; classtype:social-engineering; sid:6000061; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (manager-meta .accounts-admin-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"manager-meta.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000062; classtype:social-engineering; sid:6000062; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wallet-landing-near .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wallet-landing-near.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000063; classtype:social-engineering; sid:6000063; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paololuck .github .io/appleofficial)"; flow:established,to_server; http.uri; content:"/appleofficial"; startswith; fast_pattern; http.host; content:"paololuck.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000064; classtype:social-engineering; sid:6000064; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (microsoftspain .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"microsoftspain.weebly.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000065; classtype:social-engineering; sid:6000065; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pkcu .pages .dev/appeal_case_ID/)"; flow:established,to_server; http.uri; content:"/appeal_case_ID/"; startswith; fast_pattern; http.host; content:"pkcu.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000066; classtype:social-engineering; sid:6000066; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aicc108-demo .pages .dev/www .netflix .com/cl/login .html)"; flow:established,to_server; http.uri; content:"/www.netflix.com/cl/login.html"; startswith; fast_pattern; http.host; content:"aicc108-demo.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000067; classtype:social-engineering; sid:6000067; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s3 .dualstack .us-east-1 .amazonaws .com/rtsrtgfsgvhgvjhsd5211gvvxtcj .069 .udjhss .jnxjnnjn/index .html)"; flow:established,to_server; http.uri; content:"/rtsrtgfsgvhgvjhsd5211gvvxtcj.069.udjhss.jnxjnnjn/index.html"; startswith; fast_pattern; http.host; content:"s3.dualstack.us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000068; classtype:social-engineering; sid:6000068; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abdullah23890 .github .io/E-commerce-frontend/)"; flow:established,to_server; http.uri; content:"/E-commerce-frontend/"; startswith; fast_pattern; http.host; content:"abdullah23890.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000069; classtype:social-engineering; sid:6000069; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xpj9809 .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xpj9809.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000070; classtype:social-engineering; sid:6000070; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vanshjaiswal-dev .github .io/Netflix)"; flow:established,to_server; http.uri; content:"/Netflix"; startswith; fast_pattern; http.host; content:"vanshjaiswal-dev.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000071; classtype:social-engineering; sid:6000071; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (customer-sp-brantison1 .pages .dev/help/contact/6983929450291)"; flow:established,to_server; http.uri; content:"/help/contact/6983929450291"; startswith; fast_pattern; http.host; content:"customer-sp-brantison1.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000072; classtype:social-engineering; sid:6000072; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-active .bussines-partner-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-active.bussines-partner-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000073; classtype:social-engineering; sid:6000073; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (network-meta .accounts-admin-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"network-meta.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000074; classtype:social-engineering; sid:6000074; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agency-facebook .program-ads-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"agency-facebook.program-ads-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000075; classtype:social-engineering; sid:6000075; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (user-meta .accounts-admin-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"user-meta.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000076; classtype:social-engineering; sid:6000076; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-profile .agency-manager-support .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-profile.agency-manager-support.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000077; classtype:social-engineering; sid:6000077; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (restoreallwallet .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"restoreallwallet.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000078; classtype:social-engineering; sid:6000078; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aicc108-demo .pages .dev/www .netflix .com/cl/login)"; flow:established,to_server; http.uri; content:"/www.netflix.com/cl/login"; startswith; fast_pattern; http.host; content:"aicc108-demo.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000079; classtype:social-engineering; sid:6000079; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (snae-a5b7crbvb7akdtcc .z03 .azurefd .net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"snae-a5b7crbvb7akdtcc.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000080; classtype:social-engineering; sid:6000080; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (customer-sp-brantison1 .pages .dev/help/contact/678967077354235)"; flow:established,to_server; http.uri; content:"/help/contact/678967077354235"; startswith; fast_pattern; http.host; content:"customer-sp-brantison1.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000081; classtype:social-engineering; sid:6000081; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (satyamgupta121 .github .io/stake-prediction/)"; flow:established,to_server; http.uri; content:"/stake-prediction/"; startswith; fast_pattern; http.host; content:"satyamgupta121.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000082; classtype:social-engineering; sid:6000082; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (advertising-meta .program-ads-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"advertising-meta.program-ads-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000083; classtype:social-engineering; sid:6000083; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f .digitalmaillane .com/igit/4/6z5e5sez308nnj0brlz4c2zc5vf2pz1wqzmnfzybzrzk)"; flow:established,to_server; http.uri; content:"/igit/4/6z5e5sez308nnj0brlz4c2zc5vf2pz1wqzmnfzybzrzk"; startswith; fast_pattern; http.host; content:"f.digitalmaillane.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000084; classtype:social-engineering; sid:6000084; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id19239238 .invoice-ads-program .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id19239238.invoice-ads-program.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000085; classtype:social-engineering; sid:6000085; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aniket354 .github .io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"aniket354.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000086; classtype:social-engineering; sid:6000086; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id19239234 .invoice-ads-program .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id19239234.invoice-ads-program.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000087; classtype:social-engineering; sid:6000087; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nogllo .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nogllo.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000088; classtype:social-engineering; sid:6000088; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eugeniewun72-englichs302 .pages .dev/help/contact/743498979642437/)"; flow:established,to_server; http.uri; content:"/help/contact/743498979642437/"; startswith; fast_pattern; http.host; content:"eugeniewun72-englichs302.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000089; classtype:social-engineering; sid:6000089; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .web-git-erin-update-numericalinputs-uniswap .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.web-git-erin-update-numericalinputs-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000090; classtype:social-engineering; sid:6000090; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webctkkpn-3gla .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webctkkpn-3gla.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000091; classtype:social-engineering; sid:6000091; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (identity-hub .credit-agency-meta .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"identity-hub.credit-agency-meta.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000092; classtype:social-engineering; sid:6000092; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .robiox .com .py/users/244226404304/profile)"; flow:established,to_server; http.uri; content:"/users/244226404304/profile"; startswith; fast_pattern; http.host; content:"www.robiox.com.py"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000093; classtype:social-engineering; sid:6000093; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inner .website/x01770e170b9d04350u82b95e65qd63b2c8c .html)"; flow:established,to_server; http.uri; content:"/x01770e170b9d04350u82b95e65qd63b2c8c.html"; startswith; fast_pattern; http.host; content:"inner.website"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000094; classtype:social-engineering; sid:6000094; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (central-portal .credit-agency-meta .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"central-portal.credit-agency-meta.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000095; classtype:social-engineering; sid:6000095; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agency-meta .busines-help-center .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"agency-meta.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000096; classtype:social-engineering; sid:6000096; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (danaa-iindonesiaa .onn .my .id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"danaa-iindonesiaa.onn.my.id"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000097; classtype:social-engineering; sid:6000097; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (customer-sp-brantison1 .pages .dev/help/contact/390346491305421)"; flow:established,to_server; http.uri; content:"/help/contact/390346491305421"; startswith; fast_pattern; http.host; content:"customer-sp-brantison1.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000098; classtype:social-engineering; sid:6000098; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .robiox .com .py/users/368711310405/profile)"; flow:established,to_server; http.uri; content:"/users/368711310405/profile"; startswith; fast_pattern; http.host; content:"www.robiox.com.py"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000099; classtype:social-engineering; sid:6000099; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (client028 .business-agency-partners .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"client028.business-agency-partners.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000100; classtype:social-engineering; sid:6000100; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id19239235 .invoice-ads-program .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id19239235.invoice-ads-program.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000101; classtype:social-engineering; sid:6000101; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id19239242 .invoice-ads-program .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id19239242.invoice-ads-program.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000102; classtype:social-engineering; sid:6000102; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .auto-exchange-mail-npfs .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.auto-exchange-mail-npfs.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000103; classtype:social-engineering; sid:6000103; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klj .gangaoadmin .cyou/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"klj.gangaoadmin.cyou"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000104; classtype:social-engineering; sid:6000104; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17618 .invoice-ads-manager .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17618.invoice-ads-manager.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000105; classtype:social-engineering; sid:6000105; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (opnsea0penseamint46 .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"opnsea0penseamint46.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000106; classtype:social-engineering; sid:6000106; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (workspace-console .credit-agency-meta .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"workspace-console.credit-agency-meta.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000107; classtype:social-engineering; sid:6000107; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id19239240 .invoice-ads-program .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id19239240.invoice-ads-program.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000108; classtype:social-engineering; sid:6000108; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (teach .link/HTTPS-WWW-ROBLOX-COM)"; flow:established,to_server; http.uri; content:"/HTTPS-WWW-ROBLOX-COM"; startswith; fast_pattern; http.host; content:"teach.link"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000109; classtype:social-engineering; sid:6000109; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jexi-bank .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jexi-bank.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000110; classtype:social-engineering; sid:6000110; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uniglobalaccountsupportty .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uniglobalaccountsupportty.weebly.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000111; classtype:social-engineering; sid:6000111; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (citiretailservices .citibankonlline .com/?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 .eyJhdWQiOiJKb2tlbiIsImV4cCI6MTc3ODI4OTc4OSwiaWF0IjoxNzc4MjgyNTg5LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIzMm1ybDV2aXI3ZmpzZDViMWswb3Zua20iLCJuYmYiOjE3NzgyODI1ODksInRzIjoxNzc4MjgyNTg5NjU4MzUyfQ .QNf98IHW1RRG-Tew01BV5BMob6WpAxGI-8JfgeDmjeQ&sid=e02c35f6-4b34-11f1-8f94-e353ff0638ce/)"; flow:established,to_server; http.uri; content:"/?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTc3ODI4OTc4OSwiaWF0IjoxNzc4MjgyNTg5LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIzMm1ybDV2aXI3ZmpzZDViMWswb3Zua20iLCJuYmYiOjE3NzgyODI1ODksInRzIjoxNzc4MjgyNTg5NjU4MzUyfQ.QNf98IHW1RRG-Tew01BV5BMob6WpAxGI-8JfgeDmjeQ&sid=e02c35f6-4b34-11f1-8f94-e353ff0638ce/"; startswith; fast_pattern; http.host; content:"citiretailservices.citibankonlline.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000112; classtype:social-engineering; sid:6000112; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .microsoft761login .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.microsoft761login.weebly.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000113; classtype:social-engineering; sid:6000113; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (parakalanandhini .github .io/js/)"; flow:established,to_server; http.uri; content:"/js/"; startswith; fast_pattern; http.host; content:"parakalanandhini.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000114; classtype:social-engineering; sid:6000114; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login-plus .credit-agency-meta .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"login-plus.credit-agency-meta.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000115; classtype:social-engineering; sid:6000115; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (carloseletro .site .cineuai .xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"carloseletro.site.cineuai.xyz"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000116; classtype:social-engineering; sid:6000116; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id19239247 .invoice-ads-program .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id19239247.invoice-ads-program.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000117; classtype:social-engineering; sid:6000117; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sarvo-rixan-biz-paxru-zxgt22526r-pravix .pages .dev/system_violation_notification/)"; flow:established,to_server; http.uri; content:"/system_violation_notification/"; startswith; fast_pattern; http.host; content:"sarvo-rixan-biz-paxru-zxgt22526r-pravix.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000118; classtype:social-engineering; sid:6000118; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b222 .me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b222.me"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000119; classtype:social-engineering; sid:6000119; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (newsbwebmail .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"newsbwebmail.weebly.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000120; classtype:social-engineering; sid:6000120; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member17 .agency-ad-meta .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member17.agency-ad-meta.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000121; classtype:social-engineering; sid:6000121; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (morva-xanor-biz-dexra-zxhe22526d-glorix .pages .dev/system_violation_notification/)"; flow:established,to_server; http.uri; content:"/system_violation_notification/"; startswith; fast_pattern; http.host; content:"morva-xanor-biz-dexra-zxhe22526d-glorix.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000122; classtype:social-engineering; sid:6000122; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yimrbiz .shop/pdf/d%25/0/1/adb .html?msg=debtcounselling@)"; flow:established,to_server; http.uri; content:"/pdf/d%25/0/1/adb.html?msg=debtcounselling@"; startswith; fast_pattern; http.host; content:"yimrbiz.shop"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000123; classtype:social-engineering; sid:6000123; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (promotions .ppsmotors .co .in/file/drive/index .php)"; flow:established,to_server; http.uri; content:"/file/drive/index.php"; startswith; fast_pattern; http.host; content:"promotions.ppsmotors.co.in"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000124; classtype:social-engineering; sid:6000124; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .web-git-thomas-revertdd-uniswap .vercel .app/explore)"; flow:established,to_server; http.uri; content:"/explore"; startswith; fast_pattern; http.host; content:"www.web-git-thomas-revertdd-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000125; classtype:social-engineering; sid:6000125; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (digitalprocurements .com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"digitalprocurements.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000126; classtype:social-engineering; sid:6000126; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (billing-meta .program-ads-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"billing-meta.program-ads-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000127; classtype:social-engineering; sid:6000127; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .ledger-live-login-e7-en-us-cdn .vercel .app/ledger%20form/verify .html)"; flow:established,to_server; http.uri; content:"/ledger%20form/verify.html"; startswith; fast_pattern; http.host; content:"www.ledger-live-login-e7-en-us-cdn.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000128; classtype:social-engineering; sid:6000128; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-fbf3a87d05664d999912dfd2bd8b8dcc .r2 .dev/index .html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-fbf3a87d05664d999912dfd2bd8b8dcc.r2.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000129; classtype:social-engineering; sid:6000129; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (service-meta .accounts-admin-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"service-meta.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000130; classtype:social-engineering; sid:6000130; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inner .website/x6230c4290de194d93u84c15c8eqaf23f8fb .html)"; flow:established,to_server; http.uri; content:"/x6230c4290de194d93u84c15c8eqaf23f8fb.html"; startswith; fast_pattern; http.host; content:"inner.website"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000131; classtype:social-engineering; sid:6000131; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id19239244 .invoice-ads-program .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id19239244.invoice-ads-program.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000132; classtype:social-engineering; sid:6000132; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamkzlgano .gitbook .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metamkzlgano.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000133; classtype:social-engineering; sid:6000133; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sammyjay239 .github .io/AIRBNB-PROJECT/otherhtmlpages/amazingpool .html)"; flow:established,to_server; http.uri; content:"/AIRBNB-PROJECT/otherhtmlpages/amazingpool.html"; startswith; fast_pattern; http.host; content:"sammyjay239.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000134; classtype:social-engineering; sid:6000134; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .roblox .com .bi/users/871746524646/profile)"; flow:established,to_server; http.uri; content:"/users/871746524646/profile"; startswith; fast_pattern; http.host; content:"www.roblox.com.bi"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000135; classtype:social-engineering; sid:6000135; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (access-console .credit-agency-meta .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"access-console.credit-agency-meta.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000136; classtype:social-engineering; sid:6000136; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portail-dsi .fr/?rid=u0DAzZD)"; flow:established,to_server; http.uri; content:"/?rid=u0DAzZD"; startswith; fast_pattern; http.host; content:"portail-dsi.fr"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000137; classtype:social-engineering; sid:6000137; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .newsbwebmail .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.newsbwebmail.weebly.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000138; classtype:social-engineering; sid:6000138; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trust-wallet-0xbce9a2c916bw .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trust-wallet-0xbce9a2c916bw.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000139; classtype:social-engineering; sid:6000139; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .uniglobalaccountsupportty .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.uniglobalaccountsupportty.weebly.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000140; classtype:social-engineering; sid:6000140; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dhlexpress .ee/en/fraudulent-sms-alert)"; flow:established,to_server; http.uri; content:"/en/fraudulent-sms-alert"; startswith; fast_pattern; http.host; content:"dhlexpress.ee"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000141; classtype:social-engineering; sid:6000141; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id19239243 .invoice-ads-program .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id19239243.invoice-ads-program.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000142; classtype:social-engineering; sid:6000142; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (client-console .credit-agency-meta .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"client-console.credit-agency-meta.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000143; classtype:social-engineering; sid:6000143; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-confirmation .agency-manager-support .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-confirmation.agency-manager-support.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000144; classtype:social-engineering; sid:6000144; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suite-access .credit-agency-meta .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"suite-access.credit-agency-meta.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000145; classtype:social-engineering; sid:6000145; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kukoenvee-idd .gitbook .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kukoenvee-idd.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000146; classtype:social-engineering; sid:6000146; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (joyfullmint-drop3 .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"joyfullmint-drop3.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000147; classtype:social-engineering; sid:6000147; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .officialcherfanclub .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.officialcherfanclub.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000148; classtype:social-engineering; sid:6000148; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .web-git-thomas-revertdd-uniswap .vercel .app/swap)"; flow:established,to_server; http.uri; content:"/swap"; startswith; fast_pattern; http.host; content:"www.web-git-thomas-revertdd-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000149; classtype:social-engineering; sid:6000149; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aicc108-demo .pages .dev/title/70143836 .html)"; flow:established,to_server; http.uri; content:"/title/70143836.html"; startswith; fast_pattern; http.host; content:"aicc108-demo.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000150; classtype:social-engineering; sid:6000150; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (option-meta .accounts-admin-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"option-meta.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000151; classtype:social-engineering; sid:6000151; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auto-exchange-mail-npfs .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auto-exchange-mail-npfs.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000152; classtype:social-engineering; sid:6000152; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acceso-ya1 .webcindario .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"acceso-ya1.webcindario.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000153; classtype:social-engineering; sid:6000153; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .roblox .et/games/106375311448069/Chat-with-AI-Emiko?privateServerLinkCode=36528982249207831634559611416587)"; flow:established,to_server; http.uri; content:"/games/106375311448069/Chat-with-AI-Emiko?privateServerLinkCode=36528982249207831634559611416587"; startswith; fast_pattern; http.host; content:"www.roblox.et"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000154; classtype:social-engineering; sid:6000154; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (connect-core .credit-agency-meta .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"connect-core.credit-agency-meta.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000155; classtype:social-engineering; sid:6000155; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .kdmwj .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kdmwj.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000156; classtype:social-engineering; sid:6000156; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-code .bussines-partner-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-code.bussines-partner-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000157; classtype:social-engineering; sid:6000157; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox .com .kz/users/334614924/profile)"; flow:established,to_server; http.uri; content:"/users/334614924/profile"; startswith; fast_pattern; http.host; content:"roblox.com.kz"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000158; classtype:social-engineering; sid:6000158; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (makershfc73621423 .github .io/Instagram-login/)"; flow:established,to_server; http.uri; content:"/Instagram-login/"; startswith; fast_pattern; http.host; content:"makershfc73621423.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000159; classtype:social-engineering; sid:6000159; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login-ledgger-load-io-queue .vercel .app/ledger%20form/device .html)"; flow:established,to_server; http.uri; content:"/ledger%20form/device.html"; startswith; fast_pattern; http.host; content:"login-ledgger-load-io-queue.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000160; classtype:social-engineering; sid:6000160; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (debit-meta .accounts-admin-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"debit-meta.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000161; classtype:social-engineering; sid:6000161; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aicc108-demo .pages .dev/title/80036140 .html)"; flow:established,to_server; http.uri; content:"/title/80036140.html"; startswith; fast_pattern; http.host; content:"aicc108-demo.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000162; classtype:social-engineering; sid:6000162; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .robiox .com .py/users/444337147691/profile)"; flow:established,to_server; http.uri; content:"/users/444337147691/profile"; startswith; fast_pattern; http.host; content:"www.robiox.com.py"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000163; classtype:social-engineering; sid:6000163; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (private-access .credit-agency-meta .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"private-access.credit-agency-meta.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000164; classtype:social-engineering; sid:6000164; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .roblox .et/users/345217144/profile)"; flow:established,to_server; http.uri; content:"/users/345217144/profile"; startswith; fast_pattern; http.host; content:"www.roblox.et"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000165; classtype:social-engineering; sid:6000165; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .robiox .com .py/users/373199291273/profile)"; flow:established,to_server; http.uri; content:"/users/373199291273/profile"; startswith; fast_pattern; http.host; content:"www.robiox.com.py"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000166; classtype:social-engineering; sid:6000166; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-user23 .program-ads-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-user23.program-ads-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000167; classtype:social-engineering; sid:6000167; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (customer-sp-brantison1 .pages .dev/help/contact/170854986895580)"; flow:established,to_server; http.uri; content:"/help/contact/170854986895580"; startswith; fast_pattern; http.host; content:"customer-sp-brantison1.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000168; classtype:social-engineering; sid:6000168; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (microsoft .account .trustedentity .com/http:/microsoft .authorised-support .com/new-account/EOzAFbYj1bjLmgufSIlKJJR9Kpvsy5kc3UkY=3Ag==5WFxWR1pGWlNBallaUlxbakJcQV1qRVRGRkJaR1E=/6Xx5KG1mKRNjeU3rSnC8diFTM7R4V1de/)"; flow:established,to_server; http.uri; content:"/http:/microsoft.authorised-support.com/new-account/EOzAFbYj1bjLmgufSIlKJJR9Kpvsy5kc3UkY=3Ag==5WFxWR1pGWlNBallaUlxbakJcQV1qRVRGRkJaR1E=/6Xx5KG1mKRNjeU3rSnC8diFTM7R4V1de/"; startswith; fast_pattern; http.host; content:"microsoft.account.trustedentity.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000169; classtype:social-engineering; sid:6000169; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamkzlgano .gitbook .io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"metamkzlgano.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000170; classtype:social-engineering; sid:6000170; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth-console .credit-agency-meta .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auth-console.credit-agency-meta.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000171; classtype:social-engineering; sid:6000171; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pnckswqpwks .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pnckswqpwks.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000172; classtype:social-engineering; sid:6000172; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .kdmwj .com/dist/)"; flow:established,to_server; http.uri; content:"/dist/"; startswith; fast_pattern; http.host; content:"www.kdmwj.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000173; classtype:social-engineering; sid:6000173; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (identity-access .credit-agency-meta .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"identity-access.credit-agency-meta.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000174; classtype:social-engineering; sid:6000174; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .is .gd/Pex2mf/)"; flow:established,to_server; http.uri; content:"/Pex2mf/"; startswith; fast_pattern; http.host; content:"www.is.gd"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000175; classtype:social-engineering; sid:6000175; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .robiox .com .py/users/286671128158/profile)"; flow:established,to_server; http.uri; content:"/users/286671128158/profile"; startswith; fast_pattern; http.host; content:"www.robiox.com.py"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000176; classtype:social-engineering; sid:6000176; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aps-abesfreshie .github .io/Aps-abesfreshiep .github .io/)"; flow:established,to_server; http.uri; content:"/Aps-abesfreshiep.github.io/"; startswith; fast_pattern; http.host; content:"aps-abesfreshie.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000177; classtype:social-engineering; sid:6000177; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chalaalbretch-challa1 .pages .dev/help/contact/2572367898914052606:4700:310c%25 . . .)"; flow:established,to_server; http.uri; content:"/help/contact/2572367898914052606:4700:310c%25..."; startswith; fast_pattern; http.host; content:"chalaalbretch-challa1.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000178; classtype:social-engineering; sid:6000178; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aicc108-demo .pages .dev/title/81002370 .html)"; flow:established,to_server; http.uri; content:"/title/81002370.html"; startswith; fast_pattern; http.host; content:"aicc108-demo.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000179; classtype:social-engineering; sid:6000179; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt .flcbcs .help/track/it/)"; flow:established,to_server; http.uri; content:"/track/it/"; startswith; fast_pattern; http.host; content:"brt.flcbcs.help"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000180; classtype:social-engineering; sid:6000180; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiifkan-payllaterrs4 .from-resmi3 .my .id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiifkan-payllaterrs4.from-resmi3.my.id"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000181; classtype:social-engineering; sid:6000181; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd .malortrix .cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.malortrix.cfd"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000182; classtype:social-engineering; sid:6000182; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (david-houston3855463331 .pages .dev/help/contact/138288885999823/)"; flow:established,to_server; http.uri; content:"/help/contact/138288885999823/"; startswith; fast_pattern; http.host; content:"david-houston3855463331.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000183; classtype:social-engineering; sid:6000183; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (customer-sp-brantison1 .pages .dev/help/contact/111098134764485)"; flow:established,to_server; http.uri; content:"/help/contact/111098134764485"; startswith; fast_pattern; http.host; content:"customer-sp-brantison1.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000184; classtype:social-engineering; sid:6000184; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inner .website/104e0f6021ac9941affa1a9f3f1f3b57ef70 .html)"; flow:established,to_server; http.uri; content:"/104e0f6021ac9941affa1a9f3f1f3b57ef70.html"; startswith; fast_pattern; http.host; content:"inner.website"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000185; classtype:social-engineering; sid:6000185; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (norva-kelra-biz-sunor-zxha22526z-glanex .pages .dev/heartily_welcome?id=103892392070173&page_name=Monica%20A%20Garcia/)"; flow:established,to_server; http.uri; content:"/heartily_welcome?id=103892392070173&page_name=Monica%20A%20Garcia/"; startswith; fast_pattern; http.host; content:"norva-kelra-biz-sunor-zxha22526z-glanex.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000186; classtype:social-engineering; sid:6000186; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (command-cloud .space/whatsapp/)"; flow:established,to_server; http.uri; content:"/whatsapp/"; startswith; fast_pattern; http.host; content:"command-cloud.space"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000187; classtype:social-engineering; sid:6000187; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .web-git-thomas-revertdd-uniswap .vercel .app/positions)"; flow:established,to_server; http.uri; content:"/positions"; startswith; fast_pattern; http.host; content:"www.web-git-thomas-revertdd-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000188; classtype:social-engineering; sid:6000188; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aicc108-demo .pages .dev/title/81613903 .html)"; flow:established,to_server; http.uri; content:"/title/81613903.html"; startswith; fast_pattern; http.host; content:"aicc108-demo.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000189; classtype:social-engineering; sid:6000189; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aicc108-demo .pages .dev/title/70155584 .html)"; flow:established,to_server; http.uri; content:"/title/70155584.html"; startswith; fast_pattern; http.host; content:"aicc108-demo.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000190; classtype:social-engineering; sid:6000190; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (case0405twrqpm .syncpath-connectsrv .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"case0405twrqpm.syncpath-connectsrv.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000191; classtype:social-engineering; sid:6000191; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s3 .dualstack .us-east-1 .amazonaws .com/rtsrtgfsgvhgvjhsd5211gvvxtcj .067 .udjhss .jnxjnnjn/index .html)"; flow:established,to_server; http.uri; content:"/rtsrtgfsgvhgvjhsd5211gvvxtcj.067.udjhss.jnxjnnjn/index.html"; startswith; fast_pattern; http.host; content:"s3.dualstack.us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000192; classtype:social-engineering; sid:6000192; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robnhodlogox .gitbook .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"robnhodlogox.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000193; classtype:social-engineering; sid:6000193; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inner .website/74cb3b21cy8412457a8a7db33d6kc97065ca .html)"; flow:established,to_server; http.uri; content:"/74cb3b21cy8412457a8a7db33d6kc97065ca.html"; startswith; fast_pattern; http.host; content:"inner.website"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000194; classtype:social-engineering; sid:6000194; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwv-roblox .co/users/615630551/profile)"; flow:established,to_server; http.uri; content:"/users/615630551/profile"; startswith; fast_pattern; http.host; content:"wwv-roblox.co"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000195; classtype:social-engineering; sid:6000195; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maisaumentoparavoce .s3 .us-east-005 .backblazeb2 .com/aumento .html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"maisaumentoparavoce.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000196; classtype:social-engineering; sid:6000196; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .solutionfun .info/landingpage/cf1a9771-107e-471b-986d-361ea44c2f10/xsk53psqbrcsbx3tbjydsemzmjllzd0jtppsqfgavio)"; flow:established,to_server; http.uri; content:"/landingpage/cf1a9771-107e-471b-986d-361ea44c2f10/xsk53psqbrcsbx3tbjydsemzmjllzd0jtppsqfgavio"; startswith; fast_pattern; http.host; content:"www.solutionfun.info"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000197; classtype:social-engineering; sid:6000197; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreibyljmt5scyuoccu3ucintoqyfi33tvk6gvwng4pniq3pnoahrva4 .ipfs .dweb .link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreibyljmt5scyuoccu3ucintoqyfi33tvk6gvwng4pniq3pnoahrva4.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000198; classtype:social-engineering; sid:6000198; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox .et/communities/1109850503/KawaiPinkyCutes-Group)"; flow:established,to_server; http.uri; content:"/communities/1109850503/KawaiPinkyCutes-Group"; startswith; fast_pattern; http.host; content:"roblox.et"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000199; classtype:social-engineering; sid:6000199; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sarvo-rixan-biz-paxru-zxid22526e-glanex .pages .dev/system_violation_notification/)"; flow:established,to_server; http.uri; content:"/system_violation_notification/"; startswith; fast_pattern; http.host; content:"sarvo-rixan-biz-paxru-zxid22526e-glanex.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000200; classtype:social-engineering; sid:6000200; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (central-access .credit-agency-meta .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"central-access.credit-agency-meta.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000201; classtype:social-engineering; sid:6000201; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater .cdd .my .id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.cdd.my.id"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000202; classtype:social-engineering; sid:6000202; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (program-meta .busines-help-center .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"program-meta.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000203; classtype:social-engineering; sid:6000203; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fgxscvx .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fgxscvx.weebly.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000204; classtype:social-engineering; sid:6000204; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreihlqg7ney64hr6afams2d3aqwt7q7xh4l2tv6orjnzkaqa5bgbwb4 .ipfs .dweb .link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreihlqg7ney64hr6afams2d3aqwt7q7xh4l2tv6orjnzkaqa5bgbwb4.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000205; classtype:social-engineering; sid:6000205; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inner .website/x7e80386c0c9da4ac1uafba38ebq5e615e09 .html)"; flow:established,to_server; http.uri; content:"/x7e80386c0c9da4ac1uafba38ebq5e615e09.html"; startswith; fast_pattern; http.host; content:"inner.website"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000206; classtype:social-engineering; sid:6000206; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .robiox .com .ua/communities/6265103876/Xilo-Main)"; flow:established,to_server; http.uri; content:"/communities/6265103876/Xilo-Main"; startswith; fast_pattern; http.host; content:"www.robiox.com.ua"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000207; classtype:social-engineering; sid:6000207; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-enabled .bussines-partner-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-enabled.bussines-partner-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000208; classtype:social-engineering; sid:6000208; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (priyanshu-pandey97 .github .io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"priyanshu-pandey97.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000209; classtype:social-engineering; sid:6000209; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inner .website/x5118c60102cbd498cu89dc2773q5e7571b4 .html)"; flow:established,to_server; http.uri; content:"/x5118c60102cbd498cu89dc2773q5e7571b4.html"; startswith; fast_pattern; http.host; content:"inner.website"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000210; classtype:social-engineering; sid:6000210; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (execution-meta .accounts-admin-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"execution-meta.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000211; classtype:social-engineering; sid:6000211; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id19239237 .invoice-ads-program .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id19239237.invoice-ads-program.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000212; classtype:social-engineering; sid:6000212; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ninjafoux .github .io/Roblos/)"; flow:established,to_server; http.uri; content:"/Roblos/"; startswith; fast_pattern; http.host; content:"ninjafoux.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000213; classtype:social-engineering; sid:6000213; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (request-facebook .program-ads-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"request-facebook.program-ads-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000214; classtype:social-engineering; sid:6000214; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sammyjay239 .github .io/AIRBNB-PROJECT/otherhtmlpages/rooms .html)"; flow:established,to_server; http.uri; content:"/AIRBNB-PROJECT/otherhtmlpages/rooms.html"; startswith; fast_pattern; http.host; content:"sammyjay239.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000215; classtype:social-engineering; sid:6000215; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (client-access .credit-agency-meta .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"client-access.credit-agency-meta.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000216; classtype:social-engineering; sid:6000216; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (grp-atoiner-kalev .pages .dev/help/contact/140611966531816)"; flow:established,to_server; http.uri; content:"/help/contact/140611966531816"; startswith; fast_pattern; http.host; content:"grp-atoiner-kalev.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000217; classtype:social-engineering; sid:6000217; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-advertising .bussines-partner-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-advertising.bussines-partner-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000218; classtype:social-engineering; sid:6000218; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (creatlnlclestl355sn .iceiy .com/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"creatlnlclestl355sn.iceiy.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000219; classtype:social-engineering; sid:6000219; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (seller .jxvnxghg .cc/seller/)"; flow:established,to_server; http.uri; content:"/seller/"; startswith; fast_pattern; http.host; content:"seller.jxvnxghg.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000220; classtype:social-engineering; sid:6000220; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dd1 .qzz .io/dana/7j6ha/0h/)"; flow:established,to_server; http.uri; content:"/dana/7j6ha/0h/"; startswith; fast_pattern; http.host; content:"dd1.qzz.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000221; classtype:social-engineering; sid:6000221; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .battery-support-ledger-livelogin-e7 .vercel .app/ledger%20form/verify .html)"; flow:established,to_server; http.uri; content:"/ledger%20form/verify.html"; startswith; fast_pattern; http.host; content:"www.battery-support-ledger-livelogin-e7.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000222; classtype:social-engineering; sid:6000222; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spotifylogin-pha5m9wlk-gasstontorres .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spotifylogin-pha5m9wlk-gasstontorres.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000223; classtype:social-engineering; sid:6000223; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .robiox .com .py/users/248474341917/profile)"; flow:established,to_server; http.uri; content:"/users/248474341917/profile"; startswith; fast_pattern; http.host; content:"www.robiox.com.py"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000224; classtype:social-engineering; sid:6000224; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sarvo-drixa-biz-paxru-zxhq22526q-pravix .pages .dev/heartily_welcome?id=103892392070173&page_name=Monica%20A%20Garcia/)"; flow:established,to_server; http.uri; content:"/heartily_welcome?id=103892392070173&page_name=Monica%20A%20Garcia/"; startswith; fast_pattern; http.host; content:"sarvo-drixa-biz-paxru-zxhq22526q-pravix.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000225; classtype:social-engineering; sid:6000225; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id19239245 .invoice-ads-program .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id19239245.invoice-ads-program.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000226; classtype:social-engineering; sid:6000226; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-git-05-08-trystagingbutprobwillfailbcunauthe-c7b77b-uniswap .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-git-05-08-trystagingbutprobwillfailbcunauthe-c7b77b-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000227; classtype:social-engineering; sid:6000227; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (customer-sp-brantison1 .pages .dev/help/contact/883627422209385)"; flow:established,to_server; http.uri; content:"/help/contact/883627422209385"; startswith; fast_pattern; http.host; content:"customer-sp-brantison1.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000228; classtype:social-engineering; sid:6000228; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inner .website/j08ab4aa07e6964ca16b41083f675b13955b .html)"; flow:established,to_server; http.uri; content:"/j08ab4aa07e6964ca16b41083f675b13955b.html"; startswith; fast_pattern; http.host; content:"inner.website"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000229; classtype:social-engineering; sid:6000229; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-setup .bussines-partner-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-setup.bussines-partner-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000230; classtype:social-engineering; sid:6000230; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (geva58375 .github .io/xf/)"; flow:established,to_server; http.uri; content:"/xf/"; startswith; fast_pattern; http.host; content:"geva58375.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000231; classtype:social-engineering; sid:6000231; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inner .website/xa13e26f80592247c3u8dc699a6qdbea4a99 .html)"; flow:established,to_server; http.uri; content:"/xa13e26f80592247c3u8dc699a6qdbea4a99.html"; startswith; fast_pattern; http.host; content:"inner.website"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000232; classtype:social-engineering; sid:6000232; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (partner-console .credit-agency-meta .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"partner-console.credit-agency-meta.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000233; classtype:social-engineering; sid:6000233; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help-doc-trezor-suite .gitbook .io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"help-doc-trezor-suite.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000234; classtype:social-engineering; sid:6000234; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f .digitalmaillane .com/igit/4/2l9ligwtvjxaifw7nht08ytptp1sxhtxsmtljbtu7tntg)"; flow:established,to_server; http.uri; content:"/igit/4/2l9ligwtvjxaifw7nht08ytptp1sxhtxsmtljbtu7tntg"; startswith; fast_pattern; http.host; content:"f.digitalmaillane.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000235; classtype:social-engineering; sid:6000235; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (central-hub .credit-agency-meta .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"central-hub.credit-agency-meta.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000236; classtype:social-engineering; sid:6000236; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .wells-fargo .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.wells-fargo.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000237; classtype:social-engineering; sid:6000237; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (application-meta .accounts-admin-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"application-meta.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000238; classtype:social-engineering; sid:6000238; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mmsnverificationserver .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mmsnverificationserver.weebly.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000239; classtype:social-engineering; sid:6000239; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accessportal-credentials02 .buddyl .workers .dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"accessportal-credentials02.buddyl.workers.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000240; classtype:social-engineering; sid:6000240; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ayanaanonaeem .github .io/Netflix/)"; flow:established,to_server; http.uri; content:"/Netflix/"; startswith; fast_pattern; http.host; content:"ayanaanonaeem.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000241; classtype:social-engineering; sid:6000241; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (setting-meta .busines-help-center .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"setting-meta.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000242; classtype:social-engineering; sid:6000242; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c .4qw .nl/hy9zL99KGLitGx1U2x85mtKDNsPgf7HV/)"; flow:established,to_server; http.uri; content:"/hy9zL99KGLitGx1U2x85mtKDNsPgf7HV/"; startswith; fast_pattern; http.host; content:"c.4qw.nl"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000243; classtype:social-engineering; sid:6000243; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lzrst4345fd .fer5rtef .workers .dev/verify .html)"; flow:established,to_server; http.uri; content:"/verify.html"; startswith; fast_pattern; http.host; content:"lzrst4345fd.fer5rtef.workers.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000244; classtype:social-engineering; sid:6000244; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (palshah112007 .github .io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"palshah112007.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000245; classtype:social-engineering; sid:6000245; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id1768 .invoice-ads-manager .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id1768.invoice-ads-manager.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000246; classtype:social-engineering; sid:6000246; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-user24 .program-ads-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-user24.program-ads-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000247; classtype:social-engineering; sid:6000247; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ashton564 .github .io/BT .html)"; flow:established,to_server; http.uri; content:"/BT.html"; startswith; fast_pattern; http.host; content:"ashton564.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000248; classtype:social-engineering; sid:6000248; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (core-workspace .credit-agency-meta .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"core-workspace.credit-agency-meta.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000249; classtype:social-engineering; sid:6000249; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anubhav1450 .github .io/Javascript-Amazon-Project/)"; flow:established,to_server; http.uri; content:"/Javascript-Amazon-Project/"; startswith; fast_pattern; http.host; content:"anubhav1450.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000250; classtype:social-engineering; sid:6000250; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rva .ann .mybluehost .me/\;frfr/758e91f87bd6bd88d563/nkl-log .php)"; flow:established,to_server; http.uri; content:"/|3b|frfr/758e91f87bd6bd88d563/nkl-log.php"; startswith; fast_pattern; http.host; content:"rva.ann.mybluehost.me"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000251; classtype:social-engineering; sid:6000251; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-git-thomas-revertdd-uniswap .vercel .app/positions/create/v4)"; flow:established,to_server; http.uri; content:"/positions/create/v4"; startswith; fast_pattern; http.host; content:"web-git-thomas-revertdd-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000252; classtype:social-engineering; sid:6000252; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amanalpha001-tech .github .io/Fb-Log-in-page/)"; flow:established,to_server; http.uri; content:"/Fb-Log-in-page/"; startswith; fast_pattern; http.host; content:"amanalpha001-tech.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000253; classtype:social-engineering; sid:6000253; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s3-external-2 .amazonaws .com/rtsrtgfsgvhgvjhsd5211gvvxtcj .068 .udjhss .jnxjnnjn/index .html)"; flow:established,to_server; http.uri; content:"/rtsrtgfsgvhgvjhsd5211gvvxtcj.068.udjhss.jnxjnnjn/index.html"; startswith; fast_pattern; http.host; content:"s3-external-2.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000254; classtype:social-engineering; sid:6000254; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id19239241 .invoice-ads-program .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id19239241.invoice-ads-program.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000255; classtype:social-engineering; sid:6000255; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id19239246 .invoice-ads-program .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id19239246.invoice-ads-program.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000256; classtype:social-engineering; sid:6000256; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (microsoft761login .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"microsoft761login.weebly.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000257; classtype:social-engineering; sid:6000257; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (newspubgm .speciallshop .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"newspubgm.speciallshop.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000258; classtype:social-engineering; sid:6000258; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member08 .marketing-agency-network .com/url=)"; flow:established,to_server; http.uri; content:"/url="; startswith; fast_pattern; http.host; content:"member08.marketing-agency-network.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000259; classtype:social-engineering; sid:6000259; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (finleyal .github .io/a1/)"; flow:established,to_server; http.uri; content:"/a1/"; startswith; fast_pattern; http.host; content:"finleyal.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000260; classtype:social-engineering; sid:6000260; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .vjusqe .shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.vjusqe.shop"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000261; classtype:social-engineering; sid:6000261; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-confirmation .bussines-partner-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-confirmation.bussines-partner-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000262; classtype:social-engineering; sid:6000262; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xcosttumer-indodnan .stormiexyz .my .id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xcosttumer-indodnan.stormiexyz.my.id"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000263; classtype:social-engineering; sid:6000263; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id1765 .invoice-ads-manager .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id1765.invoice-ads-manager.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000264; classtype:social-engineering; sid:6000264; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (request-meta .busines-help-center .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"request-meta.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000265; classtype:social-engineering; sid:6000265; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-authorized .bussines-partner-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-authorized.bussines-partner-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000266; classtype:social-engineering; sid:6000266; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (votre .espacereservationlbc .info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"votre.espacereservationlbc.info"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000267; classtype:social-engineering; sid:6000267; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox .com .kz/users/1106943092/profilec)"; flow:established,to_server; http.uri; content:"/users/1106943092/profilec"; startswith; fast_pattern; http.host; content:"roblox.com.kz"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000268; classtype:social-engineering; sid:6000268; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (action-meta .accounts-admin-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"action-meta.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000269; classtype:social-engineering; sid:6000269; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .robiox .com .py/users/114818963756/profile)"; flow:established,to_server; http.uri; content:"/users/114818963756/profile"; startswith; fast_pattern; http.host; content:"www.robiox.com.py"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000270; classtype:social-engineering; sid:6000270; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tool-meta .accounts-admin-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tool-meta.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000271; classtype:social-engineering; sid:6000271; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .robiox .com .gr/users/4590069184/profile)"; flow:established,to_server; http.uri; content:"/users/4590069184/profile"; startswith; fast_pattern; http.host; content:"www.robiox.com.gr"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000272; classtype:social-engineering; sid:6000272; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .roblox .et/users/9303344010/profile)"; flow:established,to_server; http.uri; content:"/users/9303344010/profile"; startswith; fast_pattern; http.host; content:"www.roblox.et"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000273; classtype:social-engineering; sid:6000273; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .roblox .et/users/8420644668/profile)"; flow:established,to_server; http.uri; content:"/users/8420644668/profile"; startswith; fast_pattern; http.host; content:"www.roblox.et"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000274; classtype:social-engineering; sid:6000274; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwv-roblox .co/login?returlUrl=10444741951)"; flow:established,to_server; http.uri; content:"/login?returlUrl=10444741951"; startswith; fast_pattern; http.host; content:"wwv-roblox.co"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000275; classtype:social-engineering; sid:6000275; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .abnbrent-website .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.abnbrent-website.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000276; classtype:social-engineering; sid:6000276; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (seller .jxvnxghg .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"seller.jxvnxghg.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000277; classtype:social-engineering; sid:6000277; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .roblox .com .et/users/205280963510/profile)"; flow:established,to_server; http.uri; content:"/users/205280963510/profile"; startswith; fast_pattern; http.host; content:"www.roblox.com.et"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000278; classtype:social-engineering; sid:6000278; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .roblox .com .bn/users/178585097306/profile)"; flow:established,to_server; http.uri; content:"/users/178585097306/profile"; startswith; fast_pattern; http.host; content:"www.roblox.com.bn"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000279; classtype:social-engineering; sid:6000279; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aicc108-demo .pages .dev/title/70155590 .html)"; flow:established,to_server; http.uri; content:"/title/70155590.html"; startswith; fast_pattern; http.host; content:"aicc108-demo.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000280; classtype:social-engineering; sid:6000280; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id19239239 .invoice-ads-program .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id19239239.invoice-ads-program.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000281; classtype:social-engineering; sid:6000281; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .roblox .com .bi/games/17625359962/-RIVALS?privateServerLinkCode=47815123988921703605395428994914)"; flow:established,to_server; http.uri; content:"/games/17625359962/-RIVALS?privateServerLinkCode=47815123988921703605395428994914"; startswith; fast_pattern; http.host; content:"www.roblox.com.bi"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000282; classtype:social-engineering; sid:6000282; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .robiox .com .py/users/179401810451/profile)"; flow:established,to_server; http.uri; content:"/users/179401810451/profile"; startswith; fast_pattern; http.host; content:"www.robiox.com.py"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000283; classtype:social-engineering; sid:6000283; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (service-access .credit-agency-meta .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"service-access.credit-agency-meta.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000284; classtype:social-engineering; sid:6000284; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trust-access .credit-agency-meta .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trust-access.credit-agency-meta.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000285; classtype:social-engineering; sid:6000285; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member001 .business-ad-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member001.business-ad-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000286; classtype:social-engineering; sid:6000286; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17612 .invoice-ads-manager .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17612.invoice-ads-manager.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000287; classtype:social-engineering; sid:6000287; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id1769 .invoice-ads-manager .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id1769.invoice-ads-manager.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000288; classtype:social-engineering; sid:6000288; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .joyfullmint-drop3 .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.joyfullmint-drop3.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000289; classtype:social-engineering; sid:6000289; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-backup .bussines-partner-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-backup.bussines-partner-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000290; classtype:social-engineering; sid:6000290; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .web-git-thomas-revertdd-uniswap .vercel .app/portfolio)"; flow:established,to_server; http.uri; content:"/portfolio"; startswith; fast_pattern; http.host; content:"www.web-git-thomas-revertdd-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000291; classtype:social-engineering; sid:6000291; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (69faf1f96e16da18b0206fec--chimerical-custard-0c06e1 .netlify .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"69faf1f96e16da18b0206fec--chimerical-custard-0c06e1.netlify.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000292; classtype:social-engineering; sid:6000292; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .robiox .com .py/users/285605283867/profile)"; flow:established,to_server; http.uri; content:"/users/285605283867/profile"; startswith; fast_pattern; http.host; content:"www.robiox.com.py"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000293; classtype:social-engineering; sid:6000293; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sequence .leovenuestyle .com/app/wap/)"; flow:established,to_server; http.uri; content:"/app/wap/"; startswith; fast_pattern; http.host; content:"sequence.leovenuestyle.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000294; classtype:social-engineering; sid:6000294; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (veyra34 .github .io/Netflix-Ui-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Ui-Clone/"; startswith; fast_pattern; http.host; content:"veyra34.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000295; classtype:social-engineering; sid:6000295; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .robiox .com .py/games/2788229376/Da-Hood?privateServerLinkCode=373957664894834871433472041643)"; flow:established,to_server; http.uri; content:"/games/2788229376/Da-Hood?privateServerLinkCode=373957664894834871433472041643"; startswith; fast_pattern; http.host; content:"www.robiox.com.py"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000296; classtype:social-engineering; sid:6000296; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17614 .invoice-ads-manager .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17614.invoice-ads-manager.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000297; classtype:social-engineering; sid:6000297; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-git-erin-update-numericalinputs-uniswap .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-git-erin-update-numericalinputs-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000298; classtype:social-engineering; sid:6000298; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inner .website/xd06ae9a40497b4f2eua1c7645cq43c4d9bd .html)"; flow:established,to_server; http.uri; content:"/xd06ae9a40497b4f2eua1c7645cq43c4d9bd.html"; startswith; fast_pattern; http.host; content:"inner.website"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000299; classtype:social-engineering; sid:6000299; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bagi-bagi-hadiah59 .blogspot .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bagi-bagi-hadiah59.blogspot.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000300; classtype:social-engineering; sid:6000300; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id19239236 .invoice-ads-program .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id19239236.invoice-ads-program.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000301; classtype:social-engineering; sid:6000301; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafybeicn6mzxxz6l3zwgc2grdzbgery6drslhpte7eo26byfnm64bcclty .ipfs .dweb .link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafybeicn6mzxxz6l3zwgc2grdzbgery6drslhpte7eo26byfnm64bcclty.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000302; classtype:social-engineering; sid:6000302; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-control .bussines-partner-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-control.bussines-partner-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000303; classtype:social-engineering; sid:6000303; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aicc108-demo .pages .dev/title/80104434 .html)"; flow:established,to_server; http.uri; content:"/title/80104434.html"; startswith; fast_pattern; http.host; content:"aicc108-demo.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000304; classtype:social-engineering; sid:6000304; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help-doc-trezor-suite .gitbook .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"help-doc-trezor-suite.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000305; classtype:social-engineering; sid:6000305; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (profile-space .credit-agency-meta .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"profile-space.credit-agency-meta.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000306; classtype:social-engineering; sid:6000306; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aicc108-demo .pages .dev/title/70136123 .html)"; flow:established,to_server; http.uri; content:"/title/70136123.html"; startswith; fast_pattern; http.host; content:"aicc108-demo.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000307; classtype:social-engineering; sid:6000307; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (team-meta .accounts-admin-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"team-meta.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000308; classtype:social-engineering; sid:6000308; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreidgrzz5a5olpbqqm66sjo442pfrbkrq4obr54gf2zhh4rxh3bdq5u .ipfs .dweb .link/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"bafkreidgrzz5a5olpbqqm66sjo442pfrbkrq4obr54gf2zhh4rxh3bdq5u.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000309; classtype:social-engineering; sid:6000309; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aicc108-demo .pages .dev/title/80217863 .html)"; flow:established,to_server; http.uri; content:"/title/80217863.html"; startswith; fast_pattern; http.host; content:"aicc108-demo.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000310; classtype:social-engineering; sid:6000310; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member1196445 .agency-connect-center .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member1196445.agency-connect-center.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000311; classtype:social-engineering; sid:6000311; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clone-facebook-ten .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"clone-facebook-ten.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000312; classtype:social-engineering; sid:6000312; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login-ledgger-load-io-ios .vercel .app/ledger%20form/verify .html)"; flow:established,to_server; http.uri; content:"/ledger%20form/verify.html"; startswith; fast_pattern; http.host; content:"login-ledgger-load-io-ios.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000313; classtype:social-engineering; sid:6000313; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (media-meta .program-ads-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"media-meta.program-ads-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000314; classtype:social-engineering; sid:6000314; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail .alertas-de-viaje .mx/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"webmail.alertas-de-viaje.mx"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000315; classtype:social-engineering; sid:6000315; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17613 .invoice-ads-manager .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17613.invoice-ads-manager.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000316; classtype:social-engineering; sid:6000316; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sushmagithubbhat .github .io/Sushma_shop/)"; flow:established,to_server; http.uri; content:"/Sushma_shop/"; startswith; fast_pattern; http.host; content:"sushmagithubbhat.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000317; classtype:social-engineering; sid:6000317; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .888993 .vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.888993.vip"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000318; classtype:social-engineering; sid:6000318; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (profile-hub .credit-agency-meta .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"profile-hub.credit-agency-meta.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000319; classtype:social-engineering; sid:6000319; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .roblox .et/communities/505991951/famous-fashion-2)"; flow:established,to_server; http.uri; content:"/communities/505991951/famous-fashion-2"; startswith; fast_pattern; http.host; content:"www.roblox.et"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000320; classtype:social-engineering; sid:6000320; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .help-liveledger-login-wallet-extens-zeta .vercel .app/ledger%20form/verify .html)"; flow:established,to_server; http.uri; content:"/ledger%20form/verify.html"; startswith; fast_pattern; http.host; content:"www.help-liveledger-login-wallet-extens-zeta.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000321; classtype:social-engineering; sid:6000321; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .stranoparts .com/partdetails .php?ModelID=%22%2F%3E%3Cimg%20src%3D%22https%3A%2F%2Fgoogle .com%2F6dDltYqxi7ROW .jpg%22%20onerror%3D%22window .location%3DdecodeURIComponent%28atob%28%27Njg3NDc0NzA3MzNhMmYyZjc2NjE2MzdhNmMyZTczNzA2MTcyNmI2MTczNzM2NTJlNzE3MDZmNmU%3D%27%29 .replace%28%2F%28 . .%29%2Fg%2C%20%27%25%241%27%29%29%3B%22%3E)"; flow:established,to_server; http.uri; content:"/partdetails.php?ModelID=%22%2F%3E%3Cimg%20src%3D%22https%3A%2F%2Fgoogle.com%2F6dDltYqxi7ROW.jpg%22%20onerror%3D%22window.location%3DdecodeURIComponent%28atob%28%27Njg3NDc0NzA3MzNhMmYyZjc2NjE2MzdhNmMyZTczNzA2MTcyNmI2MTczNzM2NTJlNzE3MDZmNmU%3D%27%29.replace%28%2F%28..%29%2Fg%2C%20%27%25%241%27%29%29%3B%22%3E"; startswith; fast_pattern; http.host; content:"www.stranoparts.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000322; classtype:social-engineering; sid:6000322; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ersfilter-my .sharepoint .com/personal/nradonich_ersfilter_com/_layouts/15/doc .aspx?guestaccesstoken=t6T%2FHN1dKbYHlYX%2BeIMbaZufA43rrGZ6%2FaAAewNocDI%3D&docid=1_18168db23429e45f29fdf2e7be120efc4&wdFormId=%7BB9970F62-44C3-4D09-9929-6E1EB652DA57%7D&action=formsubmit&CID=7c889288-793f-4e2b-b7c4-fed5506273ef)"; flow:established,to_server; http.uri; content:"/personal/nradonich_ersfilter_com/_layouts/15/doc.aspx?guestaccesstoken=t6T%2FHN1dKbYHlYX%2BeIMbaZufA43rrGZ6%2FaAAewNocDI%3D&docid=1_18168db23429e45f29fdf2e7be120efc4&wdFormId=%7BB9970F62-44C3-4D09-9929-6E1EB652DA57%7D&action=formsubmit&CID=7c889288-793f-4e2b-b7c4-fed5506273ef"; startswith; fast_pattern; http.host; content:"ersfilter-my.sharepoint.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000323; classtype:social-engineering; sid:6000323; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (op-e0e .geohourly .com/v/)"; flow:established,to_server; http.uri; content:"/v/"; startswith; fast_pattern; http.host; content:"op-e0e.geohourly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000324; classtype:social-engineering; sid:6000324; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smmp-de .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"smmp-de.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000325; classtype:social-engineering; sid:6000325; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (onet121 .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"onet121.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000326; classtype:social-engineering; sid:6000326; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-4abcdb5ef217475eb598c7fd9e6d205b .r2 .dev/index .html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-4abcdb5ef217475eb598c7fd9e6d205b.r2.dev"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000327; classtype:social-engineering; sid:6000327; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (49 .51 .43 .12/v3/signin/identifier?amp%3Bfollowup=https%3A%2F%2Faccounts .google .com&%3Bifkv=AWnogHe_pDujLaO-hl3d_3DQFjS6PW6JGM3LRrD13mxmiaQWTJuHz9b6nwmaSIh76M5SMOelnJex7g&%3Bpassive=1209600&continue=https%3A%2F%2Faccounts .google .com%2F&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2Pav4a5xoguuXZ6e9hTNmmZY1TsU4p8yfdfgL3ZFGkdYyazY9GZ7HWCwc_rPmUAIRlzJ1o40ggQ&dsh=S1963348150%3A1778385692872888)"; flow:established,to_server; http.uri; content:"/v3/signin/identifier?amp%3Bfollowup=https%3A%2F%2Faccounts.google.com&%3Bifkv=AWnogHe_pDujLaO-hl3d_3DQFjS6PW6JGM3LRrD13mxmiaQWTJuHz9b6nwmaSIh76M5SMOelnJex7g&%3Bpassive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2Pav4a5xoguuXZ6e9hTNmmZY1TsU4p8yfdfgL3ZFGkdYyazY9GZ7HWCwc_rPmUAIRlzJ1o40ggQ&dsh=S1963348150%3A1778385692872888"; startswith; fast_pattern; http.host; content:"49.51.43.12"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000328; classtype:social-engineering; sid:6000328; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bndbbcgdgdrecvdf .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bndbbcgdgdrecvdf.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000329; classtype:social-engineering; sid:6000329; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imagoproperties .ro/corpnetb .secure/portal .nedline/rmcsn/regulctcn .php?MTc3ODM4NDIyOTFlYjg2ZmE3Y2I3ZDBmZWJhYTFlN2RkMmIyNTE4MDg1NjFmNmZhMDNiNjA1ZGY4NzA0NDFiNjg3OTA3Njg4MmQwZmQ2ODgxZA==)"; flow:established,to_server; http.uri; content:"/corpnetb.secure/portal.nedline/rmcsn/regulctcn.php?MTc3ODM4NDIyOTFlYjg2ZmE3Y2I3ZDBmZWJhYTFlN2RkMmIyNTE4MDg1NjFmNmZhMDNiNjA1ZGY4NzA0NDFiNjg3OTA3Njg4MmQwZmQ2ODgxZA=="; startswith; fast_pattern; http.host; content:"imagoproperties.ro"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000330; classtype:social-engineering; sid:6000330; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .ne12bradesconetempresapj .com/acesso-seguro .php?token=2870808736a002b6fe5ffd8 .25305954)"; flow:established,to_server; http.uri; content:"/acesso-seguro.php?token=2870808736a002b6fe5ffd8.25305954"; startswith; fast_pattern; http.host; content:"www.ne12bradesconetempresapj.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000331; classtype:social-engineering; sid:6000331; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie .oferta29442659 .shop/oferta/apple-watch-ultra-2-49-mm-titanium?id=9i7v4m2f2w0v9r8q6m4x9k8a5d1m5o8h)"; flow:established,to_server; http.uri; content:"/oferta/apple-watch-ultra-2-49-mm-titanium?id=9i7v4m2f2w0v9r8q6m4x9k8a5d1m5o8h"; startswith; fast_pattern; http.host; content:"allegrolokalnie.oferta29442659.shop"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000332; classtype:social-engineering; sid:6000332; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (server-maintenance505 .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"server-maintenance505.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000333; classtype:social-engineering; sid:6000333; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (43 .134 .178 .58/v3/signin/identifier?amp%3Bfollowup=https%3A%2F%2Faccounts .google .com%2F%3F&%3Bpassive=1209600&%3Bxrealip=107 .178 .231 .253&continue=https%3A%2F%2Faccounts .google .com%2F%3F&dsh=S1245160496%3A1778384330204826&xrealip=138 .197 .91 .206&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2Pas-_xLXUcHwvQNUxNV9CBv5leyqmzepQhOcwNysbl6RjVdZhoUBuUPYYpS3aGT_dkamBaWroQ)"; flow:established,to_server; http.uri; content:"/v3/signin/identifier?amp%3Bfollowup=https%3A%2F%2Faccounts.google.com%2F%3F&%3Bpassive=1209600&%3Bxrealip=107.178.231.253&continue=https%3A%2F%2Faccounts.google.com%2F%3F&dsh=S1245160496%3A1778384330204826&xrealip=138.197.91.206&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2Pas-_xLXUcHwvQNUxNV9CBv5leyqmzepQhOcwNysbl6RjVdZhoUBuUPYYpS3aGT_dkamBaWroQ"; startswith; fast_pattern; http.host; content:"43.134.178.58"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000334; classtype:social-engineering; sid:6000334; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jensites .com/bbr/site/index .php?cat=%22%2F%3E%3Cimg%20src%3D%22https%3A%2F%2Fgoogle .com%2FTTXABi1vh1l4b .jpg%22%20onerror%3D%22window .location%3DdecodeURIComponent%28atob%28%27Njg3NDc0NzA3MzNhMmYyZjZkNjQ2YzZlNzM3Njc5MmU3MzcwNjE3MjZiNjE3MzczNjUyZDY0NjUyZTYzNjY2NDJmNjU3MjZlNjU3NTY1NzI2ZTJlNzA2ODcw%27%29 .replace%28%2F%28 . .%29%2Fg%2C%20%27%25%241%27%29%29%3B%22%3E)"; flow:established,to_server; http.uri; content:"/bbr/site/index.php?cat=%22%2F%3E%3Cimg%20src%3D%22https%3A%2F%2Fgoogle.com%2FTTXABi1vh1l4b.jpg%22%20onerror%3D%22window.location%3DdecodeURIComponent%28atob%28%27Njg3NDc0NzA3MzNhMmYyZjZkNjQ2YzZlNzM3Njc5MmU3MzcwNjE3MjZiNjE3MzczNjUyZDY0NjUyZTYzNjY2NDJmNjU3MjZlNjU3NTY1NzI2ZTJlNzA2ODcw%27%29.replace%28%2F%28..%29%2Fg%2C%20%27%25%241%27%29%29%3B%22%3E"; startswith; fast_pattern; http.host; content:"jensites.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000335; classtype:social-engineering; sid:6000335; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j28t .site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j28t.site"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000336; classtype:social-engineering; sid:6000336; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .lihotstovebaseball .org/leagues .php?id=%22%2F%3E%3Cimg%20src%3D%22https%3A%2F%2Fgoogle .com%2FI3Tq8pXMxhWFg .jpg%22%20onerror%3D%22window .location%3DdecodeURIComponent%28atob%28%27Njg3NDc0NzA3MzNhMmYyZjY2Njg2ZDY0Nzk3MTc0NmUyZTczNzA2MTcyNmI2MTczNzM2NTJkNjQ2NTJlNjM2NjY0MmY2NTcyNmU2NTc1NjU3MjZlMmU3MDY4NzA%3D%27%29 .replace%28%2F%28 . .%29%2Fg%2C%20%27%25%241%27%29%29%3B%22%3E)"; flow:established,to_server; http.uri; content:"/leagues.php?id=%22%2F%3E%3Cimg%20src%3D%22https%3A%2F%2Fgoogle.com%2FI3Tq8pXMxhWFg.jpg%22%20onerror%3D%22window.location%3DdecodeURIComponent%28atob%28%27Njg3NDc0NzA3MzNhMmYyZjY2Njg2ZDY0Nzk3MTc0NmUyZTczNzA2MTcyNmI2MTczNzM2NTJkNjQ2NTJlNjM2NjY0MmY2NTcyNmU2NTc1NjU3MjZlMmU3MDY4NzA%3D%27%29.replace%28%2F%28..%29%2Fg%2C%20%27%25%241%27%29%29%3B%22%3E"; startswith; fast_pattern; http.host; content:"www.lihotstovebaseball.org"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000337; classtype:social-engineering; sid:6000337; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (g83u .site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"g83u.site"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000338; classtype:social-engineering; sid:6000338; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (linha-brancaofc6 .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"linha-brancaofc6.vercel.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000339; classtype:social-engineering; sid:6000339; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portal .yu3 .app/public/redirect/?u=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9 .eyJ0YXJnZXQiOiJVM0JoYlNCVlVrd2daR1YwWldOMFpXUTZJRk5QUTBsQlRGOUZUa2RKVGtWRlVrbE9Sdz09IiwiZXhwIjoxNzc4NDI3MDI5LCJpYXQiOjE3Nzg0MjY5Njl9 .CdHoUtFc-79l9hM1SBwN_9JUg9jbbja1s-d8CRJjOeAv5GFoARw95TwKjbPIRgiRfktr0VU6QsO3nbts4ExHQRoPfVuaJHo-yq_YIWo3c8itonBvJQbk20Cw17eoNqGxQ7TZvNQP-aKP9OjmGIsmTKMifn5TJVGmYHAMGVfFVvnql_EwZ7MxdL_gQViBVzZaOmGf-1H-16efQA0MVaEHs7kxlfxcWNLgW9Yu3aW5IWr-AgAx5iir3oiSfgNIuUkoFut1ys4zrZiy6OMn5qIDaN7Rm7YPS6YmMpxDnIeGr1PsDmo6sS44q61JDi_BLBuMc-R2q4ENhuyTc1WJ4pQKMQ&suspended=true)"; flow:established,to_server; http.uri; content:"/public/redirect/?u=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0YXJnZXQiOiJVM0JoYlNCVlVrd2daR1YwWldOMFpXUTZJRk5QUTBsQlRGOUZUa2RKVGtWRlVrbE9Sdz09IiwiZXhwIjoxNzc4NDI3MDI5LCJpYXQiOjE3Nzg0MjY5Njl9.CdHoUtFc-79l9hM1SBwN_9JUg9jbbja1s-d8CRJjOeAv5GFoARw95TwKjbPIRgiRfktr0VU6QsO3nbts4ExHQRoPfVuaJHo-yq_YIWo3c8itonBvJQbk20Cw17eoNqGxQ7TZvNQP-aKP9OjmGIsmTKMifn5TJVGmYHAMGVfFVvnql_EwZ7MxdL_gQViBVzZaOmGf-1H-16efQA0MVaEHs7kxlfxcWNLgW9Yu3aW5IWr-AgAx5iir3oiSfgNIuUkoFut1ys4zrZiy6OMn5qIDaN7Rm7YPS6YmMpxDnIeGr1PsDmo6sS44q61JDi_BLBuMc-R2q4ENhuyTc1WJ4pQKMQ&suspended=true"; startswith; fast_pattern; http.host; content:"portal.yu3.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000340; classtype:social-engineering; sid:6000340; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6 .accessbenefitscenter .com/journey?rdrx=1&s=08c2594f-6b29-40fc-a349-1e2e56f869af#back)"; flow:established,to_server; http.uri; content:"/journey?rdrx=1&s=08c2594f-6b29-40fc-a349-1e2e56f869af#back"; startswith; fast_pattern; http.host; content:"6.accessbenefitscenter.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000341; classtype:social-engineering; sid:6000341; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (snyhhh-m .github .io/project_frontend)"; flow:established,to_server; http.uri; content:"/project_frontend"; startswith; fast_pattern; http.host; content:"snyhhh-m.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000342; classtype:social-engineering; sid:6000342; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee3899 .blogspot .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopee3899.blogspot.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000343; classtype:social-engineering; sid:6000343; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mbhytamask-walt .gitbook .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mbhytamask-walt.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000344; classtype:social-engineering; sid:6000344; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17619 .invoice-ads-manager .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17619.invoice-ads-manager.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000345; classtype:social-engineering; sid:6000345; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (goldfish-app-upccg .ondigitalocean .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"goldfish-app-upccg.ondigitalocean.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000346; classtype:social-engineering; sid:6000346; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4 .wne001 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4.wne001.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000347; classtype:social-engineering; sid:6000347; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .v18f .xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.v18f.xyz"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000348; classtype:social-engineering; sid:6000348; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .support .nnst0120 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.support.nnst0120.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000349; classtype:social-engineering; sid:6000349; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd .xgdrew .cfd/co .uk/)"; flow:established,to_server; http.uri; content:"/co.uk/"; startswith; fast_pattern; http.host; content:"dpd.xgdrew.cfd"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000350; classtype:social-engineering; sid:6000350; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezorwaalltcrypto .gitbook .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezorwaalltcrypto.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000351; classtype:social-engineering; sid:6000351; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .omada .nnst0120 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.omada.nnst0120.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000352; classtype:social-engineering; sid:6000352; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .static .nnst0120 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.static.nnst0120.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000353; classtype:social-engineering; sid:6000353; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (test .nnst0120 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"test.nnst0120.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000354; classtype:social-engineering; sid:6000354; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (horaires-mondial .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"horaires-mondial.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000355; classtype:social-engineering; sid:6000355; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .llojin-mettaamak-uk .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.llojin-mettaamak-uk.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000356; classtype:social-engineering; sid:6000356; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lv-jeffries-stuart .pages .dev/help/contact/331032452233157/)"; flow:established,to_server; http.uri; content:"/help/contact/331032452233157/"; startswith; fast_pattern; http.host; content:"lv-jeffries-stuart.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000357; classtype:social-engineering; sid:6000357; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (testing .nnst0120 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"testing.nnst0120.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000358; classtype:social-engineering; sid:6000358; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .g105t .xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.g105t.xyz"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000359; classtype:social-engineering; sid:6000359; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id19239250 .invoice-ads-program .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id19239250.invoice-ads-program.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000360; classtype:social-engineering; sid:6000360; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd .xgdrew .cfd/co .uk)"; flow:established,to_server; http.uri; content:"/co.uk"; startswith; fast_pattern; http.host; content:"dpd.xgdrew.cfd"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000361; classtype:social-engineering; sid:6000361; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (duplo96 .github .io/Build_Week_2-Team-4)"; flow:established,to_server; http.uri; content:"/Build_Week_2-Team-4"; startswith; fast_pattern; http.host; content:"duplo96.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000362; classtype:social-engineering; sid:6000362; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-an .netlify .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-an.netlify.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000363; classtype:social-engineering; sid:6000363; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-application .bussines-partner-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-application.bussines-partner-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000364; classtype:social-engineering; sid:6000364; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .rroblox .co/users/67224868/profile/)"; flow:established,to_server; http.uri; content:"/users/67224868/profile/"; startswith; fast_pattern; http.host; content:"www.rroblox.co"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000365; classtype:social-engineering; sid:6000365; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accept-sp-maldonds .pages .dev/cdn-cgi)"; flow:established,to_server; http.uri; content:"/cdn-cgi"; startswith; fast_pattern; http.host; content:"accept-sp-maldonds.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000366; classtype:social-engineering; sid:6000366; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .web3 .pancake .run/info/v3/pairs)"; flow:established,to_server; http.uri; content:"/info/v3/pairs"; startswith; fast_pattern; http.host; content:"www.web3.pancake.run"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000367; classtype:social-engineering; sid:6000367; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreicxtiuwh6kjuloo2ypwnk4uujodhb3p2ewjjpkh6rg72nfeffopkq .ipfs .dweb .link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreicxtiuwh6kjuloo2ypwnk4uujodhb3p2ewjjpkh6rg72nfeffopkq.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000368; classtype:social-engineering; sid:6000368; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loenwe-hopeagia-noprobs .pages .dev/2606:4700:310c::ac42:2ef9/)"; flow:established,to_server; http.uri; content:"/2606:4700:310c::ac42:2ef9/"; startswith; fast_pattern; http.host; content:"loenwe-hopeagia-noprobs.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000369; classtype:social-engineering; sid:6000369; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreih6pyu4m4rbzuwj6pqhuxd7rh4wrgpr5yrnwlraygd7d2a5lhrayy .ipfs .dweb .link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreih6pyu4m4rbzuwj6pqhuxd7rh4wrgpr5yrnwlraygd7d2a5lhrayy.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000370; classtype:social-engineering; sid:6000370; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17621 .invoice-ads-manager .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17621.invoice-ads-manager.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000371; classtype:social-engineering; sid:6000371; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (api .nnst0120 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"api.nnst0120.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000372; classtype:social-engineering; sid:6000372; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smatr-5064-metropolitan .pages .dev/help/contact/853878858675975/)"; flow:established,to_server; http.uri; content:"/help/contact/853878858675975/"; startswith; fast_pattern; http.host; content:"smatr-5064-metropolitan.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000373; classtype:social-engineering; sid:6000373; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mjuniort .github .io/imers-oAlura/)"; flow:established,to_server; http.uri; content:"/imers-oAlura/"; startswith; fast_pattern; http.host; content:"mjuniort.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000374; classtype:social-engineering; sid:6000374; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eylep2 .wne001 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eylep2.wne001.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000375; classtype:social-engineering; sid:6000375; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mer-clodomiro-anderson .pages .dev/help/contact/379487956548405/)"; flow:established,to_server; http.uri; content:"/help/contact/379487956548405/"; startswith; fast_pattern; http.host; content:"mer-clodomiro-anderson.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000376; classtype:social-engineering; sid:6000376; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (methamesklgnn .gitbook .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"methamesklgnn.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000377; classtype:social-engineering; sid:6000377; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (demo .nnst0120 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"demo.nnst0120.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000378; classtype:social-engineering; sid:6000378; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd .kemarviox .cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kemarviox.cfd"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000379; classtype:social-engineering; sid:6000379; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (omada .nnst0120 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"omada.nnst0120.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000380; classtype:social-engineering; sid:6000380; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .dev .nnst0120 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.dev.nnst0120.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000381; classtype:social-engineering; sid:6000381; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smatr-5064-metropolitan .pages .dev/help/contact/553415604148422/)"; flow:established,to_server; http.uri; content:"/help/contact/553415604148422/"; startswith; fast_pattern; http.host; content:"smatr-5064-metropolitan.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000382; classtype:social-engineering; sid:6000382; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-lilac-iota .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-lilac-iota.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000383; classtype:social-engineering; sid:6000383; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anmollnigam .github .io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"anmollnigam.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000384; classtype:social-engineering; sid:6000384; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mbhytamask-walt .gitbook .io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"mbhytamask-walt.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000385; classtype:social-engineering; sid:6000385; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .staging .nnst0120 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.staging.nnst0120.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000386; classtype:social-engineering; sid:6000386; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (v17s .xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"v17s.xyz"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000387; classtype:social-engineering; sid:6000387; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fzvictor .com/whatsapp)"; flow:established,to_server; http.uri; content:"/whatsapp"; startswith; fast_pattern; http.host; content:"fzvictor.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000388; classtype:social-engineering; sid:6000388; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nnst0120 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nnst0120.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000389; classtype:social-engineering; sid:6000389; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .api .nnst0120 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.api.nnst0120.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000390; classtype:social-engineering; sid:6000390; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wanderson-a-timoteo .github .io/instagram-interface/)"; flow:established,to_server; http.uri; content:"/instagram-interface/"; startswith; fast_pattern; http.host; content:"wanderson-a-timoteo.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000391; classtype:social-engineering; sid:6000391; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dappmultichainfix .pages .dev/wallet .)"; flow:established,to_server; http.uri; content:"/wallet."; startswith; fast_pattern; http.host; content:"dappmultichainfix.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000392; classtype:social-engineering; sid:6000392; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id19239255 .invoice-ads-program .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id19239255.invoice-ads-program.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000393; classtype:social-engineering; sid:6000393; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .netflixmoi .com/m/)"; flow:established,to_server; http.uri; content:"/m/"; startswith; fast_pattern; http.host; content:"www.netflixmoi.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000394; classtype:social-engineering; sid:6000394; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shanelam-cang-saigo .pages .dev/help/contact/381790813067050/)"; flow:established,to_server; http.uri; content:"/help/contact/381790813067050/"; startswith; fast_pattern; http.host; content:"shanelam-cang-saigo.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000395; classtype:social-engineering; sid:6000395; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s1179676 .ha009 .t .mydomain .zone/S/login .php)"; flow:established,to_server; http.uri; content:"/S/login.php"; startswith; fast_pattern; http.host; content:"s1179676.ha009.t.mydomain.zone"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000396; classtype:social-engineering; sid:6000396; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lmoriw-iekascma-oqmmcq-213-cmakwe-fgacsax .pages .dev/help/contact/511955920307953)"; flow:established,to_server; http.uri; content:"/help/contact/511955920307953"; startswith; fast_pattern; http.host; content:"lmoriw-iekascma-oqmmcq-213-cmakwe-fgacsax.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000397; classtype:social-engineering; sid:6000397; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id19239252 .invoice-ads-program .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id19239252.invoice-ads-program.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000398; classtype:social-engineering; sid:6000398; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17632 .invoice-ads-manager .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17632.invoice-ads-manager.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000399; classtype:social-engineering; sid:6000399; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .nebula .nnst0120 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.nebula.nnst0120.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000400; classtype:social-engineering; sid:6000400; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lucas-7512673-moura .pages .dev/help/contact/741991158208208/)"; flow:established,to_server; http.uri; content:"/help/contact/741991158208208/"; startswith; fast_pattern; http.host; content:"lucas-7512673-moura.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000401; classtype:social-engineering; sid:6000401; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamask-dev-dashboard-feat-remove-prora-consensys-ddffed67 .vercel .app/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"metamask-dev-dashboard-feat-remove-prora-consensys-ddffed67.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000402; classtype:social-engineering; sid:6000402; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (work-with-us-31m .pages .dev/help/contact/38281068143898/)"; flow:established,to_server; http.uri; content:"/help/contact/38281068143898/"; startswith; fast_pattern; http.host; content:"work-with-us-31m.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000403; classtype:social-engineering; sid:6000403; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreidwdybc7dlcr3vbbuqme4joydimyoryfqv3lc7cci3xmxbcmwt2qm .ipfs .dweb .link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreidwdybc7dlcr3vbbuqme4joydimyoryfqv3lc7cci3xmxbcmwt2qm.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000404; classtype:social-engineering; sid:6000404; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (w66q .xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"w66q.xyz"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000405; classtype:social-engineering; sid:6000405; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreigqs4tzaw2xdqq2vqnsugqm35e5udbtaj6rkdbh7cbb4gfdhgvrqe .ipfs .dweb .link/?alt=media&token=271e95bf-d723-44a5-b87a-04324d148e8b)"; flow:established,to_server; http.uri; content:"/?alt=media&token=271e95bf-d723-44a5-b87a-04324d148e8b"; startswith; fast_pattern; http.host; content:"bafkreigqs4tzaw2xdqq2vqnsugqm35e5udbtaj6rkdbh7cbb4gfdhgvrqe.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000406; classtype:social-engineering; sid:6000406; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kalved9835-philadent98254 .pages .dev/help/contact/181740754386697/)"; flow:established,to_server; http.uri; content:"/help/contact/181740754386697/"; startswith; fast_pattern; http.host; content:"kalved9835-philadent98254.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000407; classtype:social-engineering; sid:6000407; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mymetamskwalat .gitbook .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mymetamskwalat.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000408; classtype:social-engineering; sid:6000408; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (llojin-mettaamak-uk .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"llojin-mettaamak-uk.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000409; classtype:social-engineering; sid:6000409; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mrsorage .github .io/schfd)"; flow:established,to_server; http.uri; content:"/schfd"; startswith; fast_pattern; http.host; content:"mrsorage.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000410; classtype:social-engineering; sid:6000410; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ping-8485-vincom .pages .dev/help/contact/106886234981123/)"; flow:established,to_server; http.uri; content:"/help/contact/106886234981123/"; startswith; fast_pattern; http.host; content:"ping-8485-vincom.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000411; classtype:social-engineering; sid:6000411; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (monetization-meta .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"monetization-meta.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000412; classtype:social-engineering; sid:6000412; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lucas-7512673-moura .pages .dev/help/contact/148392829681186/)"; flow:established,to_server; http.uri; content:"/help/contact/148392829681186/"; startswith; fast_pattern; http.host; content:"lucas-7512673-moura.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000413; classtype:social-engineering; sid:6000413; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mettha-mask-logi-in .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mettha-mask-logi-in.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000414; classtype:social-engineering; sid:6000414; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mobile-watertreatment .com/verify-update/)"; flow:established,to_server; http.uri; content:"/verify-update/"; startswith; fast_pattern; http.host; content:"mobile-watertreatment.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000415; classtype:social-engineering; sid:6000415; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yashaitt .github .io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"yashaitt.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000416; classtype:social-engineering; sid:6000416; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreib26odrhy2w62yzybfoofemle2le6zldpovk46b75jt6blmf5lq5i .ipfs .dweb .link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreib26odrhy2w62yzybfoofemle2le6zldpovk46b75jt6blmf5lq5i.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000417; classtype:social-engineering; sid:6000417; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-network .bussines-partner-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-network.bussines-partner-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000418; classtype:social-engineering; sid:6000418; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (riyakharotia .github .io/Spotify-clone)"; flow:established,to_server; http.uri; content:"/Spotify-clone"; startswith; fast_pattern; http.host; content:"riyakharotia.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000419; classtype:social-engineering; sid:6000419; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreidurzcblohw5tttn4gfdoe2rg7z6qfkptnzlav3u7qslkswxs42jy .ipfs .dweb .link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreidurzcblohw5tttn4gfdoe2rg7z6qfkptnzlav3u7qslkswxs42jy.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000420; classtype:social-engineering; sid:6000420; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mx648 .com/adidas-ms/)"; flow:established,to_server; http.uri; content:"/adidas-ms/"; startswith; fast_pattern; http.host; content:"mx648.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000421; classtype:social-engineering; sid:6000421; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kalimgithub .github .io/Airbnb-Clone)"; flow:established,to_server; http.uri; content:"/Airbnb-Clone"; startswith; fast_pattern; http.host; content:"kalimgithub.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000422; classtype:social-engineering; sid:6000422; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-trezor .gitbook .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sso-trezor.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000423; classtype:social-engineering; sid:6000423; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (garanticepbbvaislemleri .duckdns .org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"garanticepbbvaislemleri.duckdns.org"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000424; classtype:social-engineering; sid:6000424; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .docs .nnst0120 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.docs.nnst0120.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000425; classtype:social-engineering; sid:6000425; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .m167k .xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.m167k.xyz"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000426; classtype:social-engineering; sid:6000426; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure--app-kucoin-sso--s-cdn .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure--app-kucoin-sso--s-cdn.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000427; classtype:social-engineering; sid:6000427; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tandan-sawit .github .io/in/)"; flow:established,to_server; http.uri; content:"/in/"; startswith; fast_pattern; http.host; content:"tandan-sawit.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000428; classtype:social-engineering; sid:6000428; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-invoice .invoice-ads-setting .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-invoice.invoice-ads-setting.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000429; classtype:social-engineering; sid:6000429; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jus-sup-21399932 .pages .dev/help/contact/604035074640293/)"; flow:established,to_server; http.uri; content:"/help/contact/604035074640293/"; startswith; fast_pattern; http.host; content:"jus-sup-21399932.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000430; classtype:social-engineering; sid:6000430; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amnakram670 .github .io/netflix)"; flow:established,to_server; http.uri; content:"/netflix"; startswith; fast_pattern; http.host; content:"amnakram670.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000431; classtype:social-engineering; sid:6000431; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (varkel-sonvik-biz-denter-halrex-sp7ct12 .pages .dev/form_submit_appeal/)"; flow:established,to_server; http.uri; content:"/form_submit_appeal/"; startswith; fast_pattern; http.host; content:"varkel-sonvik-biz-denter-halrex-sp7ct12.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000432; classtype:social-engineering; sid:6000432; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pranavrh53 .github .io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"pranavrh53.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000433; classtype:social-engineering; sid:6000433; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (v31o .xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"v31o.xyz"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000434; classtype:social-engineering; sid:6000434; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17630 .invoice-ads-manager .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17630.invoice-ads-manager.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000435; classtype:social-engineering; sid:6000435; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id19239251 .invoice-ads-program .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id19239251.invoice-ads-program.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000436; classtype:social-engineering; sid:6000436; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lnk .ink/dvthr)"; flow:established,to_server; http.uri; content:"/dvthr"; startswith; fast_pattern; http.host; content:"lnk.ink"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000437; classtype:social-engineering; sid:6000437; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .mail .nnst0120 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mail.nnst0120.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000438; classtype:social-engineering; sid:6000438; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreicqh5ym5wvmfmtqbhltcawz4soxzag5xxusf7rvbtwdz4lrnttrsi .ipfs .dweb .link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreicqh5ym5wvmfmtqbhltcawz4soxzag5xxusf7rvbtwdz4lrnttrsi.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000439; classtype:social-engineering; sid:6000439; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-bf410a88ec67437fb183b22f87a37d63 .r2 .dev/index .html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-bf410a88ec67437fb183b22f87a37d63.r2.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000440; classtype:social-engineering; sid:6000440; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .coinbase-referral-code .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.coinbase-referral-code.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000441; classtype:social-engineering; sid:6000441; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (supplychain .servirtual .cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"supplychain.servirtual.cl"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000442; classtype:social-engineering; sid:6000442; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (httpp-roblox .co/users/1663298387/profile)"; flow:established,to_server; http.uri; content:"/users/1663298387/profile"; startswith; fast_pattern; http.host; content:"httpp-roblox.co"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000443; classtype:social-engineering; sid:6000443; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lnk .ink/sscdd)"; flow:established,to_server; http.uri; content:"/sscdd"; startswith; fast_pattern; http.host; content:"lnk.ink"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000444; classtype:social-engineering; sid:6000444; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coinbase-referral-code .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coinbase-referral-code.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000445; classtype:social-engineering; sid:6000445; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mer-clodomiro-anderson .pages .dev/help/contact/825017249983177/)"; flow:established,to_server; http.uri; content:"/help/contact/825017249983177/"; startswith; fast_pattern; http.host; content:"mer-clodomiro-anderson.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000446; classtype:social-engineering; sid:6000446; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lucas-7512673-moura .pages .dev/help/contact/639358875391153/)"; flow:established,to_server; http.uri; content:"/help/contact/639358875391153/"; startswith; fast_pattern; http.host; content:"lucas-7512673-moura.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000447; classtype:social-engineering; sid:6000447; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loenwe-hopeagia-noprobs .pages .dev/help/contact/724318674925798/)"; flow:established,to_server; http.uri; content:"/help/contact/724318674925798/"; startswith; fast_pattern; http.host; content:"loenwe-hopeagia-noprobs.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000448; classtype:social-engineering; sid:6000448; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fxascreat .gnsx .web .id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fxascreat.gnsx.web.id"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000449; classtype:social-engineering; sid:6000449; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loshfid-ght-48274-mtivate .pages .dev/help/contact/414297083745377/)"; flow:established,to_server; http.uri; content:"/help/contact/414297083745377/"; startswith; fast_pattern; http.host; content:"loshfid-ght-48274-mtivate.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000450; classtype:social-engineering; sid:6000450; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreid4xdvobhgxfqpzn6fkes5hpweukdmvzpyjh4hsvf5ag4evgllnfa .ipfs .dweb .link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreid4xdvobhgxfqpzn6fkes5hpweukdmvzpyjh4hsvf5ag4evgllnfa.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000451; classtype:social-engineering; sid:6000451; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cambium .nnst0120 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cambium.nnst0120.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000452; classtype:social-engineering; sid:6000452; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-loginrealumber .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-loginrealumber.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000453; classtype:social-engineering; sid:6000453; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rajtiwari0202 .github .io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"rajtiwari0202.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000454; classtype:social-engineering; sid:6000454; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .assets .nnst0120 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.assets.nnst0120.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000455; classtype:social-engineering; sid:6000455; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id19239248 .invoice-ads-program .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id19239248.invoice-ads-program.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000456; classtype:social-engineering; sid:6000456; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail .freightinternationalservices .com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"webmail.freightinternationalservices.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000457; classtype:social-engineering; sid:6000457; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jatin2004-code .github .io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"jatin2004-code.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000458; classtype:social-engineering; sid:6000458; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .garanticepbbvaislemleri .duckdns .org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.garanticepbbvaislemleri.duckdns.org"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000459; classtype:social-engineering; sid:6000459; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loenwe-hopeagia-noprobs .pages .dev/help/contact/484504895404065/)"; flow:established,to_server; http.uri; content:"/help/contact/484504895404065/"; startswith; fast_pattern; http.host; content:"loenwe-hopeagia-noprobs.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000460; classtype:social-engineering; sid:6000460; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member068 .business-ad-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member068.business-ad-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000461; classtype:social-engineering; sid:6000461; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17625 .invoice-ads-manager .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17625.invoice-ads-manager.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000462; classtype:social-engineering; sid:6000462; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (neuerzumpolicy .click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"neuerzumpolicy.click"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000463; classtype:social-engineering; sid:6000463; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (admin .albaba .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"admin.albaba.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000464; classtype:social-engineering; sid:6000464; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pooja-bhoite .github .io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"pooja-bhoite.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000465; classtype:social-engineering; sid:6000465; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamdeaskloigin .gitbook .io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"metamdeaskloigin.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000466; classtype:social-engineering; sid:6000466; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17627 .invoice-ads-manager .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17627.invoice-ads-manager.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000467; classtype:social-engineering; sid:6000467; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (w66e .xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"w66e.xyz"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000468; classtype:social-engineering; sid:6000468; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dhl .servirtual .cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dhl.servirtual.cl"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000469; classtype:social-engineering; sid:6000469; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id19239249 .invoice-ads-program .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id19239249.invoice-ads-program.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000470; classtype:social-engineering; sid:6000470; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreidhojxyaajwsb6tqt3fez4fckkfuqszdhds6nf7hmpnts3equd4ay .ipfs .dweb .link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreidhojxyaajwsb6tqt3fez4fckkfuqszdhds6nf7hmpnts3equd4ay.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000471; classtype:social-engineering; sid:6000471; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafybeig7m6ymhxquuawul7eutgialz5hto3benqc2k5r3pbzwksn4kty4q .ipfs .dweb .link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafybeig7m6ymhxquuawul7eutgialz5hto3benqc2k5r3pbzwksn4kty4q.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000472; classtype:social-engineering; sid:6000472; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apps .nnst0120 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"apps.nnst0120.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000473; classtype:social-engineering; sid:6000473; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ke-mehserle-eider .pages .dev/help/contact/165062636967682/)"; flow:established,to_server; http.uri; content:"/help/contact/165062636967682/"; startswith; fast_pattern; http.host; content:"ke-mehserle-eider.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000474; classtype:social-engineering; sid:6000474; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kshitij-0-nitnaware .github .io/Netflix-Clone)"; flow:established,to_server; http.uri; content:"/Netflix-Clone"; startswith; fast_pattern; http.host; content:"kshitij-0-nitnaware.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000475; classtype:social-engineering; sid:6000475; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fzdee2 .wne001 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fzdee2.wne001.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000476; classtype:social-engineering; sid:6000476; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (matiemeus-klogen .gitbook .io/usa)"; flow:established,to_server; http.uri; content:"/usa"; startswith; fast_pattern; http.host; content:"matiemeus-klogen.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000477; classtype:social-engineering; sid:6000477; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shanelam-cang-saigo .pages .dev/help/contact/765780231042271/)"; flow:established,to_server; http.uri; content:"/help/contact/765780231042271/"; startswith; fast_pattern; http.host; content:"shanelam-cang-saigo.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000478; classtype:social-engineering; sid:6000478; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .m .nnst0120 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.m.nnst0120.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000479; classtype:social-engineering; sid:6000479; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fredw299 .github .io/Invoicemarchoverdue2026/MARCHINVOICEDUE2026)"; flow:established,to_server; http.uri; content:"/Invoicemarchoverdue2026/MARCHINVOICEDUE2026"; startswith; fast_pattern; http.host; content:"fredw299.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000480; classtype:social-engineering; sid:6000480; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .app .nnst0120 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.app.nnst0120.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000481; classtype:social-engineering; sid:6000481; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mer-clodomiro-anderson .pages .dev/help/contact/774913828986543/)"; flow:established,to_server; http.uri; content:"/help/contact/774913828986543/"; startswith; fast_pattern; http.host; content:"mer-clodomiro-anderson.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000482; classtype:social-engineering; sid:6000482; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nethrashivani .github .io/Airbnb_clone_Tailwind)"; flow:established,to_server; http.uri; content:"/Airbnb_clone_Tailwind"; startswith; fast_pattern; http.host; content:"nethrashivani.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000483; classtype:social-engineering; sid:6000483; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webaccess-alerts .net/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"webaccess-alerts.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000484; classtype:social-engineering; sid:6000484; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ke-mehserle-eider .pages .dev/help/contact/324364168573549/)"; flow:established,to_server; http.uri; content:"/help/contact/324364168573549/"; startswith; fast_pattern; http.host; content:"ke-mehserle-eider.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000485; classtype:social-engineering; sid:6000485; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .netflixmoi .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflixmoi.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000486; classtype:social-engineering; sid:6000486; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loenwe-hopeagia-noprobs .pages .dev/help/contact/697330301873159/)"; flow:established,to_server; http.uri; content:"/help/contact/697330301873159/"; startswith; fast_pattern; http.host; content:"loenwe-hopeagia-noprobs.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000487; classtype:social-engineering; sid:6000487; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .site-t60cq3528 .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.site-t60cq3528.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000488; classtype:social-engineering; sid:6000488; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sanx001 .github .io/Netflix-Clone/subscription .html)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/subscription.html"; startswith; fast_pattern; http.host; content:"sanx001.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000489; classtype:social-engineering; sid:6000489; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loshfid-ght-48274-mtivate .pages .dev/help/contact/406609152853707/)"; flow:established,to_server; http.uri; content:"/help/contact/406609152853707/"; startswith; fast_pattern; http.host; content:"loshfid-ght-48274-mtivate.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000490; classtype:social-engineering; sid:6000490; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appviewtechs .info/t36f05b7d24a7845b9ia2caf94ao95d1db83 .html)"; flow:established,to_server; http.uri; content:"/t36f05b7d24a7845b9ia2caf94ao95d1db83.html"; startswith; fast_pattern; http.host; content:"appviewtechs.info"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000491; classtype:social-engineering; sid:6000491; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamask-dev-dashboard-feat-remove-prora-consensys-ddffed67 .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metamask-dev-dashboard-feat-remove-prora-consensys-ddffed67.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000492; classtype:social-engineering; sid:6000492; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (saliq6500-cmd .github .io/my-clone-website/)"; flow:established,to_server; http.uri; content:"/my-clone-website/"; startswith; fast_pattern; http.host; content:"saliq6500-cmd.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000493; classtype:social-engineering; sid:6000493; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (methamesklgnn .gitbook .io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"methamesklgnn.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000494; classtype:social-engineering; sid:6000494; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j53g .vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j53g.vip"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000495; classtype:social-engineering; sid:6000495; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17629 .invoice-ads-manager .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17629.invoice-ads-manager.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000496; classtype:social-engineering; sid:6000496; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .mettumuskkkvlogue .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mettumuskkkvlogue.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000497; classtype:social-engineering; sid:6000497; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .test .nnst0120 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.test.nnst0120.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000498; classtype:social-engineering; sid:6000498; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m .nnst0120 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.nnst0120.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000499; classtype:social-engineering; sid:6000499; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .demo .nnst0120 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.demo.nnst0120.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000500; classtype:social-engineering; sid:6000500; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mobile-watertreatment .com/verify-update)"; flow:established,to_server; http.uri; content:"/verify-update"; startswith; fast_pattern; http.host; content:"mobile-watertreatment.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000501; classtype:social-engineering; sid:6000501; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kaushiki-alt .github .io/Netflix/)"; flow:established,to_server; http.uri; content:"/Netflix/"; startswith; fast_pattern; http.host; content:"kaushiki-alt.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000502; classtype:social-engineering; sid:6000502; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amp .padisahbets .vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amp.padisahbets.vip"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000503; classtype:social-engineering; sid:6000503; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .aposicilia .com/fr)"; flow:established,to_server; http.uri; content:"/fr"; startswith; fast_pattern; http.host; content:"www.aposicilia.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000504; classtype:social-engineering; sid:6000504; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cn .lnmxys .com/home/register?code=49443)"; flow:established,to_server; http.uri; content:"/home/register?code=49443"; startswith; fast_pattern; http.host; content:"cn.lnmxys.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000505; classtype:social-engineering; sid:6000505; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lmoriw-iekascma-oqmmcq-213-cmakwe-fgacsax .pages .dev/help/contact/149330036916013/)"; flow:established,to_server; http.uri; content:"/help/contact/149330036916013/"; startswith; fast_pattern; http.host; content:"lmoriw-iekascma-oqmmcq-213-cmakwe-fgacsax.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000506; classtype:social-engineering; sid:6000506; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17616 .invoice-ads-manager .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17616.invoice-ads-manager.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000507; classtype:social-engineering; sid:6000507; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflixpromo .jniwebshop .com/enter-promo-code)"; flow:established,to_server; http.uri; content:"/enter-promo-code"; startswith; fast_pattern; http.host; content:"netflixpromo.jniwebshop.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000508; classtype:social-engineering; sid:6000508; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lucas-7512673-moura .pages .dev/help/contact/749304084403472/)"; flow:established,to_server; http.uri; content:"/help/contact/749304084403472/"; startswith; fast_pattern; http.host; content:"lucas-7512673-moura.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000509; classtype:social-engineering; sid:6000509; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loenwe-hopeagia-noprobs .pages .dev/help/contact/24431088983103/)"; flow:established,to_server; http.uri; content:"/help/contact/24431088983103/"; startswith; fast_pattern; http.host; content:"loenwe-hopeagia-noprobs.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000510; classtype:social-engineering; sid:6000510; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login-meta .accounts-admin-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"login-meta.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000511; classtype:social-engineering; sid:6000511; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mymetamskwalat .gitbook .io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"mymetamskwalat.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000512; classtype:social-engineering; sid:6000512; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booking-com-ab7c31 .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"booking-com-ab7c31.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000513; classtype:social-engineering; sid:6000513; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17620 .invoice-ads-manager .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17620.invoice-ads-manager.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000514; classtype:social-engineering; sid:6000514; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loshfid-ght-48274-mtivate .pages .dev/help/contact/573044871439730/)"; flow:established,to_server; http.uri; content:"/help/contact/573044871439730/"; startswith; fast_pattern; http.host; content:"loshfid-ght-48274-mtivate.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000515; classtype:social-engineering; sid:6000515; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreicbmqquwxmgcjiinvicxanjtip42fcnej5mdgdqtgv2q5jwffo7aa .ipfs .dweb .link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreicbmqquwxmgcjiinvicxanjtip42fcnej5mdgdqtgv2q5jwffo7aa.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000516; classtype:social-engineering; sid:6000516; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-team .bussines-partner-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-team.bussines-partner-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000517; classtype:social-engineering; sid:6000517; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lucas-75673324-moura .pages .dev/help/contact/11316903001806/)"; flow:established,to_server; http.uri; content:"/help/contact/11316903001806/"; startswith; fast_pattern; http.host; content:"lucas-75673324-moura.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000518; classtype:social-engineering; sid:6000518; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loenwe-hopeagia-noprobs .pages .dev/help/contact/898957116196938/)"; flow:established,to_server; http.uri; content:"/help/contact/898957116196938/"; startswith; fast_pattern; http.host; content:"loenwe-hopeagia-noprobs.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000519; classtype:social-engineering; sid:6000519; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mykeruais-assets .pages .dev/help/contact/793939233111423/)"; flow:established,to_server; http.uri; content:"/help/contact/793939233111423/"; startswith; fast_pattern; http.host; content:"mykeruais-assets.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000520; classtype:social-engineering; sid:6000520; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dev .nnst0120 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dev.nnst0120.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000521; classtype:social-engineering; sid:6000521; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appviewtechs .info/t84dfa89128b8c48f3ib44a801foa1972514 .html)"; flow:established,to_server; http.uri; content:"/t84dfa89128b8c48f3ib44a801foa1972514.html"; startswith; fast_pattern; http.host; content:"appviewtechs.info"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000522; classtype:social-engineering; sid:6000522; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aauth-sso-kucoini .gitbook .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aauth-sso-kucoini.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000523; classtype:social-engineering; sid:6000523; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .cdn .nnst0120 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cdn.nnst0120.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000524; classtype:social-engineering; sid:6000524; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oytlook .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"oytlook.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000525; classtype:social-engineering; sid:6000525; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docs .nnst0120 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"docs.nnst0120.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000526; classtype:social-engineering; sid:6000526; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mer-clodomiro-anderson .pages .dev/help/contact/441260698674140/)"; flow:established,to_server; http.uri; content:"/help/contact/441260698674140/"; startswith; fast_pattern; http.host; content:"mer-clodomiro-anderson.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000527; classtype:social-engineering; sid:6000527; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lucas-75673324-moura .pages .dev/help/contact/247251379967002/)"; flow:established,to_server; http.uri; content:"/help/contact/247251379967002/"; startswith; fast_pattern; http.host; content:"lucas-75673324-moura.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000528; classtype:social-engineering; sid:6000528; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iitssme1987-bit .github .io/mysite)"; flow:established,to_server; http.uri; content:"/mysite"; startswith; fast_pattern; http.host; content:"iitssme1987-bit.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000529; classtype:social-engineering; sid:6000529; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0larich21 .github .io/AIRBNB/)"; flow:established,to_server; http.uri; content:"/AIRBNB/"; startswith; fast_pattern; http.host; content:"0larich21.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000530; classtype:social-engineering; sid:6000530; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robloxr .com .es/charts)"; flow:established,to_server; http.uri; content:"/charts"; startswith; fast_pattern; http.host; content:"robloxr.com.es"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000531; classtype:social-engineering; sid:6000531; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .apps .nnst0120 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.apps.nnst0120.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000532; classtype:social-engineering; sid:6000532; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-plus .credit-agency-meta .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-plus.credit-agency-meta.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000533; classtype:social-engineering; sid:6000533; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .dervy-2026priv .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.dervy-2026priv.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000534; classtype:social-engineering; sid:6000534; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .cambium .nnst0120 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cambium.nnst0120.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000535; classtype:social-engineering; sid:6000535; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anugrah-ajith .github .io/netflixclone/)"; flow:established,to_server; http.uri; content:"/netflixclone/"; startswith; fast_pattern; http.host; content:"anugrah-ajith.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000536; classtype:social-engineering; sid:6000536; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deepsoni04 .github .io/Netflix_Landing_Page)"; flow:established,to_server; http.uri; content:"/Netflix_Landing_Page"; startswith; fast_pattern; http.host; content:"deepsoni04.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000537; classtype:social-engineering; sid:6000537; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (seg-gob--secretariadee .replit .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"seg-gob--secretariadee.replit.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000538; classtype:social-engineering; sid:6000538; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inpost .orderyi .cyou/orders/a3f7a2e0/komplet_lamp_sufitowa_i_wisz%C4%85ca/bank/id24424?modal_stage=blik)"; flow:established,to_server; http.uri; content:"/orders/a3f7a2e0/komplet_lamp_sufitowa_i_wisz%C4%85ca/bank/id24424?modal_stage=blik"; startswith; fast_pattern; http.host; content:"inpost.orderyi.cyou"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000539; classtype:social-engineering; sid:6000539; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreifwdr5dmyc32oxqnmdpff72ixpiykijgomywwc7aboy56ulvc7dtq .ipfs .dweb .link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreifwdr5dmyc32oxqnmdpff72ixpiykijgomywwc7aboy56ulvc7dtq.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000540; classtype:social-engineering; sid:6000540; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cn .314manx .com/home/forbidden)"; flow:established,to_server; http.uri; content:"/home/forbidden"; startswith; fast_pattern; http.host; content:"cn.314manx.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000541; classtype:social-engineering; sid:6000541; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (14213 .xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"14213.xyz"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000542; classtype:social-engineering; sid:6000542; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gatewayinterac .com/nT5xA2C9eH7kZ4Qp1R6vW8mB3cD0yFj/)"; flow:established,to_server; http.uri; content:"/nT5xA2C9eH7kZ4Qp1R6vW8mB3cD0yFj/"; startswith; fast_pattern; http.host; content:"gatewayinterac.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000543; classtype:social-engineering; sid:6000543; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smatr-5064-metropolitan .pages .dev/help/contact/619465893619826/)"; flow:established,to_server; http.uri; content:"/help/contact/619465893619826/"; startswith; fast_pattern; http.host; content:"smatr-5064-metropolitan.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000544; classtype:social-engineering; sid:6000544; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (personas-svp .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"personas-svp.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000545; classtype:social-engineering; sid:6000545; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-tool .bussines-partner-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-tool.bussines-partner-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000546; classtype:social-engineering; sid:6000546; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mykeruais-assets .pages .dev/help/contact/808926418097973/)"; flow:established,to_server; http.uri; content:"/help/contact/808926418097973/"; startswith; fast_pattern; http.host; content:"mykeruais-assets.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000547; classtype:social-engineering; sid:6000547; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id19239253 .invoice-ads-program .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id19239253.invoice-ads-program.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000548; classtype:social-engineering; sid:6000548; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (millamzy .github .io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"millamzy.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000549; classtype:social-engineering; sid:6000549; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (k65k .xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"k65k.xyz"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000550; classtype:social-engineering; sid:6000550; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreid62iamu5qe6e2lxowk2hulobmtdghug4swm6aggcz3xanxotxspq .ipfs .dweb .link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreid62iamu5qe6e2lxowk2hulobmtdghug4swm6aggcz3xanxotxspq.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000551; classtype:social-engineering; sid:6000551; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gimnixnlogen .gitbook .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gimnixnlogen.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000552; classtype:social-engineering; sid:6000552; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gimnixnlogen .gitbook .io/sign-in)"; flow:established,to_server; http.uri; content:"/sign-in"; startswith; fast_pattern; http.host; content:"gimnixnlogen.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000553; classtype:social-engineering; sid:6000553; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (micminecraft1 .github .io/lesson4/)"; flow:established,to_server; http.uri; content:"/lesson4/"; startswith; fast_pattern; http.host; content:"micminecraft1.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000554; classtype:social-engineering; sid:6000554; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jus-sup-21399932 .pages .dev/help/contact/655330282360873/)"; flow:established,to_server; http.uri; content:"/help/contact/655330282360873/"; startswith; fast_pattern; http.host; content:"jus-sup-21399932.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000555; classtype:social-engineering; sid:6000555; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mer-clodomiro-anderson .pages .dev/help/contact/7749138289865432606:4700:310c::ac42:2c5a/)"; flow:established,to_server; http.uri; content:"/help/contact/7749138289865432606:4700:310c::ac42:2c5a/"; startswith; fast_pattern; http.host; content:"mer-clodomiro-anderson.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000556; classtype:social-engineering; sid:6000556; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member312 .center-meta-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member312.center-meta-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000557; classtype:social-engineering; sid:6000557; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17628 .invoice-ads-manager .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17628.invoice-ads-manager.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000558; classtype:social-engineering; sid:6000558; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web3 .pancake .run/lottery)"; flow:established,to_server; http.uri; content:"/lottery"; startswith; fast_pattern; http.host; content:"web3.pancake.run"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000559; classtype:social-engineering; sid:6000559; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (28ecne20f9u .securebankinggroup .org/s/63bzgfsvbwsfcdx7y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63bzgfsvbwsfcdx7y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"28ecne20f9u.securebankinggroup.org"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000560; classtype:social-engineering; sid:6000560; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (datcareefdiving .com/lsd/xinfini/index .html)"; flow:established,to_server; http.uri; content:"/lsd/xinfini/index.html"; startswith; fast_pattern; http.host; content:"datcareefdiving.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000561; classtype:social-engineering; sid:6000561; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-balance .bussines-partner-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-balance.bussines-partner-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000562; classtype:social-engineering; sid:6000562; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ai-egao .github .io/Netflix-clone-Pk-only-html-and-CSS-)"; flow:established,to_server; http.uri; content:"/Netflix-clone-Pk-only-html-and-CSS-"; startswith; fast_pattern; http.host; content:"ai-egao.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000563; classtype:social-engineering; sid:6000563; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (birukkebede11 .github .io/apple .com-replica-bootstrap)"; flow:established,to_server; http.uri; content:"/apple.com-replica-bootstrap"; startswith; fast_pattern; http.host; content:"birukkebede11.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000564; classtype:social-engineering; sid:6000564; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fb100456347458388-qxiqifhtoed9ztps9os5d .vercel .app/me4r6tjns4etrfdbxgfcvx)"; flow:established,to_server; http.uri; content:"/me4r6tjns4etrfdbxgfcvx"; startswith; fast_pattern; http.host; content:"fb100456347458388-qxiqifhtoed9ztps9os5d.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000565; classtype:social-engineering; sid:6000565; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kucoin-web-learn .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kucoin-web-learn.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000566; classtype:social-engineering; sid:6000566; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oauth----en---sso--kucoin .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"oauth----en---sso--kucoin.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000567; classtype:social-engineering; sid:6000567; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mrbestman .github .io/discord-login-page-clone)"; flow:established,to_server; http.uri; content:"/discord-login-page-clone"; startswith; fast_pattern; http.host; content:"mrbestman.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000568; classtype:social-engineering; sid:6000568; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (krakqeenlogi .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"krakqeenlogi.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000569; classtype:social-engineering; sid:6000569; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (assets .nnst0120 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"assets.nnst0120.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000570; classtype:social-engineering; sid:6000570; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-lve-ledgr .pages .dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sso-lve-ledgr.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000571; classtype:social-engineering; sid:6000571; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coinbscewallct .gitbook .io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"coinbscewallct.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000572; classtype:social-engineering; sid:6000572; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (urubogreenpark .com .bo/metalworkservice/index .php)"; flow:established,to_server; http.uri; content:"/metalworkservice/index.php"; startswith; fast_pattern; http.host; content:"urubogreenpark.com.bo"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000573; classtype:social-engineering; sid:6000573; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-eta-one .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-eta-one.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000574; classtype:social-engineering; sid:6000574; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd-group-paiement-en-ligne-23 .weebly .com/enregistrement-dpd-group .html/)"; flow:established,to_server; http.uri; content:"/enregistrement-dpd-group.html/"; startswith; fast_pattern; http.host; content:"dpd-group-paiement-en-ligne-23.weebly.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000575; classtype:social-engineering; sid:6000575; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lnk .ink/bggng)"; flow:established,to_server; http.uri; content:"/bggng"; startswith; fast_pattern; http.host; content:"lnk.ink"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000576; classtype:social-engineering; sid:6000576; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .oytlook .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.oytlook.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000577; classtype:social-engineering; sid:6000577; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .perpetualmotioninc .com/*)"; flow:established,to_server; http.uri; content:"/*"; startswith; fast_pattern; http.host; content:"www.perpetualmotioninc.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000578; classtype:social-engineering; sid:6000578; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support .nnst0120 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"support.nnst0120.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000579; classtype:social-engineering; sid:6000579; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-umber-three .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-umber-three.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000580; classtype:social-engineering; sid:6000580; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (parasuramanphillips-projec26985 .pages .dev/help/contact/259735718919223/)"; flow:established,to_server; http.uri; content:"/help/contact/259735718919223/"; startswith; fast_pattern; http.host; content:"parasuramanphillips-projec26985.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000581; classtype:social-engineering; sid:6000581; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id19239254 .invoice-ads-program .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id19239254.invoice-ads-program.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000582; classtype:social-engineering; sid:6000582; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (parasuramanphillips-projec26985 .pages .dev/help/contact/15802613966299/)"; flow:established,to_server; http.uri; content:"/help/contact/15802613966299/"; startswith; fast_pattern; http.host; content:"parasuramanphillips-projec26985.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000583; classtype:social-engineering; sid:6000583; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shaid-alee .github .io/blue)"; flow:established,to_server; http.uri; content:"/blue"; startswith; fast_pattern; http.host; content:"shaid-alee.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000584; classtype:social-engineering; sid:6000584; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appviewtechs .info/t895a29b72ef204b6fi84c17ae9oeb77923a .html)"; flow:established,to_server; http.uri; content:"/t895a29b72ef204b6fi84c17ae9oeb77923a.html"; startswith; fast_pattern; http.host; content:"appviewtechs.info"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000585; classtype:social-engineering; sid:6000585; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezorwaalltcrypto .gitbook .io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"trezorwaalltcrypto.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000586; classtype:social-engineering; sid:6000586; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adityachaurasia1676 .github .io/Netflix/)"; flow:established,to_server; http.uri; content:"/Netflix/"; startswith; fast_pattern; http.host; content:"adityachaurasia1676.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000587; classtype:social-engineering; sid:6000587; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paypay-5sg .pages .dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paypay-5sg.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000588; classtype:social-engineering; sid:6000588; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-credit .bussines-partner-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-credit.bussines-partner-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000589; classtype:social-engineering; sid:6000589; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .5mp .eu/fajlok2/scba/index_www .5mp .eu_ .html)"; flow:established,to_server; http.uri; content:"/fajlok2/scba/index_www.5mp.eu_.html"; startswith; fast_pattern; http.host; content:"www.5mp.eu"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000590; classtype:social-engineering; sid:6000590; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shanelam-cang-saigo .pages .dev/help/contact/532640273975556/)"; flow:established,to_server; http.uri; content:"/help/contact/532640273975556/"; startswith; fast_pattern; http.host; content:"shanelam-cang-saigo.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000591; classtype:social-engineering; sid:6000591; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (forkandtablemag .com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"forkandtablemag.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000592; classtype:social-engineering; sid:6000592; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (notifyhubss .net/d311306a9763ea4c4bp974ec8582cfc348a9 .html)"; flow:established,to_server; http.uri; content:"/d311306a9763ea4c4bp974ec8582cfc348a9.html"; startswith; fast_pattern; http.host; content:"notifyhubss.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000593; classtype:social-engineering; sid:6000593; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (azim0786 .github .io/Airbnb-Clone-Web-Website/)"; flow:established,to_server; http.uri; content:"/Airbnb-Clone-Web-Website/"; startswith; fast_pattern; http.host; content:"azim0786.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000594; classtype:social-engineering; sid:6000594; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member-meta .accounts-admin-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member-meta.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000595; classtype:social-engineering; sid:6000595; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17626 .invoice-ads-manager .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17626.invoice-ads-manager.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000596; classtype:social-engineering; sid:6000596; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (customer-meta .accounts-admin-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"customer-meta.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000597; classtype:social-engineering; sid:6000597; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coinbscewallct .gitbook .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coinbscewallct.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000598; classtype:social-engineering; sid:6000598; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox .com .ge/communities/5040898348/)"; flow:established,to_server; http.uri; content:"/communities/5040898348/"; startswith; fast_pattern; http.host; content:"roblox.com.ge"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000599; classtype:social-engineering; sid:6000599; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (james-huston49823563 .pages .dev/help/contact/283638574988358/)"; flow:established,to_server; http.uri; content:"/help/contact/283638574988358/"; startswith; fast_pattern; http.host; content:"james-huston49823563.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000600; classtype:social-engineering; sid:6000600; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflixpromo .jniwebshop .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflixpromo.jniwebshop.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000601; classtype:social-engineering; sid:6000601; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflixclone-next .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflixclone-next.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000602; classtype:social-engineering; sid:6000602; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vbqxtpqyzjgkquc .vnsr1001 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vbqxtpqyzjgkquc.vnsr1001.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000603; classtype:social-engineering; sid:6000603; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dervy-2026priv .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dervy-2026priv.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000604; classtype:social-engineering; sid:6000604; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .wwwdd .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.wwwdd.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000605; classtype:social-engineering; sid:6000605; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .testing .nnst0120 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.testing.nnst0120.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000606; classtype:social-engineering; sid:6000606; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd .tpzkqvmrln .cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tpzkqvmrln.cfd"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000607; classtype:social-engineering; sid:6000607; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (static .nnst0120 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"static.nnst0120.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000608; classtype:social-engineering; sid:6000608; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiaf5xobv77iwcgq66bn3jmaqskzspnohb46kg5nypzmkuq5ake5pi .ipfs .dweb .link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiaf5xobv77iwcgq66bn3jmaqskzspnohb46kg5nypzmkuq5ake5pi.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000609; classtype:social-engineering; sid:6000609; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .v7msjs .buzz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.v7msjs.buzz"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000610; classtype:social-engineering; sid:6000610; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-b7042861fe7b43dc904a519d193ca7c2 .r2 .dev/index .html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-b7042861fe7b43dc904a519d193ca7c2.r2.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000611; classtype:social-engineering; sid:6000611; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (james-huston49823563 .pages .dev/help/contact/665625920517716/)"; flow:established,to_server; http.uri; content:"/help/contact/665625920517716/"; startswith; fast_pattern; http.host; content:"james-huston49823563.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000612; classtype:social-engineering; sid:6000612; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee9699 .blogspot .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopee9699.blogspot.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000613; classtype:social-engineering; sid:6000613; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kutt .it/RbuQmN)"; flow:established,to_server; http.uri; content:"/RbuQmN"; startswith; fast_pattern; http.host; content:"kutt.it"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000614; classtype:social-engineering; sid:6000614; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (walet-exods-3 .wixstudio .com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"walet-exods-3.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000615; classtype:social-engineering; sid:6000615; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie .aukcj78995-f09 .lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.aukcj78995-f09.lat"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000616; classtype:social-engineering; sid:6000616; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie .pl-oferta-0394 .shop/macbook-air-m4-13/40125/wiadomosci/)"; flow:established,to_server; http.uri; content:"/macbook-air-m4-13/40125/wiadomosci/"; startswith; fast_pattern; http.host; content:"allegrolokalnie.pl-oferta-0394.shop"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000617; classtype:social-engineering; sid:6000617; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vasudevrameshjangid .github .io/clonenetbyvasu/)"; flow:established,to_server; http.uri; content:"/clonenetbyvasu/"; startswith; fast_pattern; http.host; content:"vasudevrameshjangid.github.io"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000618; classtype:social-engineering; sid:6000618; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie .po34u72830904 .shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.po34u72830904.shop"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000619; classtype:social-engineering; sid:6000619; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie .9483ioi5484 .lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.9483ioi5484.lat"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000620; classtype:social-engineering; sid:6000620; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie .7as8875a99s .cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.7as8875a99s.cfd"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000621; classtype:social-engineering; sid:6000621; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hubert .acces948207 .pro/captcha .php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"hubert.acces948207.pro"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000622; classtype:social-engineering; sid:6000622; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amina .acces948207 .pro/index .php)"; flow:established,to_server; http.uri; content:"/index.php"; startswith; fast_pattern; http.host; content:"amina.acces948207.pro"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000623; classtype:social-engineering; sid:6000623; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pridevallte .my/us/Amp .html?eta=mail@example .com)"; flow:established,to_server; http.uri; content:"/us/Amp.html?eta=mail@example.com"; startswith; fast_pattern; http.host; content:"pridevallte.my"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000624; classtype:social-engineering; sid:6000624; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verifykyc2025 .info/483565418572)"; flow:established,to_server; http.uri; content:"/483565418572"; startswith; fast_pattern; http.host; content:"verifykyc2025.info"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000625; classtype:social-engineering; sid:6000625; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie .9209288774g .lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.9209288774g.lat"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000626; classtype:social-engineering; sid:6000626; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (generics-store .gashelpservices .com/cp-home/pl/?2f8d70ac8d9e5e091b8e63f16dc19ebc)"; flow:established,to_server; http.uri; content:"/cp-home/pl/?2f8d70ac8d9e5e091b8e63f16dc19ebc"; startswith; fast_pattern; http.host; content:"generics-store.gashelpservices.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000627; classtype:social-engineering; sid:6000627; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .acces948207 .pro/captcha .php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"www.acces948207.pro"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000628; classtype:social-engineering; sid:6000628; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mdlnsvy .sparkasse-de .cfd/erneuern .php)"; flow:established,to_server; http.uri; content:"/erneuern.php"; startswith; fast_pattern; http.host; content:"mdlnsvy.sparkasse-de.cfd"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000629; classtype:social-engineering; sid:6000629; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rachid .acces948207 .pro/captcha .php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"rachid.acces948207.pro"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000630; classtype:social-engineering; sid:6000630; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro .9483ioi5484 .lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.9483ioi5484.lat"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000631; classtype:social-engineering; sid:6000631; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro .7848239054h0-542 .lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.7848239054h0-542.lat"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000632; classtype:social-engineering; sid:6000632; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie .oopo889d0s87 .shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.oopo889d0s87.shop"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000633; classtype:social-engineering; sid:6000633; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myssouphuldappcdn .wixstudio .com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"myssouphuldappcdn.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000634; classtype:social-engineering; sid:6000634; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (howhow .cl/article/v2/ZEhWb1oyVm4mYmprdVkydz0=)"; flow:established,to_server; http.uri; content:"/article/v2/ZEhWb1oyVm4mYmprdVkydz0="; startswith; fast_pattern; http.host; content:"howhow.cl"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000635; classtype:social-engineering; sid:6000635; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro .7as8875a99s .cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.7as8875a99s.cfd"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000636; classtype:social-engineering; sid:6000636; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (download-ledgu .wixstudio .com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"download-ledgu.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000637; classtype:social-engineering; sid:6000637; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gateway-desktop .wixstudio .com/desktop)"; flow:established,to_server; http.uri; content:"/desktop"; startswith; fast_pattern; http.host; content:"gateway-desktop.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000638; classtype:social-engineering; sid:6000638; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro .91023747462349134 .lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.91023747462349134.lat"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000639; classtype:social-engineering; sid:6000639; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (olyp01nxt-zjbb .c8onkf .top/o/vdnby/1778423729469#selectedbank2&LOADS)"; flow:established,to_server; http.uri; content:"/o/vdnby/1778423729469#selectedbank2&LOADS"; startswith; fast_pattern; http.host; content:"olyp01nxt-zjbb.c8onkf.top"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000640; classtype:social-engineering; sid:6000640; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ssoledgrcom .wixstudio .com/start)"; flow:established,to_server; http.uri; content:"/start"; startswith; fast_pattern; http.host; content:"ssoledgrcom.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000641; classtype:social-engineering; sid:6000641; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (youssef .acces948207 .pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"youssef.acces948207.pro"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000642; classtype:social-engineering; sid:6000642; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docusign-signing-evelope65792 .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"docusign-signing-evelope65792.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000643; classtype:social-engineering; sid:6000643; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (volorecoverydocuments .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"volorecoverydocuments.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000644; classtype:social-engineering; sid:6000644; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j69t .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j69t.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000645; classtype:social-engineering; sid:6000645; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (goattechnologies .co/wp-admin/js/DDDDD55666244hh4y4888111rfdr74gggghdd22122111usignnewcoded231view231%20(2) .html)"; flow:established,to_server; http.uri; content:"/wp-admin/js/DDDDD55666244hh4y4888111rfdr74gggghdd22122111usignnewcoded231view231%20(2).html"; startswith; fast_pattern; http.host; content:"goattechnologies.co"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000646; classtype:social-engineering; sid:6000646; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dcqxqqx .dumzv .cn/gpajp/accunt/lginox/)"; flow:established,to_server; http.uri; content:"/gpajp/accunt/lginox/"; startswith; fast_pattern; http.host; content:"dcqxqqx.dumzv.cn"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000647; classtype:social-engineering; sid:6000647; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-de-beam-xi .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-de-beam-xi.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000648; classtype:social-engineering; sid:6000648; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie .7848239054h0-542 .lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.7848239054h0-542.lat"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000649; classtype:social-engineering; sid:6000649; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro .7238239034g34-212 .shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.7238239034g34-212.shop"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000650; classtype:social-engineering; sid:6000650; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie .8399046193850 .lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.8399046193850.lat"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000651; classtype:social-engineering; sid:6000651; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flashusdt2026 .github .io/Flash-Usdt/)"; flow:established,to_server; http.uri; content:"/Flash-Usdt/"; startswith; fast_pattern; http.host; content:"flashusdt2026.github.io"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000652; classtype:social-engineering; sid:6000652; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie .83289034 .lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.83289034.lat"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000653; classtype:social-engineering; sid:6000653; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro .8439-goo .shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.8439-goo.shop"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000654; classtype:social-engineering; sid:6000654; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eatelwebmailnotice .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eatelwebmailnotice.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000655; classtype:social-engineering; sid:6000655; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (claimusdtwebflow .pages .dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"claimusdtwebflow.pages.dev"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000656; classtype:social-engineering; sid:6000656; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .taxreliefamerica .org/lo?campaign_id=461778&aff_id=562077&ad_id=0&aff_sub=821908&click_id=05_262310365_caafda85-cbda-45c7-8590-07f08f948072&AffiliateReferenceID=747882496)"; flow:established,to_server; http.uri; content:"/lo?campaign_id=461778&aff_id=562077&ad_id=0&aff_sub=821908&click_id=05_262310365_caafda85-cbda-45c7-8590-07f08f948072&AffiliateReferenceID=747882496"; startswith; fast_pattern; http.host; content:"www.taxreliefamerica.org"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000657; classtype:social-engineering; sid:6000657; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (werasdvumtredascin .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"werasdvumtredascin.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000658; classtype:social-engineering; sid:6000658; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zimbrasecupdateam .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zimbrasecupdateam.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000659; classtype:social-engineering; sid:6000659; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .serverbwll .com/3B6F21F/S5T8TN8/?__rpt=0&__po=18953&__ptid=032236434b254665858f5f8bc9680037&__rpa=1&__rc=1&sub1=5&sub2=&sub3=&sub4=&sub5=&source_id=&__pcd=2)"; flow:established,to_server; http.uri; content:"/3B6F21F/S5T8TN8/?__rpt=0&__po=18953&__ptid=032236434b254665858f5f8bc9680037&__rpa=1&__rc=1&sub1=5&sub2=&sub3=&sub4=&sub5=&source_id=&__pcd=2"; startswith; fast_pattern; http.host; content:"www.serverbwll.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000660; classtype:social-engineering; sid:6000660; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bridge-trezer-pages .wixstudio .com/bing)"; flow:established,to_server; http.uri; content:"/bing"; startswith; fast_pattern; http.host; content:"bridge-trezer-pages.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000661; classtype:social-engineering; sid:6000661; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (us-support-ledgor-en .pages .dev/page1 .html/page4 .html/)"; flow:established,to_server; http.uri; content:"/page1.html/page4.html/"; startswith; fast_pattern; http.host; content:"us-support-ledgor-en.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000662; classtype:social-engineering; sid:6000662; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ashish-0712-web .github .io/netflix_01/)"; flow:established,to_server; http.uri; content:"/netflix_01/"; startswith; fast_pattern; http.host; content:"ashish-0712-web.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000663; classtype:social-engineering; sid:6000663; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (easybank-sage .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"easybank-sage.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000664; classtype:social-engineering; sid:6000664; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (harshika1402 .github .io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"harshika1402.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000665; classtype:social-engineering; sid:6000665; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (leddgger--wallet .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"leddgger--wallet.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000666; classtype:social-engineering; sid:6000666; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-135a4055f8454025aa2f06845da4f8d8 .r2 .dev/poiuyt .html)"; flow:established,to_server; http.uri; content:"/poiuyt.html"; startswith; fast_pattern; http.host; content:"pub-135a4055f8454025aa2f06845da4f8d8.r2.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000667; classtype:social-engineering; sid:6000667; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (realshayanahmed .github .io/netflix/)"; flow:established,to_server; http.uri; content:"/netflix/"; startswith; fast_pattern; http.host; content:"realshayanahmed.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000668; classtype:social-engineering; sid:6000668; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mintclaimpage408 .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mintclaimpage408.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000669; classtype:social-engineering; sid:6000669; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imshauryaa .github .io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"imshauryaa.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000670; classtype:social-engineering; sid:6000670; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-eight-blond .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-eight-blond.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000671; classtype:social-engineering; sid:6000671; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s4w .in/DBRnq)"; flow:established,to_server; http.uri; content:"/DBRnq"; startswith; fast_pattern; http.host; content:"s4w.in"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000672; classtype:social-engineering; sid:6000672; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sunkonto .jalenemurphy .com/rd/html/index .html)"; flow:established,to_server; http.uri; content:"/rd/html/index.html"; startswith; fast_pattern; http.host; content:"sunkonto.jalenemurphy.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000673; classtype:social-engineering; sid:6000673; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .personas-svp .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.personas-svp.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000674; classtype:social-engineering; sid:6000674; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (workstation-support .com/83491978871193d0b92f80deeaf8f06643aa7546)"; flow:established,to_server; http.uri; content:"/83491978871193d0b92f80deeaf8f06643aa7546"; startswith; fast_pattern; http.host; content:"workstation-support.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000675; classtype:social-engineering; sid:6000675; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-mekssign .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-mekssign.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000676; classtype:social-engineering; sid:6000676; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shiven5968 .github .io/ShivendraPratapSingh .github .io/)"; flow:established,to_server; http.uri; content:"/ShivendraPratapSingh.github.io/"; startswith; fast_pattern; http.host; content:"shiven5968.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000677; classtype:social-engineering; sid:6000677; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .cus-tom-er-sup-port-pro-cry-pto .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cus-tom-er-sup-port-pro-cry-pto.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000678; classtype:social-engineering; sid:6000678; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docusignature-firmar .github .io/pdf)"; flow:established,to_server; http.uri; content:"/pdf"; startswith; fast_pattern; http.host; content:"docusignature-firmar.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000679; classtype:social-engineering; sid:6000679; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .robiox .com .ps/games/103118820958944/Dont-enter-this-game?privateServerLinkCode=21847159545286821032822051883874)"; flow:established,to_server; http.uri; content:"/games/103118820958944/Dont-enter-this-game?privateServerLinkCode=21847159545286821032822051883874"; startswith; fast_pattern; http.host; content:"www.robiox.com.ps"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000680; classtype:social-engineering; sid:6000680; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .123345678g .blogspot .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.123345678g.blogspot.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000681; classtype:social-engineering; sid:6000681; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .busanopen .org/office/msgvoice/source/Login .php)"; flow:established,to_server; http.uri; content:"/office/msgvoice/source/Login.php"; startswith; fast_pattern; http.host; content:"www.busanopen.org"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000682; classtype:social-engineering; sid:6000682; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-328b2c608f85458baef54afef68fbb4a .r2 .dev/xikedgud .html)"; flow:established,to_server; http.uri; content:"/xikedgud.html"; startswith; fast_pattern; http.host; content:"pub-328b2c608f85458baef54afef68fbb4a.r2.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000683; classtype:social-engineering; sid:6000683; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mrgamal07 .github .io/Netmirror_clone/)"; flow:established,to_server; http.uri; content:"/Netmirror_clone/"; startswith; fast_pattern; http.host; content:"mrgamal07.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000684; classtype:social-engineering; sid:6000684; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s .tikglobalshop .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"s.tikglobalshop.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000685; classtype:social-engineering; sid:6000685; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (us-support-ledgor-en .pages .dev/page1 .html/page2 .html)"; flow:established,to_server; http.uri; content:"/page1.html/page2.html"; startswith; fast_pattern; http.host; content:"us-support-ledgor-en.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000686; classtype:social-engineering; sid:6000686; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sign .emptyp .xyz/new/)"; flow:established,to_server; http.uri; content:"/new/"; startswith; fast_pattern; http.host; content:"sign.emptyp.xyz"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000687; classtype:social-engineering; sid:6000687; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jys .zcpay .vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jys.zcpay.vip"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000688; classtype:social-engineering; sid:6000688; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tgzqn8hfh2-alt .github .io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"tgzqn8hfh2-alt.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000689; classtype:social-engineering; sid:6000689; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (discontcomputers .com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"discontcomputers.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000690; classtype:social-engineering; sid:6000690; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j53n .vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j53n.vip"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000691; classtype:social-engineering; sid:6000691; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .netflix-clone-iota-sand .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-iota-sand.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000692; classtype:social-engineering; sid:6000692; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gauri426 .github .io/netflix-clone)"; flow:established,to_server; http.uri; content:"/netflix-clone"; startswith; fast_pattern; http.host; content:"gauri426.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000693; classtype:social-engineering; sid:6000693; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gitika-lang .github .io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"gitika-lang.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000694; classtype:social-engineering; sid:6000694; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sgin12-dhl .mdbgo .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sgin12-dhl.mdbgo.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000695; classtype:social-engineering; sid:6000695; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .roberthood .net/me/young/quak/bizmail .php)"; flow:established,to_server; http.uri; content:"/me/young/quak/bizmail.php"; startswith; fast_pattern; http.host; content:"www.roberthood.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000696; classtype:social-engineering; sid:6000696; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a-creator-collab .github .io/Netflix-Clone)"; flow:established,to_server; http.uri; content:"/Netflix-Clone"; startswith; fast_pattern; http.host; content:"a-creator-collab.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000697; classtype:social-engineering; sid:6000697; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vistaequiltypanters .itpatches .com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"vistaequiltypanters.itpatches.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000698; classtype:social-engineering; sid:6000698; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (monicaloganathan29 .github .io/Instagram-login-page)"; flow:established,to_server; http.uri; content:"/Instagram-login-page"; startswith; fast_pattern; http.host; content:"monicaloganathan29.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000699; classtype:social-engineering; sid:6000699; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (religious-studies .028426 .com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"religious-studies.028426.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000700; classtype:social-engineering; sid:6000700; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nhncafe-articleview .com/view/482915?ref=17842781204274061)"; flow:established,to_server; http.uri; content:"/view/482915?ref=17842781204274061"; startswith; fast_pattern; http.host; content:"nhncafe-articleview.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000701; classtype:social-engineering; sid:6000701; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ipfs .io/ipfs/bafkreiatmr6qgs4jzvvqgllrbnpdyslwy6rfazygzkdr74zspvpwwhqdcy)"; flow:established,to_server; http.uri; content:"/ipfs/bafkreiatmr6qgs4jzvvqgllrbnpdyslwy6rfazygzkdr74zspvpwwhqdcy"; startswith; fast_pattern; http.host; content:"ipfs.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000702; classtype:social-engineering; sid:6000702; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netcoinslogiins .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netcoinslogiins.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000703; classtype:social-engineering; sid:6000703; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-97673970c1c145eda5e559c4f9c18f61 .r2 .dev/b94 .html)"; flow:established,to_server; http.uri; content:"/b94.html"; startswith; fast_pattern; http.host; content:"pub-97673970c1c145eda5e559c4f9c18f61.r2.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000704; classtype:social-engineering; sid:6000704; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cus-tom-er-sup-port-pro-cry-pto .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cus-tom-er-sup-port-pro-cry-pto.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000705; classtype:social-engineering; sid:6000705; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .baradua .it/wp/wp-content/plugins/MADE/files/top .html)"; flow:established,to_server; http.uri; content:"/wp/wp-content/plugins/MADE/files/top.html"; startswith; fast_pattern; http.host; content:"www.baradua.it"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000706; classtype:social-engineering; sid:6000706; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .14210 .xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.14210.xyz"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000707; classtype:social-engineering; sid:6000707; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tusharchaudhary08 .github .io/Amazon-clone)"; flow:established,to_server; http.uri; content:"/Amazon-clone"; startswith; fast_pattern; http.host; content:"tusharchaudhary08.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000708; classtype:social-engineering; sid:6000708; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (svt-aletaharropact6825 .pages .dev/help/contact/40753235360807/)"; flow:established,to_server; http.uri; content:"/help/contact/40753235360807/"; startswith; fast_pattern; http.host; content:"svt-aletaharropact6825.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000709; classtype:social-engineering; sid:6000709; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .gwenet .org/office/)"; flow:established,to_server; http.uri; content:"/office/"; startswith; fast_pattern; http.host; content:"www.gwenet.org"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000710; classtype:social-engineering; sid:6000710; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kentakahashi0523 .github .io/rakutenaimatching/)"; flow:established,to_server; http.uri; content:"/rakutenaimatching/"; startswith; fast_pattern; http.host; content:"kentakahashi0523.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000711; classtype:social-engineering; sid:6000711; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ab2660713 .github .io/Netflix-/)"; flow:established,to_server; http.uri; content:"/Netflix-/"; startswith; fast_pattern; http.host; content:"ab2660713.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000712; classtype:social-engineering; sid:6000712; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (authstart-terezor .github .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"authstart-terezor.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000713; classtype:social-engineering; sid:6000713; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nidhisa20 .github .io/AmazonClone)"; flow:established,to_server; http.uri; content:"/AmazonClone"; startswith; fast_pattern; http.host; content:"nidhisa20.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000714; classtype:social-engineering; sid:6000714; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lzlwj .pages .dev/-/zh/gp/most-gifted/pc/2348629011/ref=zg_mg_nav_pc_2_2516700011)"; flow:established,to_server; http.uri; content:"/-/zh/gp/most-gifted/pc/2348629011/ref=zg_mg_nav_pc_2_2516700011"; startswith; fast_pattern; http.host; content:"lzlwj.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000715; classtype:social-engineering; sid:6000715; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-cad-netcoins-com-auth .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sso-cad-netcoins-com-auth.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000716; classtype:social-engineering; sid:6000716; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t37y2vok1cuywyu .s3-website-us-east-1 .amazonaws .com/m30pnuxqli .html?email=redacted@anonymized .invalid)"; flow:established,to_server; http.uri; content:"/m30pnuxqli.html?email=redacted@anonymized.invalid"; startswith; fast_pattern; http.host; content:"t37y2vok1cuywyu.s3-website-us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000717; classtype:social-engineering; sid:6000717; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web2 .pancake .run/add/0x65a4fb74ced27d141dc6a8fcdcb737d35e8f453e/0xabd45b738521bedc8624ea5b359845a667a7edef?chain=bsc&persistChain=1)"; flow:established,to_server; http.uri; content:"/add/0x65a4fb74ced27d141dc6a8fcdcb737d35e8f453e/0xabd45b738521bedc8624ea5b359845a667a7edef?chain=bsc&persistChain=1"; startswith; fast_pattern; http.host; content:"web2.pancake.run"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000718; classtype:social-engineering; sid:6000718; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s .eu .premiumisp .net/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa/)"; flow:established,to_server; http.uri; content:"/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa/"; startswith; fast_pattern; http.host; content:"s.eu.premiumisp.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000719; classtype:social-engineering; sid:6000719; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-8ba6f3d0f12540a28a23829b162b6d0a .r2 .dev/index .html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-8ba6f3d0f12540a28a23829b162b6d0a.r2.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000720; classtype:social-engineering; sid:6000720; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bregrei-nnolopre-a1f1246 .pages .dev/account-support .html/)"; flow:established,to_server; http.uri; content:"/account-support.html/"; startswith; fast_pattern; http.host; content:"bregrei-nnolopre-a1f1246.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000721; classtype:social-engineering; sid:6000721; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (easybank-landing-page-alpha-seven .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"easybank-landing-page-alpha-seven.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000722; classtype:social-engineering; sid:6000722; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vasu-636 .github .io/Day-20/)"; flow:established,to_server; http.uri; content:"/Day-20/"; startswith; fast_pattern; http.host; content:"vasu-636.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000723; classtype:social-engineering; sid:6000723; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www-57365 .cc/index_m .html)"; flow:established,to_server; http.uri; content:"/index_m.html"; startswith; fast_pattern; http.host; content:"www-57365.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000724; classtype:social-engineering; sid:6000724; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s .eu .premiumisp .net/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"s.eu.premiumisp.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000725; classtype:social-engineering; sid:6000725; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-eb03e594738b420c8a34cb7366d9f29b .r2 .dev/lkjhgz .html)"; flow:established,to_server; http.uri; content:"/lkjhgz.html"; startswith; fast_pattern; http.host; content:"pub-eb03e594738b420c8a34cb7366d9f29b.r2.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000726; classtype:social-engineering; sid:6000726; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jeanjacquesbaudeau .github .io/popbela2026/)"; flow:established,to_server; http.uri; content:"/popbela2026/"; startswith; fast_pattern; http.host; content:"jeanjacquesbaudeau.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000727; classtype:social-engineering; sid:6000727; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cn .98mebetx .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cn.98mebetx.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000728; classtype:social-engineering; sid:6000728; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xalvo-remti-biz-kopra-zenlo-sp21ct3 .pages .dev/:/)"; flow:established,to_server; http.uri; content:"/:/"; startswith; fast_pattern; http.host; content:"xalvo-remti-biz-kopra-zenlo-sp21ct3.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000729; classtype:social-engineering; sid:6000729; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-8b8de6dbc21b4bb49ceaead3297322f4 .r2 .dev/woosx .html)"; flow:established,to_server; http.uri; content:"/woosx.html"; startswith; fast_pattern; http.host; content:"pub-8b8de6dbc21b4bb49ceaead3297322f4.r2.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000730; classtype:social-engineering; sid:6000730; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2iq900si9q-ef4d2cc124 .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2iq900si9q-ef4d2cc124.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000731; classtype:social-engineering; sid:6000731; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-519769e9eb634616b1746c2018641d56 .r2 .dev/zanc .html)"; flow:established,to_server; http.uri; content:"/zanc.html"; startswith; fast_pattern; http.host; content:"pub-519769e9eb634616b1746c2018641d56.r2.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000732; classtype:social-engineering; sid:6000732; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (newsalerts .eu/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/"; startswith; fast_pattern; http.host; content:"newsalerts.eu"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000733; classtype:social-engineering; sid:6000733; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fnxx .info/t9597e15921b1c442cdb86b9a4enda28ceca .html)"; flow:established,to_server; http.uri; content:"/t9597e15921b1c442cdb86b9a4enda28ceca.html"; startswith; fast_pattern; http.host; content:"fnxx.info"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000734; classtype:social-engineering; sid:6000734; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-3201b0059e074b9486139d100a5af429 .r2 .dev/bv .html)"; flow:established,to_server; http.uri; content:"/bv.html"; startswith; fast_pattern; http.host; content:"pub-3201b0059e074b9486139d100a5af429.r2.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000735; classtype:social-engineering; sid:6000735; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dilmurodbabadjanov9-boop .github .io/login-page)"; flow:established,to_server; http.uri; content:"/login-page"; startswith; fast_pattern; http.host; content:"dilmurodbabadjanov9-boop.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000736; classtype:social-engineering; sid:6000736; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apurbo-21 .github .io/NETFLIX-CLONE-FRONTEND)"; flow:established,to_server; http.uri; content:"/NETFLIX-CLONE-FRONTEND"; startswith; fast_pattern; http.host; content:"apurbo-21.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000737; classtype:social-engineering; sid:6000737; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docu-share-direct-lnk-5378edjksjhdb .vercel .app/docu-share-download98yhjkfdyidy8idyi .html)"; flow:established,to_server; http.uri; content:"/docu-share-download98yhjkfdyidy8idyi.html"; startswith; fast_pattern; http.host; content:"docu-share-direct-lnk-5378edjksjhdb.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000738; classtype:social-engineering; sid:6000738; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cn .mxahat .com/home/register/)"; flow:established,to_server; http.uri; content:"/home/register/"; startswith; fast_pattern; http.host; content:"cn.mxahat.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000739; classtype:social-engineering; sid:6000739; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledhgyta-zbxncg .pages .dev/index .htm)"; flow:established,to_server; http.uri; content:"/index.htm"; startswith; fast_pattern; http.host; content:"ledhgyta-zbxncg.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000740; classtype:social-engineering; sid:6000740; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sohamghadai42 .github .io/MOVIE-UI-CLONE/)"; flow:established,to_server; http.uri; content:"/MOVIE-UI-CLONE/"; startswith; fast_pattern; http.host; content:"sohamghadai42.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000741; classtype:social-engineering; sid:6000741; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fnxx .info/311ec6f3e3d0314fe7i84b31fe5u345727b9 .html)"; flow:established,to_server; http.uri; content:"/311ec6f3e3d0314fe7i84b31fe5u345727b9.html"; startswith; fast_pattern; http.host; content:"fnxx.info"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000742; classtype:social-engineering; sid:6000742; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (u .dongbeilaobo .com/wap)"; flow:established,to_server; http.uri; content:"/wap"; startswith; fast_pattern; http.host; content:"u.dongbeilaobo.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000743; classtype:social-engineering; sid:6000743; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .merenciano .net/serviciodecorreo/login/)"; flow:established,to_server; http.uri; content:"/serviciodecorreo/login/"; startswith; fast_pattern; http.host; content:"www.merenciano.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000744; classtype:social-engineering; sid:6000744; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (primastream .com/AUTH/lot .php/)"; flow:established,to_server; http.uri; content:"/AUTH/lot.php/"; startswith; fast_pattern; http.host; content:"primastream.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000745; classtype:social-engineering; sid:6000745; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (salehaeman .github .io/Amazon-Clone)"; flow:established,to_server; http.uri; content:"/Amazon-Clone"; startswith; fast_pattern; http.host; content:"salehaeman.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000746; classtype:social-engineering; sid:6000746; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazonwebservices .security-unauthorised-request .com/login/Mgk-WCxcfmgseLHDblkV8Onp_5Wk9ykC3UkY=2Aw==5VFhUT1pballaUlxb/U5vi3iQc2ZYY-EdD-wtEnZbBycRD5f72/)"; flow:established,to_server; http.uri; content:"/login/Mgk-WCxcfmgseLHDblkV8Onp_5Wk9ykC3UkY=2Aw==5VFhUT1pballaUlxb/U5vi3iQc2ZYY-EdD-wtEnZbBycRD5f72/"; startswith; fast_pattern; http.host; content:"amazonwebservices.security-unauthorised-request.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000747; classtype:social-engineering; sid:6000747; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .update-exodus-helpcentre .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.update-exodus-helpcentre.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000748; classtype:social-engineering; sid:6000748; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (work-with-us-n244245456 .pages .dev/help/contact/716963313698236/)"; flow:established,to_server; http.uri; content:"/help/contact/716963313698236/"; startswith; fast_pattern; http.host; content:"work-with-us-n244245456.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000749; classtype:social-engineering; sid:6000749; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (karatsu .verifytoken .com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/"; startswith; fast_pattern; http.host; content:"karatsu.verifytoken.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000750; classtype:social-engineering; sid:6000750; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kkucooin-sso .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kkucooin-sso.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000751; classtype:social-engineering; sid:6000751; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hemasai333 .github .io/Amazon-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-clone/"; startswith; fast_pattern; http.host; content:"hemasai333.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000752; classtype:social-engineering; sid:6000752; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cvefnzixezc3a6miyg4xnufmpii7z4eahmaegdoujm5hxe36dbzq .legacy .datasprite-cdn .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cvefnzixezc3a6miyg4xnufmpii7z4eahmaegdoujm5hxe36dbzq.legacy.datasprite-cdn.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000753; classtype:social-engineering; sid:6000753; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thesidsupreme .github .io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"thesidsupreme.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000754; classtype:social-engineering; sid:6000754; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (capun .wasmer .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"capun.wasmer.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000755; classtype:social-engineering; sid:6000755; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (renatoselhane-droid .github .io/Mask)"; flow:established,to_server; http.uri; content:"/Mask"; startswith; fast_pattern; http.host; content:"renatoselhane-droid.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000756; classtype:social-engineering; sid:6000756; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure--auth-b-bitmatt .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure--auth-b-bitmatt.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000757; classtype:social-engineering; sid:6000757; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metta-mskaloggsin .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metta-mskaloggsin.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000758; classtype:social-engineering; sid:6000758; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (21266486365 .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"21266486365.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000759; classtype:social-engineering; sid:6000759; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tawhid2001 .github .io/Netlix-Clone)"; flow:established,to_server; http.uri; content:"/Netlix-Clone"; startswith; fast_pattern; http.host; content:"tawhid2001.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000760; classtype:social-engineering; sid:6000760; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tochinnaji .github .io/amazon-clone-3-0/tracking .html)"; flow:established,to_server; http.uri; content:"/amazon-clone-3-0/tracking.html"; startswith; fast_pattern; http.host; content:"tochinnaji.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000761; classtype:social-engineering; sid:6000761; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazonwebservices .security-unauthorised-request .com/login/Mgk-WCxcfmgseLHDblkV8Onp_5Wk9ykC3UkY=2Aw==7VlpWTVhZaFtYUF5Z/U5vi3iQc2ZYY-EdD-wtEnZbBycRD5f72/)"; flow:established,to_server; http.uri; content:"/login/Mgk-WCxcfmgseLHDblkV8Onp_5Wk9ykC3UkY=2Aw==7VlpWTVhZaFtYUF5Z/U5vi3iQc2ZYY-EdD-wtEnZbBycRD5f72/"; startswith; fast_pattern; http.host; content:"amazonwebservices.security-unauthorised-request.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000762; classtype:social-engineering; sid:6000762; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (unsungpwa .github .io/bankofamerica/login .html)"; flow:established,to_server; http.uri; content:"/bankofamerica/login.html"; startswith; fast_pattern; http.host; content:"unsungpwa.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000763; classtype:social-engineering; sid:6000763; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (armt .cloud/devices/297905DB5084)"; flow:established,to_server; http.uri; content:"/devices/297905DB5084"; startswith; fast_pattern; http.host; content:"armt.cloud"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000764; classtype:social-engineering; sid:6000764; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (music-app-clone .netlify .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"music-app-clone.netlify.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000765; classtype:social-engineering; sid:6000765; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vishakha-23 .github .io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"vishakha-23.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000766; classtype:social-engineering; sid:6000766; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .instalgram .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instalgram.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000767; classtype:social-engineering; sid:6000767; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vfdksvkfndvkbnksfd-d8f9a7g0dzh9dads .z03 .azurefd .net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vfdksvkfndvkbnksfd-d8f9a7g0dzh9dads.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000768; classtype:social-engineering; sid:6000768; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (svt-aletaharropact6825 .pages .dev/help/contact/157264862400478/)"; flow:established,to_server; http.uri; content:"/help/contact/157264862400478/"; startswith; fast_pattern; http.host; content:"svt-aletaharropact6825.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000769; classtype:social-engineering; sid:6000769; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (us-support-ledgor-en .pages .dev/page1 .html/page3 .html)"; flow:established,to_server; http.uri; content:"/page1.html/page3.html"; startswith; fast_pattern; http.host; content:"us-support-ledgor-en.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000770; classtype:social-engineering; sid:6000770; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (u0688998 .plsk .regruhosting .ru/wp-content/themes/twentytwentyone/assets/ .ss/SF-Express/e-invoice .php)"; flow:established,to_server; http.uri; content:"/wp-content/themes/twentytwentyone/assets/.ss/SF-Express/e-invoice.php"; startswith; fast_pattern; http.host; content:"u0688998.plsk.regruhosting.ru"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000771; classtype:social-engineering; sid:6000771; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-a5d693aae13141eba692c69827d64a0f .r2 .dev/jhgmnbv .html)"; flow:established,to_server; http.uri; content:"/jhgmnbv.html"; startswith; fast_pattern; http.host; content:"pub-a5d693aae13141eba692c69827d64a0f.r2.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000772; classtype:social-engineering; sid:6000772; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-de59803496c8489585895b6917266e7c .r2 .dev/490578 .html)"; flow:established,to_server; http.uri; content:"/490578.html"; startswith; fast_pattern; http.host; content:"pub-de59803496c8489585895b6917266e7c.r2.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000773; classtype:social-engineering; sid:6000773; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .amazon-clone-sable-nu .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazon-clone-sable-nu.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000774; classtype:social-engineering; sid:6000774; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accounts .bmwweb .biz/en/login)"; flow:established,to_server; http.uri; content:"/en/login"; startswith; fast_pattern; http.host; content:"accounts.bmwweb.biz"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000775; classtype:social-engineering; sid:6000775; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paylessmini .com/kkt/boxMrenewal .php?rand=13InboxLightaspxn .1774256418&fid .4 .1252899642&fid=1&fav .1&rand .13InboxLight .aspxn .1774256418&fid .1252899642&fid .1&fav .1&email=& .rand=13InboxLight .aspx?n=1774256418&fid=4)"; flow:established,to_server; http.uri; content:"/kkt/boxMrenewal.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4"; startswith; fast_pattern; http.host; content:"paylessmini.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000776; classtype:social-engineering; sid:6000776; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail .creditunion-authority .com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"webmail.creditunion-authority.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000777; classtype:social-engineering; sid:6000777; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (basicpension .028426 .com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"basicpension.028426.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000778; classtype:social-engineering; sid:6000778; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sunkonto .jalenemurphy .com/rd)"; flow:established,to_server; http.uri; content:"/rd"; startswith; fast_pattern; http.host; content:"sunkonto.jalenemurphy.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000779; classtype:social-engineering; sid:6000779; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anejzigon .github .io/obrazec1/)"; flow:established,to_server; http.uri; content:"/obrazec1/"; startswith; fast_pattern; http.host; content:"anejzigon.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000780; classtype:social-engineering; sid:6000780; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gemiximlogen .gitbook .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gemiximlogen.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000781; classtype:social-engineering; sid:6000781; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hjr2411 .github .io/Intagram)"; flow:established,to_server; http.uri; content:"/Intagram"; startswith; fast_pattern; http.host; content:"hjr2411.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000782; classtype:social-engineering; sid:6000782; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member344 .center-meta-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member344.center-meta-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000783; classtype:social-engineering; sid:6000783; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (onur156 .github .io/instagram-phishing-tool/)"; flow:established,to_server; http.uri; content:"/instagram-phishing-tool/"; startswith; fast_pattern; http.host; content:"onur156.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000784; classtype:social-engineering; sid:6000784; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yashisaini718 .github .io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"yashisaini718.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000785; classtype:social-engineering; sid:6000785; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sarvin-lokmir-biz-helvar-sandrix-sp7ct12 .pages .dev/form_submit_appeal)"; flow:established,to_server; http.uri; content:"/form_submit_appeal"; startswith; fast_pattern; http.host; content:"sarvin-lokmir-biz-helvar-sandrix-sp7ct12.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000786; classtype:social-engineering; sid:6000786; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help---cloud--ledger .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"help---cloud--ledger.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000787; classtype:social-engineering; sid:6000787; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vaasu0777 .github .io/Facebook-Clone/)"; flow:established,to_server; http.uri; content:"/Facebook-Clone/"; startswith; fast_pattern; http.host; content:"vaasu0777.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000788; classtype:social-engineering; sid:6000788; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sanskriti01717 .github .io/Asper-task-3--Netflex-frontend-clone-/)"; flow:established,to_server; http.uri; content:"/Asper-task-3--Netflex-frontend-clone-/"; startswith; fast_pattern; http.host; content:"sanskriti01717.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000789; classtype:social-engineering; sid:6000789; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (defendid .us/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"defendid.us"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000790; classtype:social-engineering; sid:6000790; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instalgram .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instalgram.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000791; classtype:social-engineering; sid:6000791; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s4w .in/www-roblox-com-users-13342902-profile)"; flow:established,to_server; http.uri; content:"/www-roblox-com-users-13342902-profile"; startswith; fast_pattern; http.host; content:"s4w.in"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000792; classtype:social-engineering; sid:6000792; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mohamedelsokary619 .github .io/linkedIn-project/login .html)"; flow:established,to_server; http.uri; content:"/linkedIn-project/login.html"; startswith; fast_pattern; http.host; content:"mohamedelsokary619.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000793; classtype:social-engineering; sid:6000793; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-alert-center-243 .pages .dev/appeal_form)"; flow:established,to_server; http.uri; content:"/appeal_form"; startswith; fast_pattern; http.host; content:"account-alert-center-243.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000794; classtype:social-engineering; sid:6000794; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pujarijay001 .github .io/NF_LandingPage/)"; flow:established,to_server; http.uri; content:"/NF_LandingPage/"; startswith; fast_pattern; http.host; content:"pujarijay001.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000795; classtype:social-engineering; sid:6000795; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ryanml .github .io/website/)"; flow:established,to_server; http.uri; content:"/website/"; startswith; fast_pattern; http.host; content:"ryanml.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000796; classtype:social-engineering; sid:6000796; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (edisjkazndkqwsn .netlify .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"edisjkazndkqwsn.netlify.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000797; classtype:social-engineering; sid:6000797; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anmoldhiman9592 .github .io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"anmoldhiman9592.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000798; classtype:social-engineering; sid:6000798; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd .qzrvtlnkpm .cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.qzrvtlnkpm.cfd"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000799; classtype:social-engineering; sid:6000799; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kovvuri-chandra-kiran-reddy .github .io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"kovvuri-chandra-kiran-reddy.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000800; classtype:social-engineering; sid:6000800; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shtruz494 .github .io/steam)"; flow:established,to_server; http.uri; content:"/steam"; startswith; fast_pattern; http.host; content:"shtruz494.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000801; classtype:social-engineering; sid:6000801; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yashisahay .github .io/Project1/)"; flow:established,to_server; http.uri; content:"/Project1/"; startswith; fast_pattern; http.host; content:"yashisahay.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000802; classtype:social-engineering; sid:6000802; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fnxx .info/3a4a3db5333fa84f34ia1a085dau5cfecb9e .html)"; flow:established,to_server; http.uri; content:"/3a4a3db5333fa84f34ia1a085dau5cfecb9e.html"; startswith; fast_pattern; http.host; content:"fnxx.info"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000803; classtype:social-engineering; sid:6000803; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7nwk3b3g4e4nkot .s3-website-us-east-1 .amazonaws .com/sxr63wndya .html?email=redacted@anonymized .invalid)"; flow:established,to_server; http.uri; content:"/sxr63wndya.html?email=redacted@anonymized.invalid"; startswith; fast_pattern; http.host; content:"7nwk3b3g4e4nkot.s3-website-us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000804; classtype:social-engineering; sid:6000804; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-8276494512bd4f1c9323c95cdab91fdd .r2 .dev/fudjukedx .html)"; flow:established,to_server; http.uri; content:"/fudjukedx.html"; startswith; fast_pattern; http.host; content:"pub-8276494512bd4f1c9323c95cdab91fdd.r2.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000805; classtype:social-engineering; sid:6000805; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (easybank-landing-page-ecru-eta .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"easybank-landing-page-ecru-eta.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000806; classtype:social-engineering; sid:6000806; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-ea66fe1b3c8e4757bafadfb9728b159c .r2 .dev/index .html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-ea66fe1b3c8e4757bafadfb9728b159c.r2.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000807; classtype:social-engineering; sid:6000807; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (frontendmentor-easybank-chi .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"frontendmentor-easybank-chi.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000808; classtype:social-engineering; sid:6000808; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (test .currentnewsalerts .com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"test.currentnewsalerts.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000809; classtype:social-engineering; sid:6000809; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (behindthephish .com/2513501 .doc/18a80a/fad0f483-81b2-45c6-ad47-7272058d9cb6)"; flow:established,to_server; http.uri; content:"/2513501.doc/18a80a/fad0f483-81b2-45c6-ad47-7272058d9cb6"; startswith; fast_pattern; http.host; content:"behindthephish.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000810; classtype:social-engineering; sid:6000810; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .derviemprendeecuador .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.derviemprendeecuador.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000811; classtype:social-engineering; sid:6000811; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .robiox .com .ps/users/462326172/profile)"; flow:established,to_server; http.uri; content:"/users/462326172/profile"; startswith; fast_pattern; http.host; content:"www.robiox.com.ps"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000812; classtype:social-engineering; sid:6000812; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (insta-clone-application .vercel .app/auth/login)"; flow:established,to_server; http.uri; content:"/auth/login"; startswith; fast_pattern; http.host; content:"insta-clone-application.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000813; classtype:social-engineering; sid:6000813; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (walletconnect .yusihk .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"walletconnect.yusihk.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000814; classtype:social-engineering; sid:6000814; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mconnect .028426 .com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"mconnect.028426.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000815; classtype:social-engineering; sid:6000815; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (28kjhga .pages .dev/-/zh/gp/video/detail/0NU8A04C6PNXJ7NNRFMMJACP09/ref=atv_pp_fi_116/)"; flow:established,to_server; http.uri; content:"/-/zh/gp/video/detail/0NU8A04C6PNXJ7NNRFMMJACP09/ref=atv_pp_fi_116/"; startswith; fast_pattern; http.host; content:"28kjhga.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000816; classtype:social-engineering; sid:6000816; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s4w .in/www-roblox-com-users-8847852424-profile)"; flow:established,to_server; http.uri; content:"/www-roblox-com-users-8847852424-profile"; startswith; fast_pattern; http.host; content:"s4w.in"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000817; classtype:social-engineering; sid:6000817; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (differsheet1 .github .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"differsheet1.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000818; classtype:social-engineering; sid:6000818; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maikfsas .ywefdewtf .eu .org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"maikfsas.ywefdewtf.eu.org"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000819; classtype:social-engineering; sid:6000819; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-56f667a126c243baaf8d2dc27eb25fe4 .r2 .dev/hjikgud .html)"; flow:established,to_server; http.uri; content:"/hjikgud.html"; startswith; fast_pattern; http.host; content:"pub-56f667a126c243baaf8d2dc27eb25fe4.r2.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000820; classtype:social-engineering; sid:6000820; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (homepage-btimart-auth-ohm .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"homepage-btimart-auth-ohm.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000821; classtype:social-engineering; sid:6000821; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wart0s .github .io/Youtube-Clone/)"; flow:established,to_server; http.uri; content:"/Youtube-Clone/"; startswith; fast_pattern; http.host; content:"wart0s.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000822; classtype:social-engineering; sid:6000822; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (divyanshisaluja .github .io/Task-Submission---Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Task-Submission---Netflix-Clone/"; startswith; fast_pattern; http.host; content:"divyanshisaluja.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000823; classtype:social-engineering; sid:6000823; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .busanopen .org/office/msgvoice/source/wrongpass .php)"; flow:established,to_server; http.uri; content:"/office/msgvoice/source/wrongpass.php"; startswith; fast_pattern; http.host; content:"www.busanopen.org"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000824; classtype:social-engineering; sid:6000824; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spotify-login .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spotify-login.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000825; classtype:social-engineering; sid:6000825; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (primastream .com/AUTH/lot .php)"; flow:established,to_server; http.uri; content:"/AUTH/lot.php"; startswith; fast_pattern; http.host; content:"primastream.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000826; classtype:social-engineering; sid:6000826; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (us-support-ledgor-en .pages .dev/page1 .html/page3 .html/)"; flow:established,to_server; http.uri; content:"/page1.html/page3.html/"; startswith; fast_pattern; http.host; content:"us-support-ledgor-en.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000827; classtype:social-engineering; sid:6000827; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xbox-clone-5h5w .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xbox-clone-5h5w.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000828; classtype:social-engineering; sid:6000828; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .robiox .com .ps/games/920587237/Adopt-Me?privateServerLinkCode=01459993886772677311142579639976)"; flow:established,to_server; http.uri; content:"/games/920587237/Adopt-Me?privateServerLinkCode=01459993886772677311142579639976"; startswith; fast_pattern; http.host; content:"www.robiox.com.ps"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000829; classtype:social-engineering; sid:6000829; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-pink-five .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-pink-five.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000830; classtype:social-engineering; sid:6000830; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (madhubharathitl .github .io/Netflix/)"; flow:established,to_server; http.uri; content:"/Netflix/"; startswith; fast_pattern; http.host; content:"madhubharathitl.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000831; classtype:social-engineering; sid:6000831; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zkb-kundenportal .icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zkb-kundenportal.icu"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000832; classtype:social-engineering; sid:6000832; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-238f01dd643c42f082469a85feccfb1c .r2 .dev/nm .html)"; flow:established,to_server; http.uri; content:"/nm.html"; startswith; fast_pattern; http.host; content:"pub-238f01dd643c42f082469a85feccfb1c.r2.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000833; classtype:social-engineering; sid:6000833; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (karelbugwac .github .io/facebook/)"; flow:established,to_server; http.uri; content:"/facebook/"; startswith; fast_pattern; http.host; content:"karelbugwac.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000834; classtype:social-engineering; sid:6000834; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kevenhenley6903 .pages .dev/2606:4700:310c::ac42:2fa3/)"; flow:established,to_server; http.uri; content:"/2606:4700:310c::ac42:2fa3/"; startswith; fast_pattern; http.host; content:"kevenhenley6903.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000835; classtype:social-engineering; sid:6000835; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortunate1 .wasmer .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortunate1.wasmer.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000836; classtype:social-engineering; sid:6000836; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aarambhband-dev .github .io/Reel-boostnew1/)"; flow:established,to_server; http.uri; content:"/Reel-boostnew1/"; startswith; fast_pattern; http.host; content:"aarambhband-dev.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000837; classtype:social-engineering; sid:6000837; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (greamreaper01 .github .io/Netflix/)"; flow:established,to_server; http.uri; content:"/Netflix/"; startswith; fast_pattern; http.host; content:"greamreaper01.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000838; classtype:social-engineering; sid:6000838; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s3 .eu-west-1 .amazonaws .com/files .secured .documents .blobcore .com/RFQ .html?eta=)"; flow:established,to_server; http.uri; content:"/files.secured.documents.blobcore.com/RFQ.html?eta="; startswith; fast_pattern; http.host; content:"s3.eu-west-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000839; classtype:social-engineering; sid:6000839; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pt-shopee1577 .blogspot .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pt-shopee1577.blogspot.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000840; classtype:social-engineering; sid:6000840; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .geminimlogico .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.geminimlogico.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000841; classtype:social-engineering; sid:6000841; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (derviemprendeecuador .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"derviemprendeecuador.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000842; classtype:social-engineering; sid:6000842; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (geminuslogi .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"geminuslogi.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000843; classtype:social-engineering; sid:6000843; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (armt .cloud/users/sign_in)"; flow:established,to_server; http.uri; content:"/users/sign_in"; startswith; fast_pattern; http.host; content:"armt.cloud"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000844; classtype:social-engineering; sid:6000844; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gemniiiilogin .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gemniiiilogin.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000845; classtype:social-engineering; sid:6000845; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mandirienergikonsultan .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mandirienergikonsultan.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000846; classtype:social-engineering; sid:6000846; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezor-bridgeapp .typedream .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezor-bridgeapp.typedream.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000847; classtype:social-engineering; sid:6000847; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (seunelvis1 .github .io/NetflixClone1 .github .io/)"; flow:established,to_server; http.uri; content:"/NetflixClone1.github.io/"; startswith; fast_pattern; http.host; content:"seunelvis1.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000848; classtype:social-engineering; sid:6000848; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie .pl-56901895 .lol/oferta/20096809/rowerek-dzieci)"; flow:established,to_server; http.uri; content:"/oferta/20096809/rowerek-dzieci"; startswith; fast_pattern; http.host; content:"allegrolokalnie.pl-56901895.lol"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000849; classtype:social-engineering; sid:6000849; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hardik508 .github .io/Netflix/)"; flow:established,to_server; http.uri; content:"/Netflix/"; startswith; fast_pattern; http.host; content:"hardik508.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000850; classtype:social-engineering; sid:6000850; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (edoctransfer .com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"edoctransfer.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000851; classtype:social-engineering; sid:6000851; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (joao-hribeiro .github .io/spotClone/)"; flow:established,to_server; http.uri; content:"/spotClone/"; startswith; fast_pattern; http.host; content:"joao-hribeiro.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000852; classtype:social-engineering; sid:6000852; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-66e912b43770436882b334d11d691328 .r2 .dev/b57 .html)"; flow:established,to_server; http.uri; content:"/b57.html"; startswith; fast_pattern; http.host; content:"pub-66e912b43770436882b334d11d691328.r2.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000853; classtype:social-engineering; sid:6000853; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pop3 .riszq .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pop3.riszq.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000854; classtype:social-engineering; sid:6000854; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paylessmini .com/kpk/boxMrenewal .php?rand=13InboxLightaspxn .1774256418&fid .4 .1252899642&fid=1&fav .1&rand .13InboxLight .aspxn .1774256418&fid .1252899642&fid .1&fav .1&email=bWFyaW9wcm9AN2Q1OGNmMjI1ZDkwMWI0MjE3MWU4OWMwYjZmOTlhM2NmZjNjLmNvbQ==& .rand=13InboxLight .aspx?n=1774256418&fid=4)"; flow:established,to_server; http.uri; content:"/kpk/boxMrenewal.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=bWFyaW9wcm9AN2Q1OGNmMjI1ZDkwMWI0MjE3MWU4OWMwYjZmOTlhM2NmZjNjLmNvbQ==&.rand=13InboxLight.aspx?n=1774256418&fid=4"; startswith; fast_pattern; http.host; content:"paylessmini.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000855; classtype:social-engineering; sid:6000855; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledhggt-vbhdgg .pages .dev/index .htm)"; flow:established,to_server; http.uri; content:"/index.htm"; startswith; fast_pattern; http.host; content:"ledhggt-vbhdgg.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000856; classtype:social-engineering; sid:6000856; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cnsqarrlogzn .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cnsqarrlogzn.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000857; classtype:social-engineering; sid:6000857; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (syedasiddiqa .github .io/Netflix-Landing-page-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Landing-page-clone/"; startswith; fast_pattern; http.host; content:"syedasiddiqa.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000858; classtype:social-engineering; sid:6000858; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pranav0923 .github .io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"pranav0923.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000859; classtype:social-engineering; sid:6000859; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mmapphubs .pages .dev/assets)"; flow:established,to_server; http.uri; content:"/assets"; startswith; fast_pattern; http.host; content:"mmapphubs.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000860; classtype:social-engineering; sid:6000860; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (umobu .com .br/xinfini/)"; flow:established,to_server; http.uri; content:"/xinfini/"; startswith; fast_pattern; http.host; content:"umobu.com.br"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000861; classtype:social-engineering; sid:6000861; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (advertising-campaign-reporting-hub .pages .dev/welcome_to_meta_for_business/*/)"; flow:established,to_server; http.uri; content:"/welcome_to_meta_for_business/*/"; startswith; fast_pattern; http.host; content:"advertising-campaign-reporting-hub.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000862; classtype:social-engineering; sid:6000862; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jay3jay3 .github .io/ig)"; flow:established,to_server; http.uri; content:"/ig"; startswith; fast_pattern; http.host; content:"jay3jay3.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000863; classtype:social-engineering; sid:6000863; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (costumesnsfw .com/2513501 .doc/18a80a/fad0f483-81b2-45c6-ad47-7272058d9cb6)"; flow:established,to_server; http.uri; content:"/2513501.doc/18a80a/fad0f483-81b2-45c6-ad47-7272058d9cb6"; startswith; fast_pattern; http.host; content:"costumesnsfw.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000864; classtype:social-engineering; sid:6000864; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-d71709b11f304e0b87fe3275219dc568 .r2 .dev/b82 .html)"; flow:established,to_server; http.uri; content:"/b82.html"; startswith; fast_pattern; http.host; content:"pub-d71709b11f304e0b87fe3275219dc568.r2.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000865; classtype:social-engineering; sid:6000865; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-cb72691642c444eb900a44aa1d8a7107 .r2 .dev/aguiyi-e5cc43015815732a4d38f73eec6434e3e5cc43015815732a4d38f73eec6434e3e5cc43015815732a4d38f73eec6434e3outl00kAguiyi .html)"; flow:established,to_server; http.uri; content:"/aguiyi-e5cc43015815732a4d38f73eec6434e3e5cc43015815732a4d38f73eec6434e3e5cc43015815732a4d38f73eec6434e3outl00kAguiyi.html"; startswith; fast_pattern; http.host; content:"pub-cb72691642c444eb900a44aa1d8a7107.r2.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000866; classtype:social-engineering; sid:6000866; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lucelia-softwareengineer .github .io/Projeto-Imersao-Front-End-com-IA/)"; flow:established,to_server; http.uri; content:"/Projeto-Imersao-Front-End-com-IA/"; startswith; fast_pattern; http.host; content:"lucelia-softwareengineer.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000867; classtype:social-engineering; sid:6000867; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-4e9d559e11c54314b7639d20c3d13682 .r2 .dev/doc8 .html)"; flow:established,to_server; http.uri; content:"/doc8.html"; startswith; fast_pattern; http.host; content:"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000868; classtype:social-engineering; sid:6000868; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (steelheart93 .github .io/phishing-example/index .html)"; flow:established,to_server; http.uri; content:"/phishing-example/index.html"; startswith; fast_pattern; http.host; content:"steelheart93.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000869; classtype:social-engineering; sid:6000869; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pappu773512-cmd .github .io/Amazon-clone-/)"; flow:established,to_server; http.uri; content:"/Amazon-clone-/"; startswith; fast_pattern; http.host; content:"pappu773512-cmd.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000870; classtype:social-engineering; sid:6000870; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .2iq900si9q-ef4d2cc124 .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.2iq900si9q-ef4d2cc124.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000871; classtype:social-engineering; sid:6000871; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-project-khaki .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-project-khaki.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000872; classtype:social-engineering; sid:6000872; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .hollykim .com/bbs_/f9ebaa/hvsjhhvs33/)"; flow:established,to_server; http.uri; content:"/bbs_/f9ebaa/hvsjhhvs33/"; startswith; fast_pattern; http.host; content:"www.hollykim.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000873; classtype:social-engineering; sid:6000873; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (us-support-ledgor-en .pages .dev/page1 .html/page1 .html/)"; flow:established,to_server; http.uri; content:"/page1.html/page1.html/"; startswith; fast_pattern; http.host; content:"us-support-ledgor-en.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000874; classtype:social-engineering; sid:6000874; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lnstagrarn .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lnstagrarn.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000875; classtype:social-engineering; sid:6000875; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acesso-pendencias .vercel .app/up1/index .html?name=Washington%25)"; flow:established,to_server; http.uri; content:"/up1/index.html?name=Washington%25"; startswith; fast_pattern; http.host; content:"acesso-pendencias.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000876; classtype:social-engineering; sid:6000876; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .galaxycompliance .info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.galaxycompliance.info"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000877; classtype:social-engineering; sid:6000877; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (formsly-form .web .app/gMCB3d10jZmUXNSpFa40Db/)"; flow:established,to_server; http.uri; content:"/gMCB3d10jZmUXNSpFa40Db/"; startswith; fast_pattern; http.host; content:"formsly-form.web.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000878; classtype:social-engineering; sid:6000878; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-bretokyo .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-bretokyo.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000879; classtype:social-engineering; sid:6000879; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-e3bfeaa6bcd34e0dadf2c3380a0824f3 .r2 .dev/jhgfdqwe .html)"; flow:established,to_server; http.uri; content:"/jhgfdqwe.html"; startswith; fast_pattern; http.host; content:"pub-e3bfeaa6bcd34e0dadf2c3380a0824f3.r2.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000880; classtype:social-engineering; sid:6000880; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yungisrael .github .io/NETFLIX/)"; flow:established,to_server; http.uri; content:"/NETFLIX/"; startswith; fast_pattern; http.host; content:"yungisrael.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000881; classtype:social-engineering; sid:6000881; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nazarbekuzbnazarbek-maker .github .io/my-slide-siteee)"; flow:established,to_server; http.uri; content:"/my-slide-siteee"; startswith; fast_pattern; http.host; content:"nazarbekuzbnazarbek-maker.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000882; classtype:social-engineering; sid:6000882; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member348 .center-meta-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member348.center-meta-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000883; classtype:social-engineering; sid:6000883; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .amazon-clone-bretokyo .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazon-clone-bretokyo.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000884; classtype:social-engineering; sid:6000884; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-ac9a92367c8548748bc2819d5c738f15 .r2 .dev/nhyujm .html)"; flow:established,to_server; http.uri; content:"/nhyujm.html"; startswith; fast_pattern; http.host; content:"pub-ac9a92367c8548748bc2819d5c738f15.r2.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000885; classtype:social-engineering; sid:6000885; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jahreed9 .github .io/Netflix-clone-website/)"; flow:established,to_server; http.uri; content:"/Netflix-clone-website/"; startswith; fast_pattern; http.host; content:"jahreed9.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000886; classtype:social-engineering; sid:6000886; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .ahhhh .pe .kr/zb41/data/1057168297/)"; flow:established,to_server; http.uri; content:"/zb41/data/1057168297/"; startswith; fast_pattern; http.host; content:"www.ahhhh.pe.kr"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000887; classtype:social-engineering; sid:6000887; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-00bef5f99dab49e39fc5ca6f34eab29a .r2 .dev/dsajhg .html)"; flow:established,to_server; http.uri; content:"/dsajhg.html"; startswith; fast_pattern; http.host; content:"pub-00bef5f99dab49e39fc5ca6f34eab29a.r2.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000888; classtype:social-engineering; sid:6000888; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-en--netcoins-io-cdn-s .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sso-en--netcoins-io-cdn-s.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000889; classtype:social-engineering; sid:6000889; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (link .hiper-ofertas .com/v/n6A/ZKcmFKZfaD89abtNgUhpSQ/c982fb15)"; flow:established,to_server; http.uri; content:"/v/n6A/ZKcmFKZfaD89abtNgUhpSQ/c982fb15"; startswith; fast_pattern; http.host; content:"link.hiper-ofertas.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000890; classtype:social-engineering; sid:6000890; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faizancodex05461 .github .io/SONAMSHARMA-HOT/)"; flow:established,to_server; http.uri; content:"/SONAMSHARMA-HOT/"; startswith; fast_pattern; http.host; content:"faizancodex05461.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000891; classtype:social-engineering; sid:6000891; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dharmendra06 .github .io/streaming-landing-page/)"; flow:established,to_server; http.uri; content:"/streaming-landing-page/"; startswith; fast_pattern; http.host; content:"dharmendra06.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000892; classtype:social-engineering; sid:6000892; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (addg .bjrr2 .my .id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"addg.bjrr2.my.id"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000893; classtype:social-engineering; sid:6000893; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netcoins-logiii .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netcoins-logiii.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000894; classtype:social-engineering; sid:6000894; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mohsin226240 .github .io/Netflix_home/)"; flow:established,to_server; http.uri; content:"/Netflix_home/"; startswith; fast_pattern; http.host; content:"mohsin226240.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000895; classtype:social-engineering; sid:6000895; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-6b898b25dccb43a8b9fd13efe75efaf8 .r2 .dev/vfgtred .html)"; flow:established,to_server; http.uri; content:"/vfgtred.html"; startswith; fast_pattern; http.host; content:"pub-6b898b25dccb43a8b9fd13efe75efaf8.r2.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000896; classtype:social-engineering; sid:6000896; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ujjawalghosh .github .io/ecommerce-ui-clone/)"; flow:established,to_server; http.uri; content:"/ecommerce-ui-clone/"; startswith; fast_pattern; http.host; content:"ujjawalghosh.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000897; classtype:social-engineering; sid:6000897; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktifkans-danax-paylter .tiaoxsid .my .id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktifkans-danax-paylter.tiaoxsid.my.id"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000898; classtype:social-engineering; sid:6000898; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail .lucrativehiring .com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"mail.lucrativehiring.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000899; classtype:social-engineering; sid:6000899; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .ratiphysiotherapy .co .za/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ratiphysiotherapy.co.za"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000900; classtype:social-engineering; sid:6000900; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a1 .1faw .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a1.1faw.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000901; classtype:social-engineering; sid:6000901; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chandrasekar19-h .github .io/insta-login-page)"; flow:established,to_server; http.uri; content:"/insta-login-page"; startswith; fast_pattern; http.host; content:"chandrasekar19-h.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000902; classtype:social-engineering; sid:6000902; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (insta-clone-application .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"insta-clone-application.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000903; classtype:social-engineering; sid:6000903; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .webuyworkshopequipment .com/wp-content/themes/sketch/js/SF_TRASH/c45b222914e3c78d/)"; flow:established,to_server; http.uri; content:"/wp-content/themes/sketch/js/SF_TRASH/c45b222914e3c78d/"; startswith; fast_pattern; http.host; content:"www.webuyworkshopequipment.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000904; classtype:social-engineering; sid:6000904; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ti-usr1-cp .cuc-carrera-ti .ac .cr/oc/?username=)"; flow:established,to_server; http.uri; content:"/oc/?username="; startswith; fast_pattern; http.host; content:"ti-usr1-cp.cuc-carrera-ti.ac.cr"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000905; classtype:social-engineering; sid:6000905; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (matamsklogzn .gitbook .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"matamsklogzn.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000906; classtype:social-engineering; sid:6000906; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vinihero1 .github .io/Instagram-Clone/)"; flow:established,to_server; http.uri; content:"/Instagram-Clone/"; startswith; fast_pattern; http.host; content:"vinihero1.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000907; classtype:social-engineering; sid:6000907; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-mail00 .standard .us-east-1 .oortstorages .com/doc/index .cvz?provider=1&signature=c9e9f35b19a0689f5026a6dd9f0da8ee494cd4668de6c57e25ee5a143abba4c4c1868edc6c2f9c3fb0b70c87116295271b1b31e142bd2d236240700c49dfaf60230212a4d89255c2b9bab69eb4e65bea)"; flow:established,to_server; http.uri; content:"/doc/index.cvz?provider=1&signature=c9e9f35b19a0689f5026a6dd9f0da8ee494cd4668de6c57e25ee5a143abba4c4c1868edc6c2f9c3fb0b70c87116295271b1b31e142bd2d236240700c49dfaf60230212a4d89255c2b9bab69eb4e65bea"; startswith; fast_pattern; http.host; content:"web-mail00.standard.us-east-1.oortstorages.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000908; classtype:social-engineering; sid:6000908; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clickheretofail .028426 .com/2513501 .doc/18a80a/fad0f483-81b2-45c6-ad47-7272058d9cb6)"; flow:established,to_server; http.uri; content:"/2513501.doc/18a80a/fad0f483-81b2-45c6-ad47-7272058d9cb6"; startswith; fast_pattern; http.host; content:"clickheretofail.028426.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000909; classtype:social-engineering; sid:6000909; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-clone-java-full-stack .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-clone-java-full-stack.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000910; classtype:social-engineering; sid:6000910; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ohmybargains .com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/"; startswith; fast_pattern; http.host; content:"ohmybargains.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000911; classtype:social-engineering; sid:6000911; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yogeshverma25 .github .io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"yogeshverma25.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000912; classtype:social-engineering; sid:6000912; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-daaf0f3c335c477184cc201bdc5b89b3 .r2 .dev/bgtcxz .html)"; flow:established,to_server; http.uri; content:"/bgtcxz.html"; startswith; fast_pattern; http.host; content:"pub-daaf0f3c335c477184cc201bdc5b89b3.r2.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000913; classtype:social-engineering; sid:6000913; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (easybank-landing-page-dngtnv .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"easybank-landing-page-dngtnv.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000914; classtype:social-engineering; sid:6000914; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verification .healthyemployee .me/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"verification.healthyemployee.me"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000915; classtype:social-engineering; sid:6000915; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17640 .invoice-ads-manager .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17640.invoice-ads-manager.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000916; classtype:social-engineering; sid:6000916; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abindevpm .github .io/website-clone/)"; flow:established,to_server; http.uri; content:"/website-clone/"; startswith; fast_pattern; http.host; content:"abindevpm.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000917; classtype:social-engineering; sid:6000917; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hasan-321 .github .io/video53-netflix-clone/)"; flow:established,to_server; http.uri; content:"/video53-netflix-clone/"; startswith; fast_pattern; http.host; content:"hasan-321.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000918; classtype:social-engineering; sid:6000918; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dhlsiprod .eu23 .smartcommunications .cloud/produce/home/)"; flow:established,to_server; http.uri; content:"/produce/home/"; startswith; fast_pattern; http.host; content:"dhlsiprod.eu23.smartcommunications.cloud"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000919; classtype:social-engineering; sid:6000919; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .o-shop .com/en/products/oakley-sunglasses-holbrook-polished-black-grey-polarized-oo9102-02-1652 .html)"; flow:established,to_server; http.uri; content:"/en/products/oakley-sunglasses-holbrook-polished-black-grey-polarized-oo9102-02-1652.html"; startswith; fast_pattern; http.host; content:"www.o-shop.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000920; classtype:social-engineering; sid:6000920; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-12823fbd443740db82cdf220f279156a .r2 .dev/949498939dhah9338kajk3jhh3i3 .html)"; flow:established,to_server; http.uri; content:"/949498939dhah9338kajk3jhh3i3.html"; startswith; fast_pattern; http.host; content:"pub-12823fbd443740db82cdf220f279156a.r2.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000921; classtype:social-engineering; sid:6000921; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .mintclaimpage408 .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mintclaimpage408.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000922; classtype:social-engineering; sid:6000922; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (renanpablo717 .github .io/clone-interface-musical/)"; flow:established,to_server; http.uri; content:"/clone-interface-musical/"; startswith; fast_pattern; http.host; content:"renanpablo717.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000923; classtype:social-engineering; sid:6000923; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ojesevgupta-create .github .io/PROJECT_SEM1/)"; flow:established,to_server; http.uri; content:"/PROJECT_SEM1/"; startswith; fast_pattern; http.host; content:"ojesevgupta-create.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000924; classtype:social-engineering; sid:6000924; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pageseuc1 .actmkt .com/(S(c42ixedctapxf23k42tzsial))/l/c5X8MfZz6j9Y7Fto3LAd)"; flow:established,to_server; http.uri; content:"/(S(c42ixedctapxf23k42tzsial))/l/c5X8MfZz6j9Y7Fto3LAd"; startswith; fast_pattern; http.host; content:"pageseuc1.actmkt.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000925; classtype:social-engineering; sid:6000925; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kjuteddoluinter .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kjuteddoluinter.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000926; classtype:social-engineering; sid:6000926; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (email-authwestriv .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"email-authwestriv.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000927; classtype:social-engineering; sid:6000927; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apps-livelaser .wixstudio .com/app-en)"; flow:established,to_server; http.uri; content:"/app-en"; startswith; fast_pattern; http.host; content:"apps-livelaser.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000928; classtype:social-engineering; sid:6000928; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lotescadasbh11 .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lotescadasbh11.vercel.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000929; classtype:social-engineering; sid:6000929; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bradescosuporte .digital/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bradescosuporte.digital"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000930; classtype:social-engineering; sid:6000930; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atualiza-netempresa .digital/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"atualiza-netempresa.digital"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000931; classtype:social-engineering; sid:6000931; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acessando-descontos .vercel .app/inicio/index .html?utm_source=FB&\;utm_campaign=P67-32-S31v10-R30%252Fnoemi+%25E2%2580%2594+C%25C3%25B3pia+%25E2%2580%2594+C%25C3%25B3pia+%25E2%2580%2594+C%25C3%25B3pia%257C120244205168850296&\;utm_medium=-%257C120244205168610296&\;utm_content=-%257C120244205168550296&\;utm_term=Facebook_Mobile_Feed&\;fbclid=IwdGRjcARsYBpleHRuA2FlbQEwAGFkaWQBqzF3t4XTaHNydGMGYXBwX2lkCjY2Mjg1NjgzNzkAAR5XNqhMSMZ_0CMhp2OXw_VdaBFr-IfuFq3rNwrT1klKZUDlCToqN-Pbj9ofJg_aem_9sW8jhVwpU8DM-2qeghQRg&\;utm_id=120244205168850296&\;twrclid=184013862054400000)"; flow:established,to_server; http.uri; content:"/inicio/index.html?utm_source=FB&|3b|utm_campaign=P67-32-S31v10-R30%252Fnoemi+%25E2%2580%2594+C%25C3%25B3pia+%25E2%2580%2594+C%25C3%25B3pia+%25E2%2580%2594+C%25C3%25B3pia%257C120244205168850296&|3b|utm_medium=-%257C120244205168610296&|3b|utm_content=-%257C120244205168550296&|3b|utm_term=Facebook_Mobile_Feed&|3b|fbclid=IwdGRjcARsYBpleHRuA2FlbQEwAGFkaWQBqzF3t4XTaHNydGMGYXBwX2lkCjY2Mjg1NjgzNzkAAR5XNqhMSMZ_0CMhp2OXw_VdaBFr-IfuFq3rNwrT1klKZUDlCToqN-Pbj9ofJg_aem_9sW8jhVwpU8DM-2qeghQRg&|3b|utm_id=120244205168850296&|3b|twrclid=184013862054400000"; startswith; fast_pattern; http.host; content:"acessando-descontos.vercel.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000932; classtype:social-engineering; sid:6000932; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bradesco .tarifasnetempresas .digital/app/desk/index .php?sc=wrapup&\;hash=836689e4f6a3a199722564af173c6cd93f755ffb)"; flow:established,to_server; http.uri; content:"/app/desk/index.php?sc=wrapup&|3b|hash=836689e4f6a3a199722564af173c6cd93f755ffb"; startswith; fast_pattern; http.host; content:"bradesco.tarifasnetempresas.digital"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000933; classtype:social-engineering; sid:6000933; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acesso .pjappempresas .click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"acesso.pjappempresas.click"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000934; classtype:social-engineering; sid:6000934; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mlsxabes .uk .cc/my)"; flow:established,to_server; http.uri; content:"/my"; startswith; fast_pattern; http.host; content:"mlsxabes.uk.cc"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000935; classtype:social-engineering; sid:6000935; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bhdenlinea7777servicios .iceiy .com/?fbclid=IwY2xjawRscvBleHRuA2FlbQIxMQBzcnRjBmFwcF9pZBAyMjIwMzkxNzg4MjAwODkyAAEe8PD_fxH_FroC4NbYLe8KLlqr6wJMWnFN1agqx8TTX23PB_Jv1Y8OpsbO7y4_aem_BFJqQr7yZNjYL_uvyROBwA&\;i=1)"; flow:established,to_server; http.uri; content:"/?fbclid=IwY2xjawRscvBleHRuA2FlbQIxMQBzcnRjBmFwcF9pZBAyMjIwMzkxNzg4MjAwODkyAAEe8PD_fxH_FroC4NbYLe8KLlqr6wJMWnFN1agqx8TTX23PB_Jv1Y8OpsbO7y4_aem_BFJqQr7yZNjYL_uvyROBwA&|3b|i=1"; startswith; fast_pattern; http.host; content:"bhdenlinea7777servicios.iceiy.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000936; classtype:social-engineering; sid:6000936; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (servicioslider .shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"servicioslider.shop"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000937; classtype:social-engineering; sid:6000937; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (airmilescalogin .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"airmilescalogin.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000938; classtype:social-engineering; sid:6000938; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro .6767yreg .lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.6767yreg.lat"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000939; classtype:social-engineering; sid:6000939; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mstamasklogun .gitbook .io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"mstamasklogun.gitbook.io"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000940; classtype:social-engineering; sid:6000940; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (solicitudes-bancrecer-ve .netlify .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"solicitudes-bancrecer-ve.netlify.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000941; classtype:social-engineering; sid:6000941; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fyn .zoy .temporary .site/404 .html)"; flow:established,to_server; http.uri; content:"/404.html"; startswith; fast_pattern; http.host; content:"fyn.zoy.temporary.site"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000942; classtype:social-engineering; sid:6000942; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ne12netempresa .com/acesso-seguro .php?token=16645381396a019ed855f416 .91533538)"; flow:established,to_server; http.uri; content:"/acesso-seguro.php?token=16645381396a019ed855f416.91533538"; startswith; fast_pattern; http.host; content:"ne12netempresa.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000943; classtype:social-engineering; sid:6000943; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .mixo .io/site/blank-page-ash41)"; flow:established,to_server; http.uri; content:"/site/blank-page-ash41"; startswith; fast_pattern; http.host; content:"www.mixo.io"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000944; classtype:social-engineering; sid:6000944; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro .823748opd1o28 .cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.823748opd1o28.cfd"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000945; classtype:social-engineering; sid:6000945; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie .apsaoc789102 .lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.apsaoc789102.lat"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000946; classtype:social-engineering; sid:6000946; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pichinchacreditos .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pichinchacreditos.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000947; classtype:social-engineering; sid:6000947; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (downloadledgerr .wixstudio .com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"downloadledgerr.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000948; classtype:social-engineering; sid:6000948; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (primecliente .xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"primecliente.xyz"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000949; classtype:social-engineering; sid:6000949; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (publicsuite-trezr .wixstudio .com/secure)"; flow:established,to_server; http.uri; content:"/secure"; startswith; fast_pattern; http.host; content:"publicsuite-trezr.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000950; classtype:social-engineering; sid:6000950; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro .87428g340g3 .lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.87428g340g3.lat"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000951; classtype:social-engineering; sid:6000951; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oxvqq .sparkasse-de .cfd/erneuern .php)"; flow:established,to_server; http.uri; content:"/erneuern.php"; startswith; fast_pattern; http.host; content:"oxvqq.sparkasse-de.cfd"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000952; classtype:social-engineering; sid:6000952; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (894388501642281033 .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"894388501642281033.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000953; classtype:social-engineering; sid:6000953; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie .u1299ti34839 .lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.u1299ti34839.lat"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000954; classtype:social-engineering; sid:6000954; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro .poois7a879a .cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.poois7a879a.cfd"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000955; classtype:social-engineering; sid:6000955; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (videotronmail8 .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"videotronmail8.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000956; classtype:social-engineering; sid:6000956; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bradesco-portalagil .info/chegando .php?token=202372742069fdd18a59f6e1 .34109423&\;h=8d4f4aadcf62cab74ea75aa5fb16e58a20a8d92bff92792c9fd456703ddc9e75)"; flow:established,to_server; http.uri; content:"/chegando.php?token=202372742069fdd18a59f6e1.34109423&|3b|h=8d4f4aadcf62cab74ea75aa5fb16e58a20a8d92bff92792c9fd456703ddc9e75"; startswith; fast_pattern; http.host; content:"bradesco-portalagil.info"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000957; classtype:social-engineering; sid:6000957; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shop-liveledgr .wixstudio .com/usen)"; flow:established,to_server; http.uri; content:"/usen"; startswith; fast_pattern; http.host; content:"shop-liveledgr.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000958; classtype:social-engineering; sid:6000958; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bradesco .sistema-netempresa .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bradesco.sistema-netempresa.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000959; classtype:social-engineering; sid:6000959; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie .pl-00459-oferta .shop/kukirin-g4-hulajnoga-elektrycz/69130)"; flow:established,to_server; http.uri; content:"/kukirin-g4-hulajnoga-elektrycz/69130"; startswith; fast_pattern; http.host; content:"allegrolokalnie.pl-00459-oferta.shop"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000960; classtype:social-engineering; sid:6000960; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (add-en-desktop .wixstudio .com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"add-en-desktop.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000961; classtype:social-engineering; sid:6000961; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bancrecerer-entrar-64fdcf .netlify .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bancrecerer-entrar-64fdcf.netlify.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000962; classtype:social-engineering; sid:6000962; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maxismv .vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"maxismv.vip"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000963; classtype:social-engineering; sid:6000963; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b8376mghi5d .jp .larksuite .com/share/base/form/shrjpMwk5KEz3wmsdPQjPPcLjqh?auth_token=U7CK1RF-b27h3f53-4034-405b-b872-9581bcthi38r-NN5W4)"; flow:established,to_server; http.uri; content:"/share/base/form/shrjpMwk5KEz3wmsdPQjPPcLjqh?auth_token=U7CK1RF-b27h3f53-4034-405b-b872-9581bcthi38r-NN5W4"; startswith; fast_pattern; http.host; content:"b8376mghi5d.jp.larksuite.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000964; classtype:social-engineering; sid:6000964; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (form .jotform .com/251183300717348)"; flow:established,to_server; http.uri; content:"/251183300717348"; startswith; fast_pattern; http.host; content:"form.jotform.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000965; classtype:social-engineering; sid:6000965; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie .pl-oferta68101112 .cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalnie.pl-oferta68101112.cfd"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000966; classtype:social-engineering; sid:6000966; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (websiteitdiscpus .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"websiteitdiscpus.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000967; classtype:social-engineering; sid:6000967; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bradescopjcontato .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bradescopjcontato.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000968; classtype:social-engineering; sid:6000968; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shentelnetsing .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shentelnetsing.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000969; classtype:social-engineering; sid:6000969; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie .pl-039401-oferta .shop/kukirin-g4-hulajnoga-elektrycz/75137)"; flow:established,to_server; http.uri; content:"/kukirin-g4-hulajnoga-elektrycz/75137"; startswith; fast_pattern; http.host; content:"allegrolokalnie.pl-039401-oferta.shop"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000970; classtype:social-engineering; sid:6000970; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atendimentosuportenetempresa .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"atendimentosuportenetempresa.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000971; classtype:social-engineering; sid:6000971; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netempresasenegocios .net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netempresasenegocios.net"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000972; classtype:social-engineering; sid:6000972; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bradesco .netempresas-chatjuridico .digital/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bradesco.netempresas-chatjuridico.digital"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000973; classtype:social-engineering; sid:6000973; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp378794 .sitebeat .crazydomains .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp378794.sitebeat.crazydomains.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000974; classtype:social-engineering; sid:6000974; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (especialistasuporte .digital/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"especialistasuporte.digital"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000975; classtype:social-engineering; sid:6000975; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (watintaram .org/cgi-sys/suspendedpage .cgi)"; flow:established,to_server; http.uri; content:"/cgi-sys/suspendedpage.cgi"; startswith; fast_pattern; http.host; content:"watintaram.org"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000976; classtype:social-engineering; sid:6000976; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bradesco .acessos-netempresas .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bradesco.acessos-netempresas.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000977; classtype:social-engineering; sid:6000977; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (original-employee-493783 .framer .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"original-employee-493783.framer.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000978; classtype:social-engineering; sid:6000978; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fatima .form8899533 .pro/captcha .php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"fatima.form8899533.pro"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000979; classtype:social-engineering; sid:6000979; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .sushiproutah .com/index .php)"; flow:established,to_server; http.uri; content:"/index.php"; startswith; fast_pattern; http.host; content:"www.sushiproutah.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000980; classtype:social-engineering; sid:6000980; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .siraba .ci/news .html)"; flow:established,to_server; http.uri; content:"/news.html"; startswith; fast_pattern; http.host; content:"www.siraba.ci"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000981; classtype:social-engineering; sid:6000981; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pko .eu-mainside .com/pl/)"; flow:established,to_server; http.uri; content:"/pl/"; startswith; fast_pattern; http.host; content:"pko.eu-mainside.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000982; classtype:social-engineering; sid:6000982; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (876725461747823452873841l .blogspot .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"876725461747823452873841l.blogspot.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000983; classtype:social-engineering; sid:6000983; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zany-checkout-044270 .framer .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zany-checkout-044270.framer.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000984; classtype:social-engineering; sid:6000984; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hubert .form8899533 .pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hubert.form8899533.pro"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000985; classtype:social-engineering; sid:6000985; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (elegant-slide-688970 .framer .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"elegant-slide-688970.framer.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000986; classtype:social-engineering; sid:6000986; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trustworthy-teammates-372611 .framer .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trustworthy-teammates-372611.framer.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000987; classtype:social-engineering; sid:6000987; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .info-804431 .pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-804431.pro"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000988; classtype:social-engineering; sid:6000988; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dedouanement-swiss .com/pages/login .php)"; flow:established,to_server; http.uri; content:"/pages/login.php"; startswith; fast_pattern; http.host; content:"dedouanement-swiss.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000989; classtype:social-engineering; sid:6000989; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .steamcamunity .hop .ru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.steamcamunity.hop.ru"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000990; classtype:social-engineering; sid:6000990; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp-clone-peach-nine .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp-clone-peach-nine.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000991; classtype:social-engineering; sid:6000991; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (formnxzdnaid .maycou .my .id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"formnxzdnaid.maycou.my.id"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000992; classtype:social-engineering; sid:6000992; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .easybank-landing-page-gamma .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.easybank-landing-page-gamma.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000993; classtype:social-engineering; sid:6000993; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jsz .nyx .temporary .site/3https .netflix .com .pago .php)"; flow:established,to_server; http.uri; content:"/3https.netflix.com.pago.php"; startswith; fast_pattern; http.host; content:"jsz.nyx.temporary.site"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000994; classtype:social-engineering; sid:6000994; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (logininstagram .blogspot .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"logininstagram.blogspot.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000995; classtype:social-engineering; sid:6000995; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .ig-0306 .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ig-0306.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000996; classtype:social-engineering; sid:6000996; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .amazon-clone-alpha-nine .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazon-clone-alpha-nine.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000997; classtype:social-engineering; sid:6000997; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .amazonclone-nine-psi .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazonclone-nine-psi.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000998; classtype:social-engineering; sid:6000998; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telkomstorageupgrade .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"telkomstorageupgrade.weebly.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000999; classtype:social-engineering; sid:6000999; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .whatsapp-clone-peach-nine .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whatsapp-clone-peach-nine.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001000; classtype:social-engineering; sid:6001000; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bitmartloginx .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bitmartloginx.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001001; classtype:social-engineering; sid:6001001; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kucooienleginnss .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kucooienleginnss.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001002; classtype:social-engineering; sid:6001002; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jiolatest .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jiolatest.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001003; classtype:social-engineering; sid:6001003; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso---bitmart-docs-auth .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sso---bitmart-docs-auth.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001004; classtype:social-engineering; sid:6001004; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (logix-robnhood .square .site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"logix-robnhood.square.site"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001005; classtype:social-engineering; sid:6001005; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hughssherika896572396 .pages .dev/help/contact/549785169333101)"; flow:established,to_server; http.uri; content:"/help/contact/549785169333101"; startswith; fast_pattern; http.host; content:"hughssherika896572396.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001006; classtype:social-engineering; sid:6001006; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alamoumc .com/pas/f36c1fd8922e53a11f61f23bf52401c2/)"; flow:established,to_server; http.uri; content:"/pas/f36c1fd8922e53a11f61f23bf52401c2/"; startswith; fast_pattern; http.host; content:"alamoumc.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001007; classtype:social-engineering; sid:6001007; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps-discreet-priority .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"usps-discreet-priority.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001008; classtype:social-engineering; sid:6001008; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ihahyeon0308 .github .io/HUFS-Instagram)"; flow:established,to_server; http.uri; content:"/HUFS-Instagram"; startswith; fast_pattern; http.host; content:"ihahyeon0308.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001009; classtype:social-engineering; sid:6001009; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f-case-feedback-appeal .github .io/uji/)"; flow:established,to_server; http.uri; content:"/uji/"; startswith; fast_pattern; http.host; content:"f-case-feedback-appeal.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001010; classtype:social-engineering; sid:6001010; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .joyfullmint-drop6 .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.joyfullmint-drop6.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001011; classtype:social-engineering; sid:6001011; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (asignacionesclientes .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"asignacionesclientes.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001012; classtype:social-engineering; sid:6001012; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bahisguven .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bahisguven.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001013; classtype:social-engineering; sid:6001013; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (traitement-envoi-suivi .com/pages/ban .php)"; flow:established,to_server; http.uri; content:"/pages/ban.php"; startswith; fast_pattern; http.host; content:"traitement-envoi-suivi.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001014; classtype:social-engineering; sid:6001014; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (contro03l .agency-partner-operations .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"contro03l.agency-partner-operations.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001015; classtype:social-engineering; sid:6001015; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member035 .agency-partner-request .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member035.agency-partner-request.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001016; classtype:social-engineering; sid:6001016; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hughssherika896572396 .pages .dev/help/contact/895302273207517)"; flow:established,to_server; http.uri; content:"/help/contact/895302273207517"; startswith; fast_pattern; http.host; content:"hughssherika896572396.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001017; classtype:social-engineering; sid:6001017; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr .galabetgunceladresim .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.galabetgunceladresim.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001018; classtype:social-engineering; sid:6001018; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shubhamyadav8081 .github .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shubhamyadav8081.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001019; classtype:social-engineering; sid:6001019; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hughssherika896572396 .pages .dev/help/contact/652177398591792)"; flow:established,to_server; http.uri; content:"/help/contact/652177398591792"; startswith; fast_pattern; http.host; content:"hughssherika896572396.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001020; classtype:social-engineering; sid:6001020; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .netflix-clone-sepia-six .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-sepia-six.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001021; classtype:social-engineering; sid:6001021; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .netflix-clone-signup-page .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-signup-page.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001022; classtype:social-engineering; sid:6001022; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (geamnnilogiinnn .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"geamnnilogiinnn.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001023; classtype:social-engineering; sid:6001023; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kurekeans_usa_loagginis .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kurekeans_usa_loagginis.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001024; classtype:social-engineering; sid:6001024; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (akash-muddhana .github .io/Amazon-clone)"; flow:established,to_server; http.uri; content:"/Amazon-clone"; startswith; fast_pattern; http.host; content:"akash-muddhana.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001025; classtype:social-engineering; sid:6001025; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (perkridge .co .za/dr/po/config/@all .html)"; flow:established,to_server; http.uri; content:"/dr/po/config/@all.html"; startswith; fast_pattern; http.host; content:"perkridge.co.za"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001026; classtype:social-engineering; sid:6001026; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bcplay8 .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bcplay8.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001027; classtype:social-engineering; sid:6001027; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .uppholdlogex-wlu8 .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.uppholdlogex-wlu8.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001028; classtype:social-engineering; sid:6001028; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .amazon-clone-pink-five .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazon-clone-pink-five.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001029; classtype:social-engineering; sid:6001029; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cloneofair .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cloneofair.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001030; classtype:social-engineering; sid:6001030; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .amazonbylio .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazonbylio.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001031; classtype:social-engineering; sid:6001031; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eu .jotform .com/app/251738103149354)"; flow:established,to_server; http.uri; content:"/app/251738103149354"; startswith; fast_pattern; http.host; content:"eu.jotform.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001032; classtype:social-engineering; sid:6001032; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (easybank-landing-page-gamma .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"easybank-landing-page-gamma.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001033; classtype:social-engineering; sid:6001033; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .facebook-clone-snowy .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-clone-snowy.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001034; classtype:social-engineering; sid:6001034; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (neuerzumregeln .click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"neuerzumregeln.click"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001035; classtype:social-engineering; sid:6001035; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-mask-template .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-mask-template.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001036; classtype:social-engineering; sid:6001036; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr .padisahbetler .vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.padisahbetler.vip"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001037; classtype:social-engineering; sid:6001037; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hilarious-gecko-5f2262 .netlify .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hilarious-gecko-5f2262.netlify.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001038; classtype:social-engineering; sid:6001038; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-khaki-seven .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-khaki-seven.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001039; classtype:social-engineering; sid:6001039; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ajaysharma46 .github .io/Netflix-Clone)"; flow:established,to_server; http.uri; content:"/Netflix-Clone"; startswith; fast_pattern; http.host; content:"ajaysharma46.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001040; classtype:social-engineering; sid:6001040; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loggiinbitmartt .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"loggiinbitmartt.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001041; classtype:social-engineering; sid:6001041; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (advertising-meta .accounts-admin-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"advertising-meta.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001042; classtype:social-engineering; sid:6001042; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (encoded .rimedinaturali .wiki/service/)"; flow:established,to_server; http.uri; content:"/service/"; startswith; fast_pattern; http.host; content:"encoded.rimedinaturali.wiki"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001043; classtype:social-engineering; sid:6001043; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .lnk .ink/cvfdw/)"; flow:established,to_server; http.uri; content:"/cvfdw/"; startswith; fast_pattern; http.host; content:"www.lnk.ink"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001044; classtype:social-engineering; sid:6001044; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (seduce-fjhtcxulyk .edgeone .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"seduce-fjhtcxulyk.edgeone.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001045; classtype:social-engineering; sid:6001045; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazonbydhruv .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazonbydhruv.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001046; classtype:social-engineering; sid:6001046; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (capitalone-11r .pages .dev/faq)"; flow:established,to_server; http.uri; content:"/faq"; startswith; fast_pattern; http.host; content:"capitalone-11r.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001047; classtype:social-engineering; sid:6001047; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stormfather0 .github .io/Amazon-Project/product .html?category=clothing)"; flow:established,to_server; http.uri; content:"/Amazon-Project/product.html?category=clothing"; startswith; fast_pattern; http.host; content:"stormfather0.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001048; classtype:social-engineering; sid:6001048; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cnsqarrlogin .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cnsqarrlogin.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001049; classtype:social-engineering; sid:6001049; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hotel-stay2511 .com/1007328234/)"; flow:established,to_server; http.uri; content:"/1007328234/"; startswith; fast_pattern; http.host; content:"hotel-stay2511.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001050; classtype:social-engineering; sid:6001050; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atendimento-flow-sp-free .my .id/via2/)"; flow:established,to_server; http.uri; content:"/via2/"; startswith; fast_pattern; http.host; content:"atendimento-flow-sp-free.my.id"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001051; classtype:social-engineering; sid:6001051; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coinsqqareloggin .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coinsqqareloggin.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001052; classtype:social-engineering; sid:6001052; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .spotify-login .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.spotify-login.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001053; classtype:social-engineering; sid:6001053; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (contabilidadedellaretti .com .br/wp-content/upgrade-temp-backup/it/persone-e-famiglie/content/internetbanking/common/extra-content-login/login-page .html)"; flow:established,to_server; http.uri; content:"/wp-content/upgrade-temp-backup/it/persone-e-famiglie/content/internetbanking/common/extra-content-login/login-page.html"; startswith; fast_pattern; http.host; content:"contabilidadedellaretti.com.br"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001054; classtype:social-engineering; sid:6001054; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .shopee7668 .blogspot .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopee7668.blogspot.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001055; classtype:social-engineering; sid:6001055; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hcnhrqkgu74bxhlo7xvch3arblulplw7g72kkdj3ddp6vkqr4rsq .ar .randao .net/OJp4wUan-Budbv3qI-wRCui3rt839KUNOxjf6qoR5GU)"; flow:established,to_server; http.uri; content:"/OJp4wUan-Budbv3qI-wRCui3rt839KUNOxjf6qoR5GU"; startswith; fast_pattern; http.host; content:"hcnhrqkgu74bxhlo7xvch3arblulplw7g72kkdj3ddp6vkqr4rsq.ar.randao.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001056; classtype:social-engineering; sid:6001056; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uppholdlogex-wlu8 .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uppholdlogex-wlu8.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001057; classtype:social-engineering; sid:6001057; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clone-vert-nu .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"clone-vert-nu.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001058; classtype:social-engineering; sid:6001058; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enabled-meta .accounts-admin-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"enabled-meta.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001059; classtype:social-engineering; sid:6001059; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-homepage-clone-beta .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-homepage-clone-beta.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001060; classtype:social-engineering; sid:6001060; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netiflix .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netiflix.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001061; classtype:social-engineering; sid:6001061; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (licensingterms .azurewebsites .net/licensing/terms/productoffering/WindowsServerStandardDatace)"; flow:established,to_server; http.uri; content:"/licensing/terms/productoffering/WindowsServerStandardDatace"; startswith; fast_pattern; http.host; content:"licensingterms.azurewebsites.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001062; classtype:social-engineering; sid:6001062; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jamescheng-gemini .zeabur .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jamescheng-gemini.zeabur.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001063; classtype:social-engineering; sid:6001063; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-gamma-seven .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-gamma-seven.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001064; classtype:social-engineering; sid:6001064; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .asignacionesclientes .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.asignacionesclientes.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001065; classtype:social-engineering; sid:6001065; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hughssherika896572396 .pages .dev/help/contact/527159917877168)"; flow:established,to_server; http.uri; content:"/help/contact/527159917877168"; startswith; fast_pattern; http.host; content:"hughssherika896572396.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001066; classtype:social-engineering; sid:6001066; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booking-clone-sigma .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"booking-clone-sigma.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001067; classtype:social-engineering; sid:6001067; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (demo .printincbelize .com/wp-content/uploads/wcdp-uploads/xr/)"; flow:established,to_server; http.uri; content:"/wp-content/uploads/wcdp-uploads/xr/"; startswith; fast_pattern; http.host; content:"demo.printincbelize.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001068; classtype:social-engineering; sid:6001068; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (panel .standard .us-east-1 .oortstorages .com/fitsal .sg?eta=)"; flow:established,to_server; http.uri; content:"/fitsal.sg?eta="; startswith; fast_pattern; http.host; content:"panel.standard.us-east-1.oortstorages.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001069; classtype:social-engineering; sid:6001069; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .mybluecheck-verify-page .sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mybluecheck-verify-page.sbs"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001070; classtype:social-engineering; sid:6001070; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member304 .center-meta-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member304.center-meta-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001071; classtype:social-engineering; sid:6001071; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gaurkhede-ronak .github .io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"gaurkhede-ronak.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001072; classtype:social-engineering; sid:6001072; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e7-ledger-livelogin-battery-support .vercel .app/ledger%20form/verify .html)"; flow:established,to_server; http.uri; content:"/ledger%20form/verify.html"; startswith; fast_pattern; http.host; content:"e7-ledger-livelogin-battery-support.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001073; classtype:social-engineering; sid:6001073; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spotifysm .netlify .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spotifysm.netlify.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001074; classtype:social-engineering; sid:6001074; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (16ue-casefb751962 .vercel .app/managermentloc/Landingpage/landingpage .html)"; flow:established,to_server; http.uri; content:"/managermentloc/Landingpage/landingpage.html"; startswith; fast_pattern; http.host; content:"16ue-casefb751962.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001075; classtype:social-engineering; sid:6001075; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member005 .business-ad-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member005.business-ad-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001076; classtype:social-engineering; sid:6001076; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rahul-rb-frontend .github .io/demo1)"; flow:established,to_server; http.uri; content:"/demo1"; startswith; fast_pattern; http.host; content:"rahul-rb-frontend.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001077; classtype:social-engineering; sid:6001077; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .ecommerce-clone-ashy .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ecommerce-clone-ashy.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001078; classtype:social-engineering; sid:6001078; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (statuesque-marigold-226b7c .netlify .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"statuesque-marigold-226b7c.netlify.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001079; classtype:social-engineering; sid:6001079; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nneelabh02 .github .io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"nneelabh02.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001080; classtype:social-engineering; sid:6001080; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-clone-lime .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-clone-lime.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001081; classtype:social-engineering; sid:6001081; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (v23m .xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"v23m.xyz"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001082; classtype:social-engineering; sid:6001082; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (carli .028426 .com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"carli.028426.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001083; classtype:social-engineering; sid:6001083; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smtp .natrajstonex .co .in/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"smtp.natrajstonex.co.in"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001084; classtype:social-engineering; sid:6001084; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galabet .sorunsuz-giris .vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galabet.sorunsuz-giris.vip"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001085; classtype:social-engineering; sid:6001085; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smartresolution .pages .dev/pages/pages/select-wallet .html/)"; flow:established,to_server; http.uri; content:"/pages/pages/select-wallet.html/"; startswith; fast_pattern; http.host; content:"smartresolution.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001086; classtype:social-engineering; sid:6001086; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .janesantos .com .br/jb/css/index/app/index .html?&userid=937d9f67d2bf35e38b4e41bf412dbe50&ue=8ce9a235729de086297f1a48eedf142d)"; flow:established,to_server; http.uri; content:"/jb/css/index/app/index.html?&userid=937d9f67d2bf35e38b4e41bf412dbe50&ue=8ce9a235729de086297f1a48eedf142d"; startswith; fast_pattern; http.host; content:"www.janesantos.com.br"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001087; classtype:social-engineering; sid:6001087; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .amazon-clone-nine .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazon-clone-nine.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001088; classtype:social-engineering; sid:6001088; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .joyfullmint-drop2 .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.joyfullmint-drop2.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001089; classtype:social-engineering; sid:6001089; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .syriatel .gamefy .io .proxy .openvpn-ssh .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.syriatel.gamefy.io.proxy.openvpn-ssh.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001090; classtype:social-engineering; sid:6001090; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp-clone-delta-two .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp-clone-delta-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001091; classtype:social-engineering; sid:6001091; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .whatsapp-clone-delta-two .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whatsapp-clone-delta-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001092; classtype:social-engineering; sid:6001092; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .logincoinbasewallet .blogspot .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.logincoinbasewallet.blogspot.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001093; classtype:social-engineering; sid:6001093; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .easy-bank-mu .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.easy-bank-mu.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001094; classtype:social-engineering; sid:6001094; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .uphoeld-loguin .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.uphoeld-loguin.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001095; classtype:social-engineering; sid:6001095; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .netflix-clone-psi-two .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-psi-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001096; classtype:social-engineering; sid:6001096; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (banking .dkb .romandrewes .de/online/login .php)"; flow:established,to_server; http.uri; content:"/online/login.php"; startswith; fast_pattern; http.host; content:"banking.dkb.romandrewes.de"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001097; classtype:social-engineering; sid:6001097; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meittamax_logg_xnn .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meittamax_logg_xnn.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001098; classtype:social-engineering; sid:6001098; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .amazonbydhruv .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazonbydhruv.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001099; classtype:social-engineering; sid:6001099; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (licensingterms .azurewebsites .net/licensing/terms/product/Notices/EAEAS)"; flow:established,to_server; http.uri; content:"/licensing/terms/product/Notices/EAEAS"; startswith; fast_pattern; http.host; content:"licensingterms.azurewebsites.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001100; classtype:social-engineering; sid:6001100; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .metamask-wallet .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.metamask-wallet.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001101; classtype:social-engineering; sid:6001101; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .facebook-signup-page-1zav .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-signup-page-1zav.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001102; classtype:social-engineering; sid:6001102; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-nine .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-nine.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001103; classtype:social-engineering; sid:6001103; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dins .iphoneid .shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dins.iphoneid.shop"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001104; classtype:social-engineering; sid:6001104; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ankitdoi-coder .github .io/Netflix-Clone)"; flow:established,to_server; http.uri; content:"/Netflix-Clone"; startswith; fast_pattern; http.host; content:"ankitdoi-coder.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001105; classtype:social-engineering; sid:6001105; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bittbartihlogin .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bittbartihlogin.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001106; classtype:social-engineering; sid:6001106; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spotify-theta-navy .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spotify-theta-navy.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001107; classtype:social-engineering; sid:6001107; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .spotify-clone-silk-rho .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.spotify-clone-silk-rho.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001108; classtype:social-engineering; sid:6001108; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr .galabetgir17 .vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.galabetgir17.vip"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001109; classtype:social-engineering; sid:6001109; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .kosmicbeginnings .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kosmicbeginnings.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001110; classtype:social-engineering; sid:6001110; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dogstagram-c8myob4rn-jerrykapa .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dogstagram-c8myob4rn-jerrykapa.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001111; classtype:social-engineering; sid:6001111; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mohith6929 .github .io/NETFLIX-clone/)"; flow:established,to_server; http.uri; content:"/NETFLIX-clone/"; startswith; fast_pattern; http.host; content:"mohith6929.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001112; classtype:social-engineering; sid:6001112; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .amazon-clone-taupe-six .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazon-clone-taupe-six.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001113; classtype:social-engineering; sid:6001113; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (licensingterms .azurewebsites .net/licensing/terms/product/Promotions/)"; flow:established,to_server; http.uri; content:"/licensing/terms/product/Promotions/"; startswith; fast_pattern; http.host; content:"licensingterms.azurewebsites.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001114; classtype:social-engineering; sid:6001114; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .netflix-clone-taupe-ten .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-taupe-ten.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001115; classtype:social-engineering; sid:6001115; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-taupe-six .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-taupe-six.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001116; classtype:social-engineering; sid:6001116; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .verifyledgeronline .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.verifyledgeronline.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001117; classtype:social-engineering; sid:6001117; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-test .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-test.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001118; classtype:social-engineering; sid:6001118; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uphoeld-loguin .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uphoeld-loguin.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001119; classtype:social-engineering; sid:6001119; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metfmasktensnwlg .gitbook .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metfmasktensnwlg.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001120; classtype:social-engineering; sid:6001120; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-gui-clone .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-gui-clone.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001121; classtype:social-engineering; sid:6001121; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wallethh--atomicc .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wallethh--atomicc.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001122; classtype:social-engineering; sid:6001122; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .tapfumamanhanga .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.tapfumamanhanga.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001123; classtype:social-engineering; sid:6001123; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mc-whatsapp .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mc-whatsapp.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001124; classtype:social-engineering; sid:6001124; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .joyfullmint-drop4 .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.joyfullmint-drop4.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001125; classtype:social-engineering; sid:6001125; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ndaxlogen .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ndaxlogen.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001126; classtype:social-engineering; sid:6001126; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .clone-vert-nu .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.clone-vert-nu.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001127; classtype:social-engineering; sid:6001127; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafybeigbqwmxazxynaputje3qz5bp5im3grqzyqdzb3r3xb5uuzysijlt4 .ipfs .infura-ipfs .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafybeigbqwmxazxynaputje3qz5bp5im3grqzyqdzb3r3xb5uuzysijlt4.ipfs.infura-ipfs.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001128; classtype:social-engineering; sid:6001128; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (airbnb-clone-xi-nine .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"airbnb-clone-xi-nine.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001129; classtype:social-engineering; sid:6001129; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazonbylio .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazonbylio.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001130; classtype:social-engineering; sid:6001130; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .klamotte-vivaldihaus .de/jox)"; flow:established,to_server; http.uri; content:"/jox"; startswith; fast_pattern; http.host; content:"www.klamotte-vivaldihaus.de"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001131; classtype:social-engineering; sid:6001131; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .sanisidrova .com .ar/Netflix .com .mx/index .html)"; flow:established,to_server; http.uri; content:"/Netflix.com.mx/index.html"; startswith; fast_pattern; http.host; content:"www.sanisidrova.com.ar"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001132; classtype:social-engineering; sid:6001132; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (redirect-256b1065 .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"redirect-256b1065.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001133; classtype:social-engineering; sid:6001133; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .service-cloudflare .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.service-cloudflare.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001134; classtype:social-engineering; sid:6001134; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .amazon-clone-three-sandy .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazon-clone-three-sandy.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001135; classtype:social-engineering; sid:6001135; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (url2745 .absoluterail .com/ls/click?upn=u001 .tG9QZ1bWjBCAROH6pq8MGeRVeSaoEq61Qzb2DXBnlX0dkFFV0-2BvO17gnRy7UU-2FgezAaI_nhF4ZmJ5D9fHGdVqiWtP3e1W6ysHem-2BGYv73n4NKR7gLw1vlnszZtMvpO-2Boawb1jrXf6-2FfYWRMPzZ5Ay8cI5jR-2BVd4IeW1rDc03aDph6LcrbIr5HL-2FdMTXplBiZB9KpBeiLVjaJpmSJf4AOj7hyQ26Dokhqv1pKDk4cI54W0T-2F4Xqjr1C-2B0UDGTAp2uZHwJsQrf-2FIo6G6IwyugN8XcP2CA-3D-3D)"; flow:established,to_server; http.uri; content:"/ls/click?upn=u001.tG9QZ1bWjBCAROH6pq8MGeRVeSaoEq61Qzb2DXBnlX0dkFFV0-2BvO17gnRy7UU-2FgezAaI_nhF4ZmJ5D9fHGdVqiWtP3e1W6ysHem-2BGYv73n4NKR7gLw1vlnszZtMvpO-2Boawb1jrXf6-2FfYWRMPzZ5Ay8cI5jR-2BVd4IeW1rDc03aDph6LcrbIr5HL-2FdMTXplBiZB9KpBeiLVjaJpmSJf4AOj7hyQ26Dokhqv1pKDk4cI54W0T-2F4Xqjr1C-2B0UDGTAp2uZHwJsQrf-2FIo6G6IwyugN8XcP2CA-3D-3D"; startswith; fast_pattern; http.host; content:"url2745.absoluterail.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001136; classtype:social-engineering; sid:6001136; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roboux2025 .netlify .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"roboux2025.netlify.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001137; classtype:social-engineering; sid:6001137; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .instagram-clone-kappa-one .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-clone-kappa-one.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001138; classtype:social-engineering; sid:6001138; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .amazon-homepage-clone-beta .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazon-homepage-clone-beta.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001139; classtype:social-engineering; sid:6001139; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .instagram-test .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-test.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001140; classtype:social-engineering; sid:6001140; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toryo .co .zw/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"toryo.co.zw"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001141; classtype:social-engineering; sid:6001141; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .easybank-landing-pi .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.easybank-landing-pi.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001142; classtype:social-engineering; sid:6001142; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anon3mpx .github .io/pancake-swap-interface-v1)"; flow:established,to_server; http.uri; content:"/pancake-swap-interface-v1"; startswith; fast_pattern; http.host; content:"anon3mpx.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001143; classtype:social-engineering; sid:6001143; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (marketing-meta .accounts-admin-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"marketing-meta.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001144; classtype:social-engineering; sid:6001144; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (samiksha-pattir .github .io/Amazon_Home_Page_ng_assig/)"; flow:established,to_server; http.uri; content:"/Amazon_Home_Page_ng_assig/"; startswith; fast_pattern; http.host; content:"samiksha-pattir.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001145; classtype:social-engineering; sid:6001145; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-jet-eight-44 .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-jet-eight-44.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001146; classtype:social-engineering; sid:6001146; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-three-sandy .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-three-sandy.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001147; classtype:social-engineering; sid:6001147; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loggmaskmetha-uk34 .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"loggmaskmetha-uk34.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001148; classtype:social-engineering; sid:6001148; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dedouanement-swiss .com/pages/ban .php)"; flow:established,to_server; http.uri; content:"/pages/ban.php"; startswith; fast_pattern; http.host; content:"dedouanement-swiss.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001149; classtype:social-engineering; sid:6001149; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-signup-page-1zav .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-signup-page-1zav.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001150; classtype:social-engineering; sid:6001150; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamossk_login .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metamossk_login.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001151; classtype:social-engineering; sid:6001151; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr .galabetgir16 .vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.galabetgir16.vip"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001152; classtype:social-engineering; sid:6001152; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .netflix-clone-khaki-seven .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-khaki-seven.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001153; classtype:social-engineering; sid:6001153; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (av1 .6f8 .mytemp .website/wp-includes/images/zm/)"; flow:established,to_server; http.uri; content:"/wp-includes/images/zm/"; startswith; fast_pattern; http.host; content:"av1.6f8.mytemp.website"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001154; classtype:social-engineering; sid:6001154; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my--bitmart-oauth-azure .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"my--bitmart-oauth-azure.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001155; classtype:social-engineering; sid:6001155; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .geminni-uxsalogies .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.geminni-uxsalogies.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001156; classtype:social-engineering; sid:6001156; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mtta_meesklog_01 .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mtta_meesklog_01.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001157; classtype:social-engineering; sid:6001157; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gedmni .zeabur .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gedmni.zeabur.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001158; classtype:social-engineering; sid:6001158; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (skcrazy .github .io/Instagrame)"; flow:established,to_server; http.uri; content:"/Instagrame"; startswith; fast_pattern; http.host; content:"skcrazy.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001159; classtype:social-engineering; sid:6001159; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (user-gateway .credit-agency-meta .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"user-gateway.credit-agency-meta.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001160; classtype:social-engineering; sid:6001160; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .netflix-clone-jose-pimentas-projects .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-jose-pimentas-projects.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001161; classtype:social-engineering; sid:6001161; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bet6662 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bet6662.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001162; classtype:social-engineering; sid:6001162; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rembourse0055 .github .io/remboursementservice-online .github .io/OnlineFr)"; flow:established,to_server; http.uri; content:"/remboursementservice-online.github.io/OnlineFr"; startswith; fast_pattern; http.host; content:"rembourse0055.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001163; classtype:social-engineering; sid:6001163; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-blue-ten .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-blue-ten.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001164; classtype:social-engineering; sid:6001164; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .airbnb-clone-xi-nine .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.airbnb-clone-xi-nine.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001165; classtype:social-engineering; sid:6001165; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (project-beta-topaz-83 .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"project-beta-topaz-83.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001166; classtype:social-engineering; sid:6001166; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (licensingterms .azurewebsites .net/licensing/terms/productoffering/MicrosoftDynamics365Service)"; flow:established,to_server; http.uri; content:"/licensing/terms/productoffering/MicrosoftDynamics365Service"; startswith; fast_pattern; http.host; content:"licensingterms.azurewebsites.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001167; classtype:social-engineering; sid:6001167; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cinoa .com .ar/vps/am/infospage .php)"; flow:established,to_server; http.uri; content:"/vps/am/infospage.php"; startswith; fast_pattern; http.host; content:"cinoa.com.ar"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001168; classtype:social-engineering; sid:6001168; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamask-wallet .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metamask-wallet.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001169; classtype:social-engineering; sid:6001169; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .apple-responsive-frontend .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.apple-responsive-frontend.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001170; classtype:social-engineering; sid:6001170; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .amazon-clone-project-alpha .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazon-clone-project-alpha.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001171; classtype:social-engineering; sid:6001171; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-clone-omega-six .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-clone-omega-six.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001172; classtype:social-engineering; sid:6001172; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (logi-ndax-usa .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"logi-ndax-usa.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001173; classtype:social-engineering; sid:6001173; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-clone-sabitalizade .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-clone-sabitalizade.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001174; classtype:social-engineering; sid:6001174; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .ecount-update .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ecount-update.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001175; classtype:social-engineering; sid:6001175; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cinoa .com .ar/vps/am/3dsece .php)"; flow:established,to_server; http.uri; content:"/vps/am/3dsece.php"; startswith; fast_pattern; http.host; content:"cinoa.com.ar"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001176; classtype:social-engineering; sid:6001176; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mynetflixui .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mynetflixui.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001177; classtype:social-engineering; sid:6001177; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .intsagrann .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.intsagrann.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001178; classtype:social-engineering; sid:6001178; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (survey .refassured .co/KyA1QdbK)"; flow:established,to_server; http.uri; content:"/KyA1QdbK"; startswith; fast_pattern; http.host; content:"survey.refassured.co"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001179; classtype:social-engineering; sid:6001179; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (g89n .xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"g89n.xyz"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001180; classtype:social-engineering; sid:6001180; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (active-meta .accounts-admin-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"active-meta.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001181; classtype:social-engineering; sid:6001181; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (profile-meta .program-ads-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"profile-meta.program-ads-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001182; classtype:social-engineering; sid:6001182; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (greatbellbiz .netlify .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"greatbellbiz.netlify.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001183; classtype:social-engineering; sid:6001183; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .joyfullmint-drop5 .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.joyfullmint-drop5.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001184; classtype:social-engineering; sid:6001184; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeetbk062 .blogspot .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopeetbk062.blogspot.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001185; classtype:social-engineering; sid:6001185; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mailsrv .itupdates .support/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"mailsrv.itupdates.support"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001186; classtype:social-engineering; sid:6001186; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cnbasprologiusaa .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cnbasprologiusaa.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001187; classtype:social-engineering; sid:6001187; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (survey .refassured .com/KyA1QdbK)"; flow:established,to_server; http.uri; content:"/KyA1QdbK"; startswith; fast_pattern; http.host; content:"survey.refassured.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001188; classtype:social-engineering; sid:6001188; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clickinhere2026 .iceiy .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"clickinhere2026.iceiy.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001189; classtype:social-engineering; sid:6001189; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (harshitbhardwaj0101 .github .io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"harshitbhardwaj0101.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001190; classtype:social-engineering; sid:6001190; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .amazon-clone-ten-rust .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazon-clone-ten-rust.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001191; classtype:social-engineering; sid:6001191; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr .madridbetin-resmiadresi .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.madridbetin-resmiadresi.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001192; classtype:social-engineering; sid:6001192; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nk9956 .craftum .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nk9956.craftum.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001193; classtype:social-engineering; sid:6001193; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mettamaske_loggees .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mettamaske_loggees.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001194; classtype:social-engineering; sid:6001194; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gemini .141010 .xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gemini.141010.xyz"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001195; classtype:social-engineering; sid:6001195; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .netflix-clone-beta-sand .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-beta-sand.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001196; classtype:social-engineering; sid:6001196; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .cloneofair .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cloneofair.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001197; classtype:social-engineering; sid:6001197; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (huabei .zeabur .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"huabei.zeabur.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001198; classtype:social-engineering; sid:6001198; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (joyfullmint-drop4 .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"joyfullmint-drop4.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001199; classtype:social-engineering; sid:6001199; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9855554778890 .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9855554778890.weebly.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001200; classtype:social-engineering; sid:6001200; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cn .lumxza .com/home/register?code=40569)"; flow:established,to_server; http.uri; content:"/home/register?code=40569"; startswith; fast_pattern; http.host; content:"cn.lumxza.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001201; classtype:social-engineering; sid:6001201; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icount-notice .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"icount-notice.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001202; classtype:social-engineering; sid:6001202; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bahismerkez .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bahismerkez.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001203; classtype:social-engineering; sid:6001203; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .chilhoodgames .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.chilhoodgames.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001204; classtype:social-engineering; sid:6001204; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s3 .us-east-1 .amazonaws .com/daexterminating .com/index .html)"; flow:established,to_server; http.uri; content:"/daexterminating.com/index.html"; startswith; fast_pattern; http.host; content:"s3.us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001205; classtype:social-engineering; sid:6001205; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecommerce-clone-ashy .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ecommerce-clone-ashy.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001206; classtype:social-engineering; sid:6001206; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .info-trezrwallet .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-trezrwallet.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001207; classtype:social-engineering; sid:6001207; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .airbnbclone-haris .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.airbnbclone-haris.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001208; classtype:social-engineering; sid:6001208; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pc1380 .ecardalert .com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"pc1380.ecardalert.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001209; classtype:social-engineering; sid:6001209; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mask-sign-inmeta2 .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mask-sign-inmeta2.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001210; classtype:social-engineering; sid:6001210; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (authorized-meta .accounts-admin-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"authorized-meta.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001211; classtype:social-engineering; sid:6001211; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atomicc--wallets--ssn .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"atomicc--wallets--ssn.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001212; classtype:social-engineering; sid:6001212; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (licensingterms .azurewebsites .net/licensing/terms/product/StorageArrayandAzureDataBoxTerms/Al)"; flow:established,to_server; http.uri; content:"/licensing/terms/product/StorageArrayandAzureDataBoxTerms/Al"; startswith; fast_pattern; http.host; content:"licensingterms.azurewebsites.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001213; classtype:social-engineering; sid:6001213; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .amazon-clone-blue-ten .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazon-clone-blue-ten.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001214; classtype:social-engineering; sid:6001214; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (contabilidadedellaretti .com .br/wp-content/upgrade-temp-backup/it/persone-e-famiglie/content/internetbanking/common/extra-content-login/)"; flow:established,to_server; http.uri; content:"/wp-content/upgrade-temp-backup/it/persone-e-famiglie/content/internetbanking/common/extra-content-login/"; startswith; fast_pattern; http.host; content:"contabilidadedellaretti.com.br"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001215; classtype:social-engineering; sid:6001215; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr .galabetgir15 .vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.galabetgir15.vip"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001216; classtype:social-engineering; sid:6001216; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (joyfullmint-drop5 .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"joyfullmint-drop5.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001217; classtype:social-engineering; sid:6001217; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .amazon-clone-jet-eight-44 .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazon-clone-jet-eight-44.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001218; classtype:social-engineering; sid:6001218; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (licensingterms .azurewebsites .net/licensing/terms/product/ProfessionalServices/)"; flow:established,to_server; http.uri; content:"/licensing/terms/product/ProfessionalServices/"; startswith; fast_pattern; http.host; content:"licensingterms.azurewebsites.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001219; classtype:social-engineering; sid:6001219; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loftuscheeck .dothome .co .kr/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"loftuscheeck.dothome.co.kr"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001220; classtype:social-engineering; sid:6001220; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mariana-noreply-sp1100879 .pages .dev/help/contact/7337)"; flow:established,to_server; http.uri; content:"/help/contact/7337"; startswith; fast_pattern; http.host; content:"mariana-noreply-sp1100879.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001221; classtype:social-engineering; sid:6001221; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamsk_loogii .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metamsk_loogii.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001222; classtype:social-engineering; sid:6001222; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dev-ecube .github .io/Netflic-Clone)"; flow:established,to_server; http.uri; content:"/Netflic-Clone"; startswith; fast_pattern; http.host; content:"dev-ecube.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001223; classtype:social-engineering; sid:6001223; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .watsicon .kz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.watsicon.kz"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001224; classtype:social-engineering; sid:6001224; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imtkz0 .ethereumlimited .top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"imtkz0.ethereumlimited.top"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001225; classtype:social-engineering; sid:6001225; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mytelshsryh .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mytelshsryh.weebly.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001226; classtype:social-engineering; sid:6001226; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (16ue-casefb751962 .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"16ue-casefb751962.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001227; classtype:social-engineering; sid:6001227; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yalem-amazon-project .netlify .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yalem-amazon-project.netlify.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001228; classtype:social-engineering; sid:6001228; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .luohesmw .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.luohesmw.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001229; classtype:social-engineering; sid:6001229; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (laboboinsta .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"laboboinsta.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001230; classtype:social-engineering; sid:6001230; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gemuilgeefn .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gemuilgeefn.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001231; classtype:social-engineering; sid:6001231; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazonclone-nine-psi .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazonclone-nine-psi.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001232; classtype:social-engineering; sid:6001232; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cybernations .tech-institute .org/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"cybernations.tech-institute.org"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001233; classtype:social-engineering; sid:6001233; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-sepia-six .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-sepia-six.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001234; classtype:social-engineering; sid:6001234; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-ten-rust .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-ten-rust.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001235; classtype:social-engineering; sid:6001235; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (geminui_login .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"geminui_login.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001236; classtype:social-engineering; sid:6001236; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .music-application-flax .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.music-application-flax.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001237; classtype:social-engineering; sid:6001237; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (summitalarm .com/cgi-bin/)"; flow:established,to_server; http.uri; content:"/cgi-bin/"; startswith; fast_pattern; http.host; content:"summitalarm.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001238; classtype:social-engineering; sid:6001238; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mercadolibre-promocao .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mercadolibre-promocao.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001239; classtype:social-engineering; sid:6001239; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member031 .agency-partner-request .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member031.agency-partner-request.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001240; classtype:social-engineering; sid:6001240; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (supersafed .standard .us-east-1 .oortstorages .com/fitsal .cvz?eta=)"; flow:established,to_server; http.uri; content:"/fitsal.cvz?eta="; startswith; fast_pattern; http.host; content:"supersafed.standard.us-east-1.oortstorages.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001241; classtype:social-engineering; sid:6001241; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (geminikey .zeabur .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"geminikey.zeabur.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001242; classtype:social-engineering; sid:6001242; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (insuranceycontrol .it .com/981385/)"; flow:established,to_server; http.uri; content:"/981385/"; startswith; fast_pattern; http.host; content:"insuranceycontrol.it.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001243; classtype:social-engineering; sid:6001243; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enell .infiniteboard .win/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"enell.infiniteboard.win"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001244; classtype:social-engineering; sid:6001244; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (traitement-envoi-suivi .com/pages/carte .php)"; flow:established,to_server; http.uri; content:"/pages/carte.php"; startswith; fast_pattern; http.host; content:"traitement-envoi-suivi.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001245; classtype:social-engineering; sid:6001245; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (soft-leaf-8a43 .azariakarlaphsslr0636 .workers .dev/help-facebook-appeal/)"; flow:established,to_server; http.uri; content:"/help-facebook-appeal/"; startswith; fast_pattern; http.host; content:"soft-leaf-8a43.azariakarlaphsslr0636.workers.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001246; classtype:social-engineering; sid:6001246; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ruki77 .github .io/Amazon-clone-/)"; flow:established,to_server; http.uri; content:"/Amazon-clone-/"; startswith; fast_pattern; http.host; content:"ruki77.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001247; classtype:social-engineering; sid:6001247; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (attvt1 .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"attvt1.weebly.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001248; classtype:social-engineering; sid:6001248; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (strat--leidgre--com .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"strat--leidgre--com.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001249; classtype:social-engineering; sid:6001249; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (treezorwalletrhwr .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"treezorwalletrhwr.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001250; classtype:social-engineering; sid:6001250; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-psi-two .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-psi-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001251; classtype:social-engineering; sid:6001251; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cinoa .com .ar/vps/am/3dsec .php)"; flow:established,to_server; http.uri; content:"/vps/am/3dsec.php"; startswith; fast_pattern; http.host; content:"cinoa.com.ar"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001252; classtype:social-engineering; sid:6001252; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (juno-com-webmail-012368 .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"juno-com-webmail-012368.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001253; classtype:social-engineering; sid:6001253; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m .padisahbet-bonusadresi .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.padisahbet-bonusadresi.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001254; classtype:social-engineering; sid:6001254; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spontaneous-faloodeh-8e2a38 .netlify .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spontaneous-faloodeh-8e2a38.netlify.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001255; classtype:social-engineering; sid:6001255; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .instagram-clone-lime .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-clone-lime.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001256; classtype:social-engineering; sid:6001256; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (its-rkyadav .github .io/netflix_clone/)"; flow:established,to_server; http.uri; content:"/netflix_clone/"; startswith; fast_pattern; http.host; content:"its-rkyadav.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001257; classtype:social-engineering; sid:6001257; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cinoa .com .ar/vps/am/paiement .php)"; flow:established,to_server; http.uri; content:"/vps/am/paiement.php"; startswith; fast_pattern; http.host; content:"cinoa.com.ar"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001258; classtype:social-engineering; sid:6001258; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (messagerie-sfr-alerte .ddns-ip .net/securityss/lignesfr-clients/)"; flow:established,to_server; http.uri; content:"/securityss/lignesfr-clients/"; startswith; fast_pattern; http.host; content:"messagerie-sfr-alerte.ddns-ip.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001259; classtype:social-engineering; sid:6001259; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezouallwwet .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezouallwwet.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001260; classtype:social-engineering; sid:6001260; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (816532487654871235156346 .blogspot .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"816532487654871235156346.blogspot.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001261; classtype:social-engineering; sid:6001261; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (managewbeppauityiukwetrfiu342rsdg .goblin3 .biz .id/?yyy)"; flow:established,to_server; http.uri; content:"/?yyy"; startswith; fast_pattern; http.host; content:"managewbeppauityiukwetrfiu342rsdg.goblin3.biz.id"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001262; classtype:social-engineering; sid:6001262; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (13 .accessbenefitscenter .com/journey?rdrx=1&s=e3925da0-1373-44ae-a3d3-fef9540214ff#back)"; flow:established,to_server; http.uri; content:"/journey?rdrx=1&s=e3925da0-1373-44ae-a3d3-fef9540214ff#back"; startswith; fast_pattern; http.host; content:"13.accessbenefitscenter.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001263; classtype:social-engineering; sid:6001263; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .2 .gp/vzufzj8c)"; flow:established,to_server; http.uri; content:"/vzufzj8c"; startswith; fast_pattern; http.host; content:"www.2.gp"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001264; classtype:social-engineering; sid:6001264; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (exciting-principles-227692 .framer .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"exciting-principles-227692.framer.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001265; classtype:social-engineering; sid:6001265; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sunwocu8acct .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sunwocu8acct.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001266; classtype:social-engineering; sid:6001266; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (u3l .co/FD2Dv)"; flow:established,to_server; http.uri; content:"/FD2Dv"; startswith; fast_pattern; http.host; content:"u3l.co"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001267; classtype:social-engineering; sid:6001267; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faithful-leadership-448234 .framer .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"faithful-leadership-448234.framer.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001268; classtype:social-engineering; sid:6001268; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (place .bio/jhuuiui)"; flow:established,to_server; http.uri; content:"/jhuuiui"; startswith; fast_pattern; http.host; content:"place.bio"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001269; classtype:social-engineering; sid:6001269; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazonclone-steel-two .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazonclone-steel-two.vercel.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001270; classtype:social-engineering; sid:6001270; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (diplomatic-charts-791986 .framer .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"diplomatic-charts-791986.framer.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001271; classtype:social-engineering; sid:6001271; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vusawera .z1 .web .core .windows .net/uifzz3olfk9p .html)"; flow:established,to_server; http.uri; content:"/uifzz3olfk9p.html"; startswith; fast_pattern; http.host; content:"vusawera.z1.web.core.windows.net"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001272; classtype:social-engineering; sid:6001272; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (miraculous-example-761148 .framer .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"miraculous-example-761148.framer.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001273; classtype:social-engineering; sid:6001273; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (delightful-times-065803 .framer .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"delightful-times-065803.framer.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001274; classtype:social-engineering; sid:6001274; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (linky .ph/notfound)"; flow:established,to_server; http.uri; content:"/notfound"; startswith; fast_pattern; http.host; content:"linky.ph"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001275; classtype:social-engineering; sid:6001275; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mytwcommchcec .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mytwcommchcec.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001276; classtype:social-engineering; sid:6001276; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (posta-mfa .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"posta-mfa.webflow.io"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001277; classtype:social-engineering; sid:6001277; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinityweeeebbbbbbllllllyyyyyyy .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinityweeeebbbbbbllllllyyyyyyy.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001278; classtype:social-engineering; sid:6001278; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alouf .info-804431 .pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"alouf.info-804431.pro"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001279; classtype:social-engineering; sid:6001279; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mohamed .form8899533 .pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mohamed.form8899533.pro"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001280; classtype:social-engineering; sid:6001280; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mycmmunitychce .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mycmmunitychce.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001281; classtype:social-engineering; sid:6001281; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (physical-mission-098756 .framer .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"physical-mission-098756.framer.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001282; classtype:social-engineering; sid:6001282; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hrr-007ca7 .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hrr-007ca7.webflow.io"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001283; classtype:social-engineering; sid:6001283; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hvccuweb .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hvccuweb.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001284; classtype:social-engineering; sid:6001284; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cyvudbwvyudcjnkdbcvyfv .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cyvudbwvyudcjnkdbcvyfv.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001285; classtype:social-engineering; sid:6001285; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (super-part-458579 .framer .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"super-part-458579.framer.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001286; classtype:social-engineering; sid:6001286; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (newofferxfinitymailuser .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"newofferxfinitymailuser.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001287; classtype:social-engineering; sid:6001287; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rotating-presentation-849991 .framer .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rotating-presentation-849991.framer.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001288; classtype:social-engineering; sid:6001288; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (malouk .info-804431 .pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"malouk.info-804431.pro"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001289; classtype:social-engineering; sid:6001289; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lovely-face-544511 .framer .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lovely-face-544511.framer.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001290; classtype:social-engineering; sid:6001290; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiatmr6qgs4jzvvqgllrbnpdyslwy6rfazygzkdr74zspvpwwhqdcy .ipfs .dweb .link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiatmr6qgs4jzvvqgllrbnpdyslwy6rfazygzkdr74zspvpwwhqdcy.ipfs.dweb.link"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001291; classtype:social-engineering; sid:6001291; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (87132478623467124786532181l .blogspot .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"87132478623467124786532181l.blogspot.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001292; classtype:social-engineering; sid:6001292; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .form8899533 .pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.form8899533.pro"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001293; classtype:social-engineering; sid:6001293; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apps-trexiostart .wixstudio .com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"apps-trexiostart.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001294; classtype:social-engineering; sid:6001294; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cmstartledgr .wixstudio .com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"cmstartledgr.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001295; classtype:social-engineering; sid:6001295; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cuddly-wealth-365306 .framer .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cuddly-wealth-365306.framer.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001296; classtype:social-engineering; sid:6001296; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (megane .info-804431 .pro/capcha .php)"; flow:established,to_server; http.uri; content:"/capcha.php"; startswith; fast_pattern; http.host; content:"megane.info-804431.pro"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001297; classtype:social-engineering; sid:6001297; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eng-ledgr-com .wixstudio .com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"eng-ledgr-com.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001298; classtype:social-engineering; sid:6001298; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thoughtful-footprint-594939 .framer .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"thoughtful-footprint-594939.framer.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001299; classtype:social-engineering; sid:6001299; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tidy-context-585562 .framer .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tidy-context-585562.framer.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001300; classtype:social-engineering; sid:6001300; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (friendly-chart-655420 .framer .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"friendly-chart-655420.framer.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001301; classtype:social-engineering; sid:6001301; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (daewrfidkoofnedko .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"daewrfidkoofnedko.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001302; classtype:social-engineering; sid:6001302; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yandex .ru/showcaptchafast?d=E5CE661CC36210BA21921DEF8502412514E3E26D9A4BDCB41AA852D68A3EEE84F016E1018D7F53DCAB9939DCBE23AC5BCAE695F1EF&retpath=aHR0cHM6Ly95YW5kZXgucnUvc2VhcmNoP3RleHQ9MjExNjg3MTc%2C_ca5191c7931ca4352fae0a7ab1a27d68&s=db204c157019ab35d73336547eb5f308)"; flow:established,to_server; http.uri; content:"/showcaptchafast?d=E5CE661CC36210BA21921DEF8502412514E3E26D9A4BDCB41AA852D68A3EEE84F016E1018D7F53DCAB9939DCBE23AC5BCAE695F1EF&retpath=aHR0cHM6Ly95YW5kZXgucnUvc2VhcmNoP3RleHQ9MjExNjg3MTc%2C_ca5191c7931ca4352fae0a7ab1a27d68&s=db204c157019ab35d73336547eb5f308"; startswith; fast_pattern; http.host; content:"yandex.ru"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001303; classtype:social-engineering; sid:6001303; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (miloud .form8899533 .pro/captcha .php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"miloud.form8899533.pro"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001304; classtype:social-engineering; sid:6001304; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rachid .info-804431 .pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rachid.info-804431.pro"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001305; classtype:social-engineering; sid:6001305; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (waesdstdprigngo .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"waesdstdprigngo.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001306; classtype:social-engineering; sid:6001306; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (important-guardrails-681688 .framer .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"important-guardrails-681688.framer.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001307; classtype:social-engineering; sid:6001307; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lyve-leger .zapier .app/connect)"; flow:established,to_server; http.uri; content:"/connect"; startswith; fast_pattern; http.host; content:"lyve-leger.zapier.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001308; classtype:social-engineering; sid:6001308; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pagesxfiinnitywert .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pagesxfiinnitywert.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001309; classtype:social-engineering; sid:6001309; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bradescoatendimento .club/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bradescoatendimento.club"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001310; classtype:social-engineering; sid:6001310; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (glowing-customer-034374 .framer .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"glowing-customer-034374.framer.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001311; classtype:social-engineering; sid:6001311; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .facebookmail-noreply .com/live)"; flow:established,to_server; http.uri; content:"/live"; startswith; fast_pattern; http.host; content:"www.facebookmail-noreply.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001312; classtype:social-engineering; sid:6001312; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (23 .254 .227 .236/doc/kcupdate .html)"; flow:established,to_server; http.uri; content:"/doc/kcupdate.html"; startswith; fast_pattern; http.host; content:"23.254.227.236"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001313; classtype:social-engineering; sid:6001313; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member-access .credit-agency-meta .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member-access.credit-agency-meta.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001314; classtype:social-engineering; sid:6001314; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suitseapp-trexor .wixstudio .com/aaps)"; flow:established,to_server; http.uri; content:"/aaps"; startswith; fast_pattern; http.host; content:"suitseapp-trexor.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001315; classtype:social-engineering; sid:6001315; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie .oppp8129902 .shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.oppp8129902.shop"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001316; classtype:social-engineering; sid:6001316; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a .bestsizeservice .top/loader?a=4800032&s=4787556&t=94&p=18301&s1=999)"; flow:established,to_server; http.uri; content:"/loader?a=4800032&s=4787556&t=94&p=18301&s1=999"; startswith; fast_pattern; http.host; content:"a.bestsizeservice.top"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001317; classtype:social-engineering; sid:6001317; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yng .onlineclosetirai .info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yng.onlineclosetirai.info"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001318; classtype:social-engineering; sid:6001318; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .lightweightreliablesafecreative .autos/1jmkom16o/l?btd=dHJrLmp1ZGdlLXdpbmRvdy1yZWFsLWJpcnRoLnJ1bg&\;cid=oXulrv10d1QGquZZm89zIRCg&\;exptoken=MTc3NjY2NjAxMjk0NA%3D%3D&\;lang=cs&\;lid=0390021c-bed3-4ea8-ad72-8e05057a7893&\;ltd=dHJrLnNtZWxsLXJvY2tldC1jaGFpci1nYXJhZ2UucnVu&\;pd2q=YTE9MDM5MDAyMWMtYmVkMy00ZWE4LWFkNzItOGUwNTA1N2E3ODkzJmEyPTQxOTI4ZmE1LWZlNzMtNDlkMS1hMTUwLWFlNWMyMGNlMWJmMSZhMz0xMTY4&\;r_countrycode=CZ&\;r_lang=cs&\;td=dHJrLnNjZW5lLXByaW5jaXBhbC1wYXBlci1zdGVhbS5ydW4vc253ZGFydGY&\;lvc=33577df7)"; flow:established,to_server; http.uri; content:"/1jmkom16o/l?btd=dHJrLmp1ZGdlLXdpbmRvdy1yZWFsLWJpcnRoLnJ1bg&|3b|cid=oXulrv10d1QGquZZm89zIRCg&|3b|exptoken=MTc3NjY2NjAxMjk0NA%3D%3D&|3b|lang=cs&|3b|lid=0390021c-bed3-4ea8-ad72-8e05057a7893&|3b|ltd=dHJrLnNtZWxsLXJvY2tldC1jaGFpci1nYXJhZ2UucnVu&|3b|pd2q=YTE9MDM5MDAyMWMtYmVkMy00ZWE4LWFkNzItOGUwNTA1N2E3ODkzJmEyPTQxOTI4ZmE1LWZlNzMtNDlkMS1hMTUwLWFlNWMyMGNlMWJmMSZhMz0xMTY4&|3b|r_countrycode=CZ&|3b|r_lang=cs&|3b|td=dHJrLnNjZW5lLXByaW5jaXBhbC1wYXBlci1zdGVhbS5ydW4vc253ZGFydGY&|3b|lvc=33577df7"; startswith; fast_pattern; http.host; content:"www.lightweightreliablesafecreative.autos"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001319; classtype:social-engineering; sid:6001319; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sebmout .com/HomeAotap/)"; flow:established,to_server; http.uri; content:"/HomeAotap/"; startswith; fast_pattern; http.host; content:"sebmout.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001320; classtype:social-engineering; sid:6001320; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (asset-download .wixstudio .com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"asset-download.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001321; classtype:social-engineering; sid:6001321; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pqsolutions .org/yak/rogers/login .html)"; flow:established,to_server; http.uri; content:"/yak/rogers/login.html"; startswith; fast_pattern; http.host; content:"pqsolutions.org"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001322; classtype:social-engineering; sid:6001322; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .powr .io/microblog/i/40754732%22)"; flow:established,to_server; http.uri; content:"/microblog/i/40754732%22"; startswith; fast_pattern; http.host; content:"www.powr.io"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001323; classtype:social-engineering; sid:6001323; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (victorycollegemaadi .com/wp-includes/Text/cxtqnrg/twlzeqa/eulxdbm/pit/?503680)"; flow:established,to_server; http.uri; content:"/wp-includes/Text/cxtqnrg/twlzeqa/eulxdbm/pit/?503680"; startswith; fast_pattern; http.host; content:"victorycollegemaadi.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001324; classtype:social-engineering; sid:6001324; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mub .me/5TL)"; flow:established,to_server; http.uri; content:"/5TL"; startswith; fast_pattern; http.host; content:"mub.me"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001325; classtype:social-engineering; sid:6001325; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (startledggr-live .wixstudio .com/enus-live)"; flow:established,to_server; http.uri; content:"/enus-live"; startswith; fast_pattern; http.host; content:"startledggr-live.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001326; classtype:social-engineering; sid:6001326; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (duioaesdrcvbkl .z9 .web .core .windows .net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"duioaesdrcvbkl.z9.web.core.windows.net"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001327; classtype:social-engineering; sid:6001327; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tronscen .wixstudio .com/tronscan)"; flow:established,to_server; http.uri; content:"/tronscan"; startswith; fast_pattern; http.host; content:"tronscen.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001328; classtype:social-engineering; sid:6001328; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my-website-26221 .jimdosite .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"my-website-26221.jimdosite.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001329; classtype:social-engineering; sid:6001329; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lineagiorgini .com/postaonline/ptt-address-page .html)"; flow:established,to_server; http.uri; content:"/postaonline/ptt-address-page.html"; startswith; fast_pattern; http.host; content:"lineagiorgini.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001330; classtype:social-engineering; sid:6001330; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps .us-xoarg .life/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"usps.us-xoarg.life"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001331; classtype:social-engineering; sid:6001331; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sebceqcit .com/Homeatoas/)"; flow:established,to_server; http.uri; content:"/Homeatoas/"; startswith; fast_pattern; http.host; content:"sebceqcit.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001332; classtype:social-engineering; sid:6001332; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-zone .credit-agency-meta .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-zone.credit-agency-meta.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001333; classtype:social-engineering; sid:6001333; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (seblanqet .com/HomeSelta/)"; flow:established,to_server; http.uri; content:"/HomeSelta/"; startswith; fast_pattern; http.host; content:"seblanqet.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001334; classtype:social-engineering; sid:6001334; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hoematreselob .com/HoseMatar/)"; flow:established,to_server; http.uri; content:"/HoseMatar/"; startswith; fast_pattern; http.host; content:"hoematreselob.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001335; classtype:social-engineering; sid:6001335; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (us-ledgerrstart .wixstudio .com/en-cdn)"; flow:established,to_server; http.uri; content:"/en-cdn"; startswith; fast_pattern; http.host; content:"us-ledgerrstart.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001336; classtype:social-engineering; sid:6001336; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ln .run/-l6T3)"; flow:established,to_server; http.uri; content:"/-l6T3"; startswith; fast_pattern; http.host; content:"ln.run"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001337; classtype:social-engineering; sid:6001337; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (10nlinedocurnentsharedmonday .stablesuccessstrategies .de/5jVEg/)"; flow:established,to_server; http.uri; content:"/5jVEg/"; startswith; fast_pattern; http.host; content:"10nlinedocurnentsharedmonday.stablesuccessstrategies.de"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001338; classtype:social-engineering; sid:6001338; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (base .maskarad .kiev .ua/sites/default/files/)"; flow:established,to_server; http.uri; content:"/sites/default/files/"; startswith; fast_pattern; http.host; content:"base.maskarad.kiev.ua"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001339; classtype:social-engineering; sid:6001339; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-eea61f21eee34420a23796facab50d72 .r2 .dev/ordini/ordine .html)"; flow:established,to_server; http.uri; content:"/ordini/ordine.html"; startswith; fast_pattern; http.host; content:"pub-eea61f21eee34420a23796facab50d72.r2.dev"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001340; classtype:social-engineering; sid:6001340; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mrhussenroshddy .samcart .com/products/happiness)"; flow:established,to_server; http.uri; content:"/products/happiness"; startswith; fast_pattern; http.host; content:"mrhussenroshddy.samcart.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001341; classtype:social-engineering; sid:6001341; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ddieza4565 .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ddieza4565.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001342; classtype:social-engineering; sid:6001342; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cannalab .eu/images/c/?email=undefined)"; flow:established,to_server; http.uri; content:"/images/c/?email=undefined"; startswith; fast_pattern; http.host; content:"cannalab.eu"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001343; classtype:social-engineering; sid:6001343; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brevistestresolve .pages .dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"brevistestresolve.pages.dev"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001344; classtype:social-engineering; sid:6001344; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (openai-onlinelxb .rvmobltech .com/chat/app/key .php?token=7cd8831d71a34639&\;session=eea9fe80f7&\;ref=17766906451526&\;v=v3 .4&\;t=1776690645)"; flow:established,to_server; http.uri; content:"/chat/app/key.php?token=7cd8831d71a34639&|3b|session=eea9fe80f7&|3b|ref=17766906451526&|3b|v=v3.4&|3b|t=1776690645"; startswith; fast_pattern; http.host; content:"openai-onlinelxb.rvmobltech.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001345; classtype:social-engineering; sid:6001345; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (desktop-ledgar .zapier .app/live)"; flow:established,to_server; http.uri; content:"/live"; startswith; fast_pattern; http.host; content:"desktop-ledgar.zapier.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001346; classtype:social-engineering; sid:6001346; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uarlrewje .sparkasse .qpon/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uarlrewje.sparkasse.qpon"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001347; classtype:social-engineering; sid:6001347; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dev-adjacent37 .pantheonsite .io/wp-admin/arubaben/posto .php)"; flow:established,to_server; http.uri; content:"/wp-admin/arubaben/posto.php"; startswith; fast_pattern; http.host; content:"dev-adjacent37.pantheonsite.io"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001348; classtype:social-engineering; sid:6001348; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paulomoreiramesquita .pt/zee/next/web/authen .php)"; flow:established,to_server; http.uri; content:"/zee/next/web/authen.php"; startswith; fast_pattern; http.host; content:"paulomoreiramesquita.pt"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001349; classtype:social-engineering; sid:6001349; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ugxwabhqtbta .sparkasse .qpon/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ugxwabhqtbta.sparkasse.qpon"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001350; classtype:social-engineering; sid:6001350; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ntwananotech .co .za/fayiii/surport .php#o .bures@mup .cz)"; flow:established,to_server; http.uri; content:"/fayiii/surport.php#o.bures@mup.cz"; startswith; fast_pattern; http.host; content:"ntwananotech.co.za"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001351; classtype:social-engineering; sid:6001351; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie .oferta73907652 .lat/oferta/kierownica-thrustmaster-t300-yy7pk96m)"; flow:established,to_server; http.uri; content:"/oferta/kierownica-thrustmaster-t300-yy7pk96m"; startswith; fast_pattern; http.host; content:"allegrolokalnie.oferta73907652.lat"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001352; classtype:social-engineering; sid:6001352; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (source-13903 .s3 .us-east-2 .amazonaws .com/reset/profile/config .html)"; flow:established,to_server; http.uri; content:"/reset/profile/config.html"; startswith; fast_pattern; http.host; content:"source-13903.s3.us-east-2.amazonaws.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001353; classtype:social-engineering; sid:6001353; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rgilf .thespeedyway .com/p6f88d0/691364425d2eafe234edc268 .html#BB)"; flow:established,to_server; http.uri; content:"/p6f88d0/691364425d2eafe234edc268.html#BB"; startswith; fast_pattern; http.host; content:"rgilf.thespeedyway.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001354; classtype:social-engineering; sid:6001354; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help-cHYQUP .dansopschool .nl/swiss/)"; flow:established,to_server; http.uri; content:"/swiss/"; startswith; fast_pattern; http.host; content:"help-chyqup.dansopschool.nl"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001355; classtype:social-engineering; sid:6001355; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sykessler .blob .core .windows .net/sykessler/sykessler)"; flow:established,to_server; http.uri; content:"/sykessler/sykessler"; startswith; fast_pattern; http.host; content:"sykessler.blob.core.windows.net"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001356; classtype:social-engineering; sid:6001356; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hotel-stay32181 .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hotel-stay32181.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001357; classtype:social-engineering; sid:6001357; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chime549 .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"chime549.godaddysites.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001358; classtype:social-engineering; sid:6001358; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eng-trezo .zapier .app/en-login)"; flow:established,to_server; http.uri; content:"/en-login"; startswith; fast_pattern; http.host; content:"eng-trezo.zapier.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001359; classtype:social-engineering; sid:6001359; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie .yng392802 .lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.yng392802.lat"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001360; classtype:social-engineering; sid:6001360; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trexor-ensuite .wixstudio .com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"trexor-ensuite.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001361; classtype:social-engineering; sid:6001361; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lhv-baaaa-promo1 .com/LHV/)"; flow:established,to_server; http.uri; content:"/LHV/"; startswith; fast_pattern; http.host; content:"lhv-baaaa-promo1.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001362; classtype:social-engineering; sid:6001362; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web .amarifirmdynamic-concepts .com/?email=example@example .com)"; flow:established,to_server; http.uri; content:"/?email=example@example.com"; startswith; fast_pattern; http.host; content:"web.amarifirmdynamic-concepts.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001363; classtype:social-engineering; sid:6001363; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie .983450h41 .lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.983450h41.lat"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001364; classtype:social-engineering; sid:6001364; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (etoll-ezpass-notify .bumbleshrimp .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"etoll-ezpass-notify.bumbleshrimp.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001365; classtype:social-engineering; sid:6001365; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mygphomes .com/login-check .html)"; flow:established,to_server; http.uri; content:"/login-check.html"; startswith; fast_pattern; http.host; content:"mygphomes.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001366; classtype:social-engineering; sid:6001366; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (host-ptit .amartstudio .it/WEBDFSPT/e763f4a3451842c78d5cc7649a7361c1/?e763f4a3451842c78d5cc7649a7361c1=g9JHXKnlVSz&\;payer)"; flow:established,to_server; http.uri; content:"/WEBDFSPT/e763f4a3451842c78d5cc7649a7361c1/?e763f4a3451842c78d5cc7649a7361c1=g9JHXKnlVSz&|3b|payer"; startswith; fast_pattern; http.host; content:"host-ptit.amartstudio.it"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001367; classtype:social-engineering; sid:6001367; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro .poiu23810-g34 .lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.poiu23810-g34.lat"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001368; classtype:social-engineering; sid:6001368; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (discordseas .pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"discordseas.pro"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001369; classtype:social-engineering; sid:6001369; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e-zpassiags-april .dynv6 .net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e-zpassiags-april.dynv6.net"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001370; classtype:social-engineering; sid:6001370; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (casaleco .com/login-check .html)"; flow:established,to_server; http.uri; content:"/login-check.html"; startswith; fast_pattern; http.host; content:"casaleco.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001371; classtype:social-engineering; sid:6001371; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-suittrez .wixstudio .com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"app-suittrez.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001372; classtype:social-engineering; sid:6001372; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie .pl-049049-oferta .shop/hulajnoga-kukirin-g4-2025/43725)"; flow:established,to_server; http.uri; content:"/hulajnoga-kukirin-g4-2025/43725"; startswith; fast_pattern; http.host; content:"allegrolokalnie.pl-049049-oferta.shop"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001373; classtype:social-engineering; sid:6001373; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pessoa-fisica .nesh6 .com .br/inicio)"; flow:established,to_server; http.uri; content:"/inicio"; startswith; fast_pattern; http.host; content:"pessoa-fisica.nesh6.com.br"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001374; classtype:social-engineering; sid:6001374; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (medwu .info/416806)"; flow:established,to_server; http.uri; content:"/416806"; startswith; fast_pattern; http.host; content:"medwu.info"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001375; classtype:social-engineering; sid:6001375; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cefdehgshdf .onrender .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cefdehgshdf.onrender.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001376; classtype:social-engineering; sid:6001376; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro .983450h41 .lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.983450h41.lat"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001377; classtype:social-engineering; sid:6001377; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps .us-ntudr .life/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"usps.us-ntudr.life"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001378; classtype:social-engineering; sid:6001378; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nav-upohld-eng .zapier .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nav-upohld-eng.zapier.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001379; classtype:social-engineering; sid:6001379; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netfilx-rejoin .dynv6 .net/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"netfilx-rejoin.dynv6.net"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001380; classtype:social-engineering; sid:6001380; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie .842738232f32 .lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.842738232f32.lat"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001381; classtype:social-engineering; sid:6001381; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (surl .li/nkayto)"; flow:established,to_server; http.uri; content:"/nkayto"; startswith; fast_pattern; http.host; content:"surl.li"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001382; classtype:social-engineering; sid:6001382; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ms-en .github .io/lnstagram/)"; flow:established,to_server; http.uri; content:"/lnstagram/"; startswith; fast_pattern; http.host; content:"ms-en.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001383; classtype:social-engineering; sid:6001383; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (desaplicadas .vu/bgt5/others .html?eta=maror9@ab14f2274f9be61f966367b15882eba516d5 .com)"; flow:established,to_server; http.uri; content:"/bgt5/others.html?eta=maror9@ab14f2274f9be61f966367b15882eba516d5.com"; startswith; fast_pattern; http.host; content:"desaplicadas.vu"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001384; classtype:social-engineering; sid:6001384; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (karankumae .github .io/netflixclone/)"; flow:established,to_server; http.uri; content:"/netflixclone/"; startswith; fast_pattern; http.host; content:"karankumae.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001385; classtype:social-engineering; sid:6001385; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iplog .co/2er7S6)"; flow:established,to_server; http.uri; content:"/2er7S6"; startswith; fast_pattern; http.host; content:"iplog.co"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001386; classtype:social-engineering; sid:6001386; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (is .gd/GgieGX)"; flow:established,to_server; http.uri; content:"/GgieGX"; startswith; fast_pattern; http.host; content:"is.gd"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001387; classtype:social-engineering; sid:6001387; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ribanholdlogip .gitbook .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ribanholdlogip.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001388; classtype:social-engineering; sid:6001388; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anusriyacp .github .io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"anusriyacp.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001389; classtype:social-engineering; sid:6001389; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agency-network .accounts-admin-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"agency-network.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001390; classtype:social-engineering; sid:6001390; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (finance-ndax .pages .dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"finance-ndax.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001391; classtype:social-engineering; sid:6001391; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (joaogallindo-dev .github .io/Clone-Netflix/)"; flow:established,to_server; http.uri; content:"/Clone-Netflix/"; startswith; fast_pattern; http.host; content:"joaogallindo-dev.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001392; classtype:social-engineering; sid:6001392; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (finnest .ink/yago/index .html)"; flow:established,to_server; http.uri; content:"/yago/index.html"; startswith; fast_pattern; http.host; content:"finnest.ink"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001393; classtype:social-engineering; sid:6001393; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (namanjain-git .github .io/Netflix-UI-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-UI-Clone/"; startswith; fast_pattern; http.host; content:"namanjain-git.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001394; classtype:social-engineering; sid:6001394; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (microsoftquarantine .authorised-support .com/login/review/wjy99UrJpywk6FVPPIN_vx51xfx1Jt7X1UEQ=7Bg==/qVL0fNmNYahdj2smOXWXeggfE1TOi_hb/)"; flow:established,to_server; http.uri; content:"/login/review/wjy99UrJpywk6FVPPIN_vx51xfx1Jt7X1UEQ=7Bg==/qVL0fNmNYahdj2smOXWXeggfE1TOi_hb/"; startswith; fast_pattern; http.host; content:"microsoftquarantine.authorised-support.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001395; classtype:social-engineering; sid:6001395; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clover-infotech-internal .github .io/clover-ai-chatboat-compass/)"; flow:established,to_server; http.uri; content:"/clover-ai-chatboat-compass/"; startswith; fast_pattern; http.host; content:"clover-infotech-internal.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001396; classtype:social-engineering; sid:6001396; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sab8942 .github .io/Amazon-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-clone/"; startswith; fast_pattern; http.host; content:"sab8942.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001397; classtype:social-engineering; sid:6001397; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enuganduladineshkumar .github .io/Netflix-Clone-Landing-page/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone-Landing-page/"; startswith; fast_pattern; http.host; content:"enuganduladineshkumar.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001398; classtype:social-engineering; sid:6001398; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dkcode1706 .github .io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"dkcode1706.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001399; classtype:social-engineering; sid:6001399; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd .zplmqxjtrv .cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.zplmqxjtrv.cfd"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001400; classtype:social-engineering; sid:6001400; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mhqajiz .bl8cz6 .cn/apusetop/jupindx/)"; flow:established,to_server; http.uri; content:"/apusetop/jupindx/"; startswith; fast_pattern; http.host; content:"mhqajiz.bl8cz6.cn"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001401; classtype:social-engineering; sid:6001401; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (serves-9eprotection .vercel .app/jsecsev .html?eta=renenhub@7048b0f77cf7408ea29da6189a080712327c .com)"; flow:established,to_server; http.uri; content:"/jsecsev.html?eta=renenhub@7048b0f77cf7408ea29da6189a080712327c.com"; startswith; fast_pattern; http.host; content:"serves-9eprotection.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001402; classtype:social-engineering; sid:6001402; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kixcoinlognin .gitbook .io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"kixcoinlognin.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001403; classtype:social-engineering; sid:6001403; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (synva-nalra-biz01-prixo-dexma-spct1 .pages .dev/heartily_welcome?id=845957945277545&page_name=AryaSpa/)"; flow:established,to_server; http.uri; content:"/heartily_welcome?id=845957945277545&page_name=AryaSpa/"; startswith; fast_pattern; http.host; content:"synva-nalra-biz01-prixo-dexma-spct1.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001404; classtype:social-engineering; sid:6001404; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usa_bluckfilouin .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"usa_bluckfilouin.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001405; classtype:social-engineering; sid:6001405; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwbellca .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wwbellca.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001406; classtype:social-engineering; sid:6001406; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trkloge23 .serv00 .net/dkb/login .php)"; flow:established,to_server; http.uri; content:"/dkb/login.php"; startswith; fast_pattern; http.host; content:"trkloge23.serv00.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001407; classtype:social-engineering; sid:6001407; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agency-service .accounts-admin-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"agency-service.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001408; classtype:social-engineering; sid:6001408; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktifkanpayylater .ijj .my .id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktifkanpayylater.ijj.my.id"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001409; classtype:social-engineering; sid:6001409; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth-metasmskchrrm .gitbook .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auth-metasmskchrrm.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001410; classtype:social-engineering; sid:6001410; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (01bced66 .sweet-credit-9cdf .pages .dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"01bced66.sweet-credit-9cdf.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001411; classtype:social-engineering; sid:6001411; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (niharika0732 .github .io/Project_Sem1/)"; flow:established,to_server; http.uri; content:"/Project_Sem1/"; startswith; fast_pattern; http.host; content:"niharika0732.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001412; classtype:social-engineering; sid:6001412; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (firewalll .b-cdn .net/11a .html)"; flow:established,to_server; http.uri; content:"/11a.html"; startswith; fast_pattern; http.host; content:"firewalll.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001413; classtype:social-engineering; sid:6001413; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robiox .com .py/users/205878237667/profile)"; flow:established,to_server; http.uri; content:"/users/205878237667/profile"; startswith; fast_pattern; http.host; content:"robiox.com.py"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001414; classtype:social-engineering; sid:6001414; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (seunovolimitealtoliberado .s3 .us-east-005 .backblazeb2 .com/aumento .html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"seunovolimitealtoliberado.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001415; classtype:social-engineering; sid:6001415; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-web-ndxxa-cdns .typedream .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-web-ndxxa-cdns.typedream.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001416; classtype:social-engineering; sid:6001416; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nr7571808-bit .github .io/Amazon-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-clone/"; startswith; fast_pattern; http.host; content:"nr7571808-bit.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001417; classtype:social-engineering; sid:6001417; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ericasantiago .com .br/0utFix/Mr_Khan/)"; flow:established,to_server; http.uri; content:"/0utFix/Mr_Khan/"; startswith; fast_pattern; http.host; content:"ericasantiago.com.br"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001418; classtype:social-engineering; sid:6001418; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kuckoinlogen .gitbook .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kuckoinlogen.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001419; classtype:social-engineering; sid:6001419; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login-pichinha .hstn .me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"login-pichinha.hstn.me"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001420; classtype:social-engineering; sid:6001420; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portal-cliente .hstn .me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"portal-cliente.hstn.me"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001421; classtype:social-engineering; sid:6001421; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sahanajambagi .github .io/amazon_clone/)"; flow:established,to_server; http.uri; content:"/amazon_clone/"; startswith; fast_pattern; http.host; content:"sahanajambagi.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001422; classtype:social-engineering; sid:6001422; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .uspsmailjourney .com/home)"; flow:established,to_server; http.uri; content:"/home"; startswith; fast_pattern; http.host; content:"www.uspsmailjourney.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001423; classtype:social-engineering; sid:6001423; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tax .securebankinggroup .com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"tax.securebankinggroup.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001424; classtype:social-engineering; sid:6001424; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kaarthi0312 .github .io/Instagram-copy-page)"; flow:established,to_server; http.uri; content:"/Instagram-copy-page"; startswith; fast_pattern; http.host; content:"kaarthi0312.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001425; classtype:social-engineering; sid:6001425; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (contact-account-client .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"contact-account-client.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001426; classtype:social-engineering; sid:6001426; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jjanahh274-eng .github .io/portofoliocs/)"; flow:established,to_server; http.uri; content:"/portofoliocs/"; startswith; fast_pattern; http.host; content:"jjanahh274-eng.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001427; classtype:social-engineering; sid:6001427; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (diogohenriquedotpy .github .io/meus-sites-favoritos)"; flow:established,to_server; http.uri; content:"/meus-sites-favoritos"; startswith; fast_pattern; http.host; content:"diogohenriquedotpy.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001428; classtype:social-engineering; sid:6001428; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (asistenciahoy .com/?r=9f5adc1a-07a7-4de3-b3cb-e368f57c684b&rg=eu)"; flow:established,to_server; http.uri; content:"/?r=9f5adc1a-07a7-4de3-b3cb-e368f57c684b&rg=eu"; startswith; fast_pattern; http.host; content:"asistenciahoy.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001429; classtype:social-engineering; sid:6001429; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mattcreamer17-gif .github .io/bank-of-america/)"; flow:established,to_server; http.uri; content:"/bank-of-america/"; startswith; fast_pattern; http.host; content:"mattcreamer17-gif.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001430; classtype:social-engineering; sid:6001430; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xdanaidnpayltersp .teocix .my .id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xdanaidnpayltersp.teocix.my.id"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001431; classtype:social-engineering; sid:6001431; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (automation-meta .accounts-admin-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"automation-meta.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001432; classtype:social-engineering; sid:6001432; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gestao .current-news-alerts .com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"gestao.current-news-alerts.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001433; classtype:social-engineering; sid:6001433; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (husnainjavaid856 .github .io/netflix-ui-clone/)"; flow:established,to_server; http.uri; content:"/netflix-ui-clone/"; startswith; fast_pattern; http.host; content:"husnainjavaid856.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001434; classtype:social-engineering; sid:6001434; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (view-help---auth---bitmert--sso .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"view-help---auth---bitmert--sso.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001435; classtype:social-engineering; sid:6001435; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agency-manager .accounts-admin-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"agency-manager.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001436; classtype:social-engineering; sid:6001436; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (emilemoraes .github .io/Netflix-Clone-/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone-/"; startswith; fast_pattern; http.host; content:"emilemoraes.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001437; classtype:social-engineering; sid:6001437; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (badging .it-support-group .com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"badging.it-support-group.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001438; classtype:social-engineering; sid:6001438; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (codebyprathmesh .github .io/Amazon_Clone/)"; flow:established,to_server; http.uri; content:"/Amazon_Clone/"; startswith; fast_pattern; http.host; content:"codebyprathmesh.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001439; classtype:social-engineering; sid:6001439; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (free-antivir .us/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"free-antivir.us"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001440; classtype:social-engineering; sid:6001440; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trilova .com .br/wp-includes/images/smilies/?ai=Gsolex@661f473f1606f68678eada72ac26d980b864 .com)"; flow:established,to_server; http.uri; content:"/wp-includes/images/smilies/?ai=Gsolex@661f473f1606f68678eada72ac26d980b864.com"; startswith; fast_pattern; http.host; content:"trilova.com.br"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001441; classtype:social-engineering; sid:6001441; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apple-responsive-frontend .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"apple-responsive-frontend.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001442; classtype:social-engineering; sid:6001442; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dhlsupplychaintest .earcu .com/jobs/login)"; flow:established,to_server; http.uri; content:"/jobs/login"; startswith; fast_pattern; http.host; content:"dhlsupplychaintest.earcu.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001443; classtype:social-engineering; sid:6001443; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member11 .agency-ad-meta .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member11.agency-ad-meta.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001444; classtype:social-engineering; sid:6001444; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member-sync .credit-agency-meta .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member-sync.credit-agency-meta.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001445; classtype:social-engineering; sid:6001445; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tamaratav .github .io/Netflix/)"; flow:established,to_server; http.uri; content:"/Netflix/"; startswith; fast_pattern; http.host; content:"tamaratav.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001446; classtype:social-engineering; sid:6001446; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (biswarup96 .github .io/cloneofnetflix/)"; flow:established,to_server; http.uri; content:"/cloneofnetflix/"; startswith; fast_pattern; http.host; content:"biswarup96.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001447; classtype:social-engineering; sid:6001447; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agency-marketing .accounts-admin-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"agency-marketing.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001448; classtype:social-engineering; sid:6001448; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-member .bussines-partner-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-member.bussines-partner-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001449; classtype:social-engineering; sid:6001449; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (easybank-landing-page-xi-eight .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"easybank-landing-page-xi-eight.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001450; classtype:social-engineering; sid:6001450; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (banque-online .com/?r=ad85ef05-2f84-483c-9666-7f58616606bd&rg=eu)"; flow:established,to_server; http.uri; content:"/?r=ad85ef05-2f84-483c-9666-7f58616606bd&rg=eu"; startswith; fast_pattern; http.host; content:"banque-online.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001451; classtype:social-engineering; sid:6001451; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (croatiapools .com/DK/DKB/dkb/login .php/)"; flow:established,to_server; http.uri; content:"/DK/DKB/dkb/login.php/"; startswith; fast_pattern; http.host; content:"croatiapools.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001452; classtype:social-engineering; sid:6001452; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member35 .agency-connection-hub .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member35.agency-connection-hub.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001453; classtype:social-engineering; sid:6001453; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (crackaf-bubbles-frontend .vercel .app/swap)"; flow:established,to_server; http.uri; content:"/swap"; startswith; fast_pattern; http.host; content:"crackaf-bubbles-frontend.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001454; classtype:social-engineering; sid:6001454; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faiyazusmani .github .io/instagram/)"; flow:established,to_server; http.uri; content:"/instagram/"; startswith; fast_pattern; http.host; content:"faiyazusmani.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001455; classtype:social-engineering; sid:6001455; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (updatesubs-netfilx .dynv6 .net/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"updatesubs-netfilx.dynv6.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001456; classtype:social-engineering; sid:6001456; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robloxt .cv/users/767705078/profile)"; flow:established,to_server; http.uri; content:"/users/767705078/profile"; startswith; fast_pattern; http.host; content:"robloxt.cv"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001457; classtype:social-engineering; sid:6001457; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-clone-kappa-five .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-clone-kappa-five.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001458; classtype:social-engineering; sid:6001458; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (net1 .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"net1.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001459; classtype:social-engineering; sid:6001459; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-tan-six .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-tan-six.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001460; classtype:social-engineering; sid:6001460; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (free-instagram-followers-mocha .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"free-instagram-followers-mocha.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001461; classtype:social-engineering; sid:6001461; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member17 .agency-connect-profile .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member17.agency-connect-profile.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001462; classtype:social-engineering; sid:6001462; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ericasantiago .com .br/0utFix/Mr_Khan/index2 .php)"; flow:established,to_server; http.uri; content:"/0utFix/Mr_Khan/index2.php"; startswith; fast_pattern; http.host; content:"ericasantiago.com.br"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001463; classtype:social-engineering; sid:6001463; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rentrise .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rentrise.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001464; classtype:social-engineering; sid:6001464; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kcoinlogin .github .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kcoinlogin.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001465; classtype:social-engineering; sid:6001465; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portal-live-ledgar .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"portal-live-ledgar.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001466; classtype:social-engineering; sid:6001466; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abhishekkumar2280 .github .io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"abhishekkumar2280.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001467; classtype:social-engineering; sid:6001467; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fdgfdg .center-meta-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fdgfdg.center-meta-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001468; classtype:social-engineering; sid:6001468; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentosolicitadomaio .s3 .us-east-005 .backblazeb2 .com/aumento .html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentosolicitadomaio.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001469; classtype:social-engineering; sid:6001469; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-6aa3879fh .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-6aa3879fh.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001470; classtype:social-engineering; sid:6001470; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accounts .bmwweb .systems/en/login)"; flow:established,to_server; http.uri; content:"/en/login"; startswith; fast_pattern; http.host; content:"accounts.bmwweb.systems"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001471; classtype:social-engineering; sid:6001471; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (studyioiyy .b-cdn .net/all1 .html?eta=mirus2@f0fca16225d1fa713bfefd56bbd8674cead3 .org)"; flow:established,to_server; http.uri; content:"/all1.html?eta=mirus2@f0fca16225d1fa713bfefd56bbd8674cead3.org"; startswith; fast_pattern; http.host; content:"studyioiyy.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001472; classtype:social-engineering; sid:6001472; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sheetaljanghu-design .github .io/Amazon-UI/)"; flow:established,to_server; http.uri; content:"/Amazon-UI/"; startswith; fast_pattern; http.host; content:"sheetaljanghu-design.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001473; classtype:social-engineering; sid:6001473; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (id-meta .busines-help-center .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"id-meta.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001474; classtype:social-engineering; sid:6001474; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (novolimitepratodos .s3 .us-east-005 .backblazeb2 .com/aumento .html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"novolimitepratodos.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001475; classtype:social-engineering; sid:6001475; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kidcarteer .b-cdn .net/all2 .html?eta=elen@af4ca0094d3b1404f6b727ea8d84549f47f5 .org)"; flow:established,to_server; http.uri; content:"/all2.html?eta=elen@af4ca0094d3b1404f6b727ea8d84549f47f5.org"; startswith; fast_pattern; http.host; content:"kidcarteer.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001476; classtype:social-engineering; sid:6001476; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vishal7398 .github .io/avs/index .html)"; flow:established,to_server; http.uri; content:"/avs/index.html"; startswith; fast_pattern; http.host; content:"vishal7398.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001477; classtype:social-engineering; sid:6001477; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-red-seven .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-red-seven.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001478; classtype:social-engineering; sid:6001478; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-f4bf4b5c581d4d2fae8ac6d8e8ea7310 .r2 .dev/woad .html)"; flow:established,to_server; http.uri; content:"/woad.html"; startswith; fast_pattern; http.host; content:"pub-f4bf4b5c581d4d2fae8ac6d8e8ea7310.r2.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001479; classtype:social-engineering; sid:6001479; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-1e5d76a3f07d40fca9aaa348be68acb6 .r2 .dev/Client:DogsForOurBraveEventDate%204:07:2026Tue .html)"; flow:established,to_server; http.uri; content:"/Client:DogsForOurBraveEventDate%204:07:2026Tue.html"; startswith; fast_pattern; http.host; content:"pub-1e5d76a3f07d40fca9aaa348be68acb6.r2.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001480; classtype:social-engineering; sid:6001480; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fnaver .netlify .app/nidlogin .login/?naps)"; flow:established,to_server; http.uri; content:"/nidlogin.login/?naps"; startswith; fast_pattern; http.host; content:"fnaver.netlify.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001481; classtype:social-engineering; sid:6001481; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17660 .invoice-ads-manager .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17660.invoice-ads-manager.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001482; classtype:social-engineering; sid:6001482; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thatpartllc .co/wp-admin/sf/sf_marley/sf_marley)"; flow:established,to_server; http.uri; content:"/wp-admin/sf/sf_marley/sf_marley"; startswith; fast_pattern; http.host; content:"thatpartllc.co"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001483; classtype:social-engineering; sid:6001483; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (members-meta .accounts-admin-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"members-meta.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001484; classtype:social-engineering; sid:6001484; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (easy-bank-landing-page-ecru .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"easy-bank-landing-page-ecru.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001485; classtype:social-engineering; sid:6001485; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (semdesculpaparasuassolucoes .s3 .us-east-005 .backblazeb2 .com/aumento .html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"semdesculpaparasuassolucoes.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001486; classtype:social-engineering; sid:6001486; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hems .standard .us-east-1 .oortstorages .com/11 .znc)"; flow:established,to_server; http.uri; content:"/11.znc"; startswith; fast_pattern; http.host; content:"hems.standard.us-east-1.oortstorages.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001487; classtype:social-engineering; sid:6001487; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-qu144p5yp-lumiereproductions .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-qu144p5yp-lumiereproductions.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001488; classtype:social-engineering; sid:6001488; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webfun .website/landingpages/a462b1ba-cbb5-4aec-853c-99f6af486dd1/jhAEYEtInnqYxzPh_N4lL-B6doAiM3LckFuEP39p2Kc)"; flow:established,to_server; http.uri; content:"/landingpages/a462b1ba-cbb5-4aec-853c-99f6af486dd1/jhAEYEtInnqYxzPh_N4lL-B6doAiM3LckFuEP39p2Kc"; startswith; fast_pattern; http.host; content:"webfun.website"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001489; classtype:social-engineering; sid:6001489; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shruti01022004 .github .io/NETFLIX-UI-clone/)"; flow:established,to_server; http.uri; content:"/NETFLIX-UI-clone/"; startswith; fast_pattern; http.host; content:"shruti01022004.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001490; classtype:social-engineering; sid:6001490; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abhimanyu088 .github .io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"abhimanyu088.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001491; classtype:social-engineering; sid:6001491; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (banban87 .github .io/banana/)"; flow:established,to_server; http.uri; content:"/banana/"; startswith; fast_pattern; http.host; content:"banban87.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001492; classtype:social-engineering; sid:6001492; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verifasoli .webcindario .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"verifasoli.webcindario.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001493; classtype:social-engineering; sid:6001493; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (956882coinbase .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"956882coinbase.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001494; classtype:social-engineering; sid:6001494; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (khushijain3103 .github .io/Instagram-Love)"; flow:established,to_server; http.uri; content:"/Instagram-Love"; startswith; fast_pattern; http.host; content:"khushijain3103.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001495; classtype:social-engineering; sid:6001495; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17658 .invoice-ads-manager .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17658.invoice-ads-manager.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001496; classtype:social-engineering; sid:6001496; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (microsoftquarantine .authorised-support .com/login/review/wjy99UrJpywk6FVPPIN_vx51xfx1Jt7X1UEQ=7Bg==0XVlTQl9DX1ZEb1xfV1leb0dZRFhvQFFDQ0dfQlQ=/qVL0fNmNYahdj2smOXWXeggfE1TOi_hb/)"; flow:established,to_server; http.uri; content:"/login/review/wjy99UrJpywk6FVPPIN_vx51xfx1Jt7X1UEQ=7Bg==0XVlTQl9DX1ZEb1xfV1leb0dZRFhvQFFDQ0dfQlQ=/qVL0fNmNYahdj2smOXWXeggfE1TOi_hb/"; startswith; fast_pattern; http.host; content:"microsoftquarantine.authorised-support.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001497; classtype:social-engineering; sid:6001497; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maida1610 .github .io/Amazon-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-clone/"; startswith; fast_pattern; http.host; content:"maida1610.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001498; classtype:social-engineering; sid:6001498; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (discord-clone-rajdeep019 .vercel .app/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"discord-clone-rajdeep019.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001499; classtype:social-engineering; sid:6001499; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (microsoft .authorised-support .com/new-account/EOzAFbYj1bjLmgufSIlKJJR9Kpvsy5kc3UkY=3Ag==5WFxWR1pGWlNBallaUlxbakJcQV1qRVRGRkJaR1E=/6Xx5KG1mKRNjeU3rSnC8diFTM7R4V1de)"; flow:established,to_server; http.uri; content:"/new-account/EOzAFbYj1bjLmgufSIlKJJR9Kpvsy5kc3UkY=3Ag==5WFxWR1pGWlNBallaUlxbakJcQV1qRVRGRkJaR1E=/6Xx5KG1mKRNjeU3rSnC8diFTM7R4V1de"; startswith; fast_pattern; http.host; content:"microsoft.authorised-support.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001500; classtype:social-engineering; sid:6001500; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortflarefn .github .io/roblox .github .io/)"; flow:established,to_server; http.uri; content:"/roblox.github.io/"; startswith; fast_pattern; http.host; content:"fortflarefn.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001501; classtype:social-engineering; sid:6001501; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .ynabioueconus-meriescs-experinces-t .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ynabioueconus-meriescs-experinces-t.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001502; classtype:social-engineering; sid:6001502; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login-finan2026 .gamer .gd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"login-finan2026.gamer.gd"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001503; classtype:social-engineering; sid:6001503; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mhamedkbt .github .io/NetflixPrj/)"; flow:established,to_server; http.uri; content:"/NetflixPrj/"; startswith; fast_pattern; http.host; content:"mhamedkbt.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001504; classtype:social-engineering; sid:6001504; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (theblueheart321-max .github .io/Amazon-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-clone/"; startswith; fast_pattern; http.host; content:"theblueheart321-max.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001505; classtype:social-engineering; sid:6001505; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (updatesubs-netfilx .dynv6 .net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"updatesubs-netfilx.dynv6.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001506; classtype:social-engineering; sid:6001506; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jkblog790 .netlify .app/playerunknowns-battlegrounds)"; flow:established,to_server; http.uri; content:"/playerunknowns-battlegrounds"; startswith; fast_pattern; http.host; content:"jkblog790.netlify.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001507; classtype:social-engineering; sid:6001507; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .amazon-clone-gray-psi .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazon-clone-gray-psi.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001508; classtype:social-engineering; sid:6001508; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .mexcdefi .com/h5/)"; flow:established,to_server; http.uri; content:"/h5/"; startswith; fast_pattern; http.host; content:"www.mexcdefi.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001509; classtype:social-engineering; sid:6001509; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (register27 .agency-partner-management .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"register27.agency-partner-management.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001510; classtype:social-engineering; sid:6001510; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adsmaxtt .putunesimbah .de/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"adsmaxtt.putunesimbah.de"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001511; classtype:social-engineering; sid:6001511; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17659 .invoice-ads-manager .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17659.invoice-ads-manager.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001512; classtype:social-engineering; sid:6001512; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inicioinusual365 .webcindario .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"inicioinusual365.webcindario.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001513; classtype:social-engineering; sid:6001513; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (javi-salas-dev .github .io/duplicate-Netflix)"; flow:established,to_server; http.uri; content:"/duplicate-Netflix"; startswith; fast_pattern; http.host; content:"javi-salas-dev.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001514; classtype:social-engineering; sid:6001514; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (central .pr-universe .com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/"; startswith; fast_pattern; http.host; content:"central.pr-universe.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001515; classtype:social-engineering; sid:6001515; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bridge-home--trezor .gitbook .io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"bridge-home--trezor.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001516; classtype:social-engineering; sid:6001516; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumento75 .s3 .us-east-005 .backblazeb2 .com/aumento .html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumento75.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001517; classtype:social-engineering; sid:6001517; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sites .google .com/view/wetrsfer/accueil/)"; flow:established,to_server; http.uri; content:"/view/wetrsfer/accueil/"; startswith; fast_pattern; http.host; content:"sites.google.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001518; classtype:social-engineering; sid:6001518; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (crditoecuadoenlinea .gt .tc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"crditoecuadoenlinea.gt.tc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001519; classtype:social-engineering; sid:6001519; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mdkamran623 .github .io/Amazon-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-clone/"; startswith; fast_pattern; http.host; content:"mdkamran623.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001520; classtype:social-engineering; sid:6001520; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (princemedia .co .za/mipaz/pages/login .php)"; flow:established,to_server; http.uri; content:"/mipaz/pages/login.php"; startswith; fast_pattern; http.host; content:"princemedia.co.za"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001521; classtype:social-engineering; sid:6001521; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecount-update .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ecount-update.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001522; classtype:social-engineering; sid:6001522; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galexcarrion .github .io/steam/)"; flow:established,to_server; http.uri; content:"/steam/"; startswith; fast_pattern; http.host; content:"galexcarrion.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001523; classtype:social-engineering; sid:6001523; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sherkar .github .io/Amazon_Web_Clone/)"; flow:established,to_server; http.uri; content:"/Amazon_Web_Clone/"; startswith; fast_pattern; http.host; content:"sherkar.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001524; classtype:social-engineering; sid:6001524; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (humanresources-team .com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"humanresources-team.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001525; classtype:social-engineering; sid:6001525; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-azure-ten .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-azure-ten.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001526; classtype:social-engineering; sid:6001526; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hotel-stay77213 .com/1006451789)"; flow:established,to_server; http.uri; content:"/1006451789"; startswith; fast_pattern; http.host; content:"hotel-stay77213.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001527; classtype:social-engineering; sid:6001527; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .joyfullmint-drop7 .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.joyfullmint-drop7.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001528; classtype:social-engineering; sid:6001528; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my-site-103180-108737 .weeblysite .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"my-site-103180-108737.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001529; classtype:social-engineering; sid:6001529; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumento25 .s3 .us-east-005 .backblazeb2 .com/aumento .html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumento25.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001530; classtype:social-engineering; sid:6001530; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maiorlimiteagora .s3 .us-east-005 .backblazeb2 .com/aumento .html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"maiorlimiteagora.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001531; classtype:social-engineering; sid:6001531; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dnaxx-ld .nxtxle .biz .id/x/int .html)"; flow:established,to_server; http.uri; content:"/x/int.html"; startswith; fast_pattern; http.host; content:"dnaxx-ld.nxtxle.biz.id"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001532; classtype:social-engineering; sid:6001532; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth-metasmskchrrm .gitbook .io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"auth-metasmskchrrm.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001533; classtype:social-engineering; sid:6001533; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (easy-bank-landing-page-pi .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"easy-bank-landing-page-pi.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001534; classtype:social-engineering; sid:6001534; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zxd365756 .com/index_m .html)"; flow:established,to_server; http.uri; content:"/index_m.html"; startswith; fast_pattern; http.host; content:"zxd365756.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001535; classtype:social-engineering; sid:6001535; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (home-rent-application .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"home-rent-application.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001536; classtype:social-engineering; sid:6001536; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ddeepakgoutam2005 .github .io/Netflix_Clone/)"; flow:established,to_server; http.uri; content:"/Netflix_Clone/"; startswith; fast_pattern; http.host; content:"ddeepakgoutam2005.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001537; classtype:social-engineering; sid:6001537; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger .updatesetup .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger.updatesetup.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001538; classtype:social-engineering; sid:6001538; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mayuresh-2601 .github .io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"mayuresh-2601.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001539; classtype:social-engineering; sid:6001539; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zeynepsudeilaslan .github .io/netflix-website-bootstrap/)"; flow:established,to_server; http.uri; content:"/netflix-website-bootstrap/"; startswith; fast_pattern; http.host; content:"zeynepsudeilaslan.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001540; classtype:social-engineering; sid:6001540; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shreyajaiswal0808 .github .io/PROJECT-main/)"; flow:established,to_server; http.uri; content:"/PROJECT-main/"; startswith; fast_pattern; http.host; content:"shreyajaiswal0808.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001541; classtype:social-engineering; sid:6001541; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mandalacraft .ro/lop/admin%20verify/)"; flow:established,to_server; http.uri; content:"/lop/admin%20verify/"; startswith; fast_pattern; http.host; content:"mandalacraft.ro"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001542; classtype:social-engineering; sid:6001542; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (applelocalizar .com/KvnLR/)"; flow:established,to_server; http.uri; content:"/KvnLR/"; startswith; fast_pattern; http.host; content:"applelocalizar.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001543; classtype:social-engineering; sid:6001543; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (desenrolabrasil2026 .site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"desenrolabrasil2026.site"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001544; classtype:social-engineering; sid:6001544; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help--ledgerlivelad .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"help--ledgerlivelad.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001545; classtype:social-engineering; sid:6001545; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (partner-sync .credit-agency-meta .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"partner-sync.credit-agency-meta.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001546; classtype:social-engineering; sid:6001546; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-azure-seven .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-azure-seven.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001547; classtype:social-engineering; sid:6001547; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shabin-hussain .github .io/facebook_login/)"; flow:established,to_server; http.uri; content:"/facebook_login/"; startswith; fast_pattern; http.host; content:"shabin-hussain.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001548; classtype:social-engineering; sid:6001548; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shantanu024 .github .io/Netflix-Clone)"; flow:established,to_server; http.uri; content:"/Netflix-Clone"; startswith; fast_pattern; http.host; content:"shantanu024.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001549; classtype:social-engineering; sid:6001549; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ubercar-site .web .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ubercar-site.web.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001550; classtype:social-engineering; sid:6001550; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ynabioueconus-meriescs-experinces-t .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ynabioueconus-meriescs-experinces-t.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001551; classtype:social-engineering; sid:6001551; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth-io-ttrezrcdn .gitbook .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auth-io-ttrezrcdn.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001552; classtype:social-engineering; sid:6001552; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chinkotemple .github .io/monfigs/)"; flow:established,to_server; http.uri; content:"/monfigs/"; startswith; fast_pattern; http.host; content:"chinkotemple.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001553; classtype:social-engineering; sid:6001553; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adiraneazkuenaga .es/cn/en .php?rand=13inboxlightaspxn .1774256418)"; flow:established,to_server; http.uri; content:"/cn/en.php?rand=13inboxlightaspxn.1774256418"; startswith; fast_pattern; http.host; content:"adiraneazkuenaga.es"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001554; classtype:social-engineering; sid:6001554; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledfgt-xmvtyoz .pages .dev/index .htm/)"; flow:established,to_server; http.uri; content:"/index.htm/"; startswith; fast_pattern; http.host; content:"ledfgt-xmvtyoz.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001555; classtype:social-engineering; sid:6001555; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (next-ab-clone-apetta .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"next-ab-clone-apetta.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001556; classtype:social-engineering; sid:6001556; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sgr4fa .pages .dev/-/zh/gp/video/detail/0q7g46igupnjj9zutowrmf8nst/ref=atv_pp_tt_9)"; flow:established,to_server; http.uri; content:"/-/zh/gp/video/detail/0q7g46igupnjj9zutowrmf8nst/ref=atv_pp_tt_9"; startswith; fast_pattern; http.host; content:"sgr4fa.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001557; classtype:social-engineering; sid:6001557; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .16ue-casefb751962 .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16ue-casefb751962.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001558; classtype:social-engineering; sid:6001558; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shrutitomar02 .github .io/Amazon-Project/checkout .html)"; flow:established,to_server; http.uri; content:"/Amazon-Project/checkout.html"; startswith; fast_pattern; http.host; content:"shrutitomar02.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001559; classtype:social-engineering; sid:6001559; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (airbnb-alpha-coral .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"airbnb-alpha-coral.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001560; classtype:social-engineering; sid:6001560; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (artmedal .ir/ggyg/alibaba/)"; flow:established,to_server; http.uri; content:"/ggyg/alibaba/"; startswith; fast_pattern; http.host; content:"artmedal.ir"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001561; classtype:social-engineering; sid:6001561; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail465163 .kmdastur .co/r?auth=f5ebb7e0ec4b860d&u=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS91cmw/cT1odHRwcyUzQSUyRiUyRndlYm1haWxzMzkuZmlsZ2h0LWNhbC5jb20lMkZvdXRsb29rZW5jcnB0JnNhPUQmc250ej0xJnVzZz1BT3ZWYXczdTc0Rkh5RzZOVktrNmtna0VmNUR5I3Rrb2VubmluZ0BjbHRob21hcy5jb21nbGUuY29t)"; flow:established,to_server; http.uri; content:"/r?auth=f5ebb7e0ec4b860d&u=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS91cmw/cT1odHRwcyUzQSUyRiUyRndlYm1haWxzMzkuZmlsZ2h0LWNhbC5jb20lMkZvdXRsb29rZW5jcnB0JnNhPUQmc250ej0xJnVzZz1BT3ZWYXczdTc0Rkh5RzZOVktrNmtna0VmNUR5I3Rrb2VubmluZ0BjbHRob21hcy5jb21nbGUuY29t"; startswith; fast_pattern; http.host; content:"webmail465163.kmdastur.co"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001562; classtype:social-engineering; sid:6001562; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kuckoinlogen .gitbook .io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"kuckoinlogen.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001563; classtype:social-engineering; sid:6001563; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (caseid0030 .marketing-network .agency/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"caseid0030.marketing-network.agency"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001564; classtype:social-engineering; sid:6001564; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ftx .claims-notification .com/portal-claims/?id=Y2FsY3VsYXRvYXJlcGl0ZXN0aS5jb20)"; flow:established,to_server; http.uri; content:"/portal-claims/?id=Y2FsY3VsYXRvYXJlcGl0ZXN0aS5jb20"; startswith; fast_pattern; http.host; content:"ftx.claims-notification.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001565; classtype:social-engineering; sid:6001565; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jkblog790 .netlify .app/playerunknowns-battlegrounds .html/)"; flow:established,to_server; http.uri; content:"/playerunknowns-battlegrounds.html/"; startswith; fast_pattern; http.host; content:"jkblog790.netlify.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001566; classtype:social-engineering; sid:6001566; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ww .viettevghy2026 .kesug .com/facebook-meta-ads2026)"; flow:established,to_server; http.uri; content:"/facebook-meta-ads2026"; startswith; fast_pattern; http.host; content:"ww.viettevghy2026.kesug.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001567; classtype:social-engineering; sid:6001567; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (radhachavan .github .io/My_website/)"; flow:established,to_server; http.uri; content:"/My_website/"; startswith; fast_pattern; http.host; content:"radhachavan.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001568; classtype:social-engineering; sid:6001568; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (phiscientificholdings .com/2513501 .doc/18a80a/fad0f483-81b2-45c6-ad47-7272058d9cb6)"; flow:established,to_server; http.uri; content:"/2513501.doc/18a80a/fad0f483-81b2-45c6-ad47-7272058d9cb6"; startswith; fast_pattern; http.host; content:"phiscientificholdings.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001569; classtype:social-engineering; sid:6001569; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-blockfee .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sso-blockfee.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001570; classtype:social-engineering; sid:6001570; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kuiocnlogen .gitbook .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kuiocnlogen.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001571; classtype:social-engineering; sid:6001571; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member24 .agency-connection-hub .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member24.agency-connection-hub.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001572; classtype:social-engineering; sid:6001572; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agency-partner .accounts-admin-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"agency-partner.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001573; classtype:social-engineering; sid:6001573; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth-io-ttrezrcdn .gitbook .io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"auth-io-ttrezrcdn.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001574; classtype:social-engineering; sid:6001574; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loginservice .cloud/E .lEcQSl9-99fHIQ?/linkedin/slink?code=afSN103785)"; flow:established,to_server; http.uri; content:"/E.lEcQSl9-99fHIQ?/linkedin/slink?code=afSN103785"; startswith; fast_pattern; http.host; content:"loginservice.cloud"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001575; classtype:social-engineering; sid:6001575; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telasmaster .serveirc .com/sicred/Portal .php)"; flow:established,to_server; http.uri; content:"/sicred/Portal.php"; startswith; fast_pattern; http.host; content:"telasmaster.serveirc.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001576; classtype:social-engineering; sid:6001576; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (public-trezo .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"public-trezo.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001577; classtype:social-engineering; sid:6001577; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail .supplier-gas-elpiji .duckdns .org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mail.supplier-gas-elpiji.duckdns.org"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001578; classtype:social-engineering; sid:6001578; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .nethubcorp .com/a57dc89e5gafef46a46bc0d58a4d0b6cf305 .html)"; flow:established,to_server; http.uri; content:"/a57dc89e5gafef46a46bc0d58a4d0b6cf305.html"; startswith; fast_pattern; http.host; content:"www.nethubcorp.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001579; classtype:social-engineering; sid:6001579; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kucoinrewards .blogspot .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kucoinrewards.blogspot.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001580; classtype:social-engineering; sid:6001580; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .app86365 .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.app86365.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001581; classtype:social-engineering; sid:6001581; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comtamsabichuongsiungonn .pages .dev/help/contact/633659756476066)"; flow:established,to_server; http.uri; content:"/help/contact/633659756476066"; startswith; fast_pattern; http.host; content:"comtamsabichuongsiungonn.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001582; classtype:social-engineering; sid:6001582; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sarthak312004 .github .io/Netflix_cln/)"; flow:established,to_server; http.uri; content:"/Netflix_cln/"; startswith; fast_pattern; http.host; content:"sarthak312004.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001583; classtype:social-engineering; sid:6001583; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .vlkote .hop .ru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.vlkote.hop.ru"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001584; classtype:social-engineering; sid:6001584; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imarsalan-tech .github .io/amazon-website/)"; flow:established,to_server; http.uri; content:"/amazon-website/"; startswith; fast_pattern; http.host; content:"imarsalan-tech.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001585; classtype:social-engineering; sid:6001585; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (arunvbiradar .github .io/instagram-clone)"; flow:established,to_server; http.uri; content:"/instagram-clone"; startswith; fast_pattern; http.host; content:"arunvbiradar.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001586; classtype:social-engineering; sid:6001586; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spotify .servernotification .events/premium/campaign/rejoin6m/login/jYIzT3IkJkRzitEx5knZyYGJ069Fh6em0RVs=6Bw==9SklWTVBfQGZVVl5QVw==/PFbnBhvz5dwOkHR1eD_R-l48VOHQKA2m/)"; flow:established,to_server; http.uri; content:"/premium/campaign/rejoin6m/login/jYIzT3IkJkRzitEx5knZyYGJ069Fh6em0RVs=6Bw==9SklWTVBfQGZVVl5QVw==/PFbnBhvz5dwOkHR1eD_R-l48VOHQKA2m/"; startswith; fast_pattern; http.host; content:"spotify.servernotification.events"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001587; classtype:social-engineering; sid:6001587; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bridge-home--trezor .gitbook .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bridge-home--trezor.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001588; classtype:social-engineering; sid:6001588; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (edu4life .github .io/amazon-project-version-1/)"; flow:established,to_server; http.uri; content:"/amazon-project-version-1/"; startswith; fast_pattern; http.host; content:"edu4life.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001589; classtype:social-engineering; sid:6001589; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (update-exodus-helpcentre .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"update-exodus-helpcentre.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001590; classtype:social-engineering; sid:6001590; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member427 .partner-business-hub .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member427.partner-business-hub.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001591; classtype:social-engineering; sid:6001591; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (red-mud-f702 .kendallelsaxbthtp0668 .workers .dev/email-notification2e3waXFarD_eFq_tvhuJl8ff\;fr=1lyxrntvqTbTboazV .AWccO3ZxPz8a78gk_aXXTrSbCR2jUDllDnMyiTKvp4YMycirUlo .Bp8iie . .AAA .0 .0 .Bp8iie .AWfdP6EKabBlBt6U0GYa0PcIPxQ)"; flow:established,to_server; http.uri; content:"/email-notification2e3waXFarD_eFq_tvhuJl8ff|3b|fr=1lyxrntvqTbTboazV.AWccO3ZxPz8a78gk_aXXTrSbCR2jUDllDnMyiTKvp4YMycirUlo.Bp8iie..AAA.0.0.Bp8iie.AWfdP6EKabBlBt6U0GYa0PcIPxQ"; startswith; fast_pattern; http.host; content:"red-mud-f702.kendallelsaxbthtp0668.workers.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001592; classtype:social-engineering; sid:6001592; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (luiplky .b-cdn .net/all1 .html)"; flow:established,to_server; http.uri; content:"/all1.html"; startswith; fast_pattern; http.host; content:"luiplky.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001593; classtype:social-engineering; sid:6001593; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (profile-meta .busines-help-center .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"profile-meta.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001594; classtype:social-engineering; sid:6001594; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-en-ca-netcoins-com-nav-azure .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sso-en-ca-netcoins-com-nav-azure.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001595; classtype:social-engineering; sid:6001595; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso--netcoins-com--cdn-oauth .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sso--netcoins-com--cdn-oauth.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001596; classtype:social-engineering; sid:6001596; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .free-instagram-followers-mocha .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.free-instagram-followers-mocha.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001597; classtype:social-engineering; sid:6001597; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (red-mud-f702 .kendallelsaxbthtp0668 .workers .dev/email-notification2e3waXFarD_eFq_tvhuJl8ff%3Bfr%3D1lyxrntvqTbTboazV .AWccO3ZxPz8a78gk_aXXTrSbCR2jUDllDnMyiTKvp4YMycirUlo .Bp8iie . .AAA .0 .0 .Bp8iie .AWfdP6EKabBlBt6U0GYa0PcIPxQ)"; flow:established,to_server; http.uri; content:"/email-notification2e3waXFarD_eFq_tvhuJl8ff%3Bfr%3D1lyxrntvqTbTboazV.AWccO3ZxPz8a78gk_aXXTrSbCR2jUDllDnMyiTKvp4YMycirUlo.Bp8iie..AAA.0.0.Bp8iie.AWfdP6EKabBlBt6U0GYa0PcIPxQ"; startswith; fast_pattern; http.host; content:"red-mud-f702.kendallelsaxbthtp0668.workers.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001598; classtype:social-engineering; sid:6001598; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gh .cyberfish .io/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"gh.cyberfish.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001599; classtype:social-engineering; sid:6001599; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kixcoinlognin .gitbook .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kixcoinlognin.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001600; classtype:social-engineering; sid:6001600; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rohanmore20 .github .io/Project-Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Project-Netflix-Clone/"; startswith; fast_pattern; http.host; content:"rohanmore20.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001601; classtype:social-engineering; sid:6001601; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member37 .agency-connection-hub .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member37.agency-connection-hub.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001602; classtype:social-engineering; sid:6001602; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (u6u .site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"u6u.site"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001603; classtype:social-engineering; sid:6001603; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allhrgroup .com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/"; startswith; fast_pattern; http.host; content:"allhrgroup.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001604; classtype:social-engineering; sid:6001604; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secur-servenupdates .b-cdn .net/secure .html?eta=kalospro@9940cf839c8806745bd7b4900dafd8a656e5 .net/)"; flow:established,to_server; http.uri; content:"/secure.html?eta=kalospro@9940cf839c8806745bd7b4900dafd8a656e5.net/"; startswith; fast_pattern; http.host; content:"secur-servenupdates.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001605; classtype:social-engineering; sid:6001605; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nandaatenatec .github .io/clone-spotify/)"; flow:established,to_server; http.uri; content:"/clone-spotify/"; startswith; fast_pattern; http.host; content:"nandaatenatec.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001606; classtype:social-engineering; sid:6001606; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jhamilan .github .io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"jhamilan.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001607; classtype:social-engineering; sid:6001607; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-e4efbbd740ce40d2ac91b55c3e0107be .r2 .dev/index .html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-e4efbbd740ce40d2ac91b55c3e0107be.r2.dev"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001608; classtype:social-engineering; sid:6001608; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (74-248-233-85 .cprapid .com/de/update .php?qvrmjupvmde7j2lskbn8)"; flow:established,to_server; http.uri; content:"/de/update.php?qvrmjupvmde7j2lskbn8"; startswith; fast_pattern; http.host; content:"74-248-233-85.cprapid.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001609; classtype:social-engineering; sid:6001609; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (raqnngilbcw .sparkasse .qpon/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"raqnngilbcw.sparkasse.qpon"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001610; classtype:social-engineering; sid:6001610; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (didactic-quick-link-leap .base44 .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"didactic-quick-link-leap.base44.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001611; classtype:social-engineering; sid:6001611; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie .smart-ogloszenie7482754 .shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalnie.smart-ogloszenie7482754.shop"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001612; classtype:social-engineering; sid:6001612; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comisariatoelsitio .com/php/010/de/error .php)"; flow:established,to_server; http.uri; content:"/php/010/de/error.php"; startswith; fast_pattern; http.host; content:"comisariatoelsitio.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001613; classtype:social-engineering; sid:6001613; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hardware-wallete7-ledger-live-login .vercel .app/ledger%20form/verify .html)"; flow:established,to_server; http.uri; content:"/ledger%20form/verify.html"; startswith; fast_pattern; http.host; content:"hardware-wallete7-ledger-live-login.vercel.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001614; classtype:social-engineering; sid:6001614; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fancy-pluto-198673 .framer .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fancy-pluto-198673.framer.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001615; classtype:social-engineering; sid:6001615; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (home-trezor .wixstudio .com/start)"; flow:established,to_server; http.uri; content:"/start"; startswith; fast_pattern; http.host; content:"home-trezor.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001616; classtype:social-engineering; sid:6001616; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ins-tagram .com/h5/)"; flow:established,to_server; http.uri; content:"/h5/"; startswith; fast_pattern; http.host; content:"ins-tagram.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001617; classtype:social-engineering; sid:6001617; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member-area-netfilx .dynv6 .net/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"member-area-netfilx.dynv6.net"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001618; classtype:social-engineering; sid:6001618; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dustswap .pages .dev/app/)"; flow:established,to_server; http.uri; content:"/app/"; startswith; fast_pattern; http.host; content:"dustswap.pages.dev"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001619; classtype:social-engineering; sid:6001619; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reviewattinformation .z6 .web .core .windows .net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"reviewattinformation.z6.web.core.windows.net"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001620; classtype:social-engineering; sid:6001620; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tdtshdbrhnen .onrender .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tdtshdbrhnen.onrender.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001621; classtype:social-engineering; sid:6001621; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (azcaycanh .com/smart-money-habits-daily-actions/?utm_source=shorten .ee .mh2qy&\;utm_medium=referral&\;utm_campaign=lnnf)"; flow:established,to_server; http.uri; content:"/smart-money-habits-daily-actions/?utm_source=shorten.ee.mh2qy&|3b|utm_medium=referral&|3b|utm_campaign=lnnf"; startswith; fast_pattern; http.host; content:"azcaycanh.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001622; classtype:social-engineering; sid:6001622; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netempresarialbra .digital/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netempresarialbra.digital"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001623; classtype:social-engineering; sid:6001623; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suiteapp-starten .wixstudio .com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"suiteapp-starten.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001624; classtype:social-engineering; sid:6001624; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafybeiex24yvfkzmdmn3chn7stonzts3kwgtyrf365zechav4aguha32ra .ipfs .dweb .link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafybeiex24yvfkzmdmn3chn7stonzts3kwgtyrf365zechav4aguha32ra.ipfs.dweb.link"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001625; classtype:social-engineering; sid:6001625; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ipkqrdegxqut .sparkasse .qpon/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ipkqrdegxqut.sparkasse.qpon"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001626; classtype:social-engineering; sid:6001626; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stationnement-antai-gouv-infractions .g-stav .eu/fr/facture-electronique/dossie/fr-fr/redirect)"; flow:established,to_server; http.uri; content:"/fr/facture-electronique/dossie/fr-fr/redirect"; startswith; fast_pattern; http.host; content:"stationnement-antai-gouv-infractions.g-stav.eu"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001627; classtype:social-engineering; sid:6001627; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aspiresafety .co .uk/login-check .html)"; flow:established,to_server; http.uri; content:"/login-check.html"; startswith; fast_pattern; http.host; content:"aspiresafety.co.uk"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001628; classtype:social-engineering; sid:6001628; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (consultas-descontos .vercel .app/inicio/index .html?utm_source=FB&\;utm_campaign=P67-32-R2-R30%252Fnoemi+%25E2%2580%2594+C%25C3%25B3pia+%25E2%2580%2594+C%25C3%25B3pia+%25E2%2580%2594+C%25C3%25B3pia%257C120244351874680296&\;utm_medium=-%257C120244351874240296&\;utm_content=-%257C120244351874910296&\;utm_term=Instagram_Reels&\;utm_id=120244351874680296&\;fbclid=PAaWdyZARu8YVleHRuA2FlbQEwAGFkaWQBqzGZ7A8ayHNydGMGYXBwX2lkDzU2NzA2NzM0MzM1MjQyNwABp88OnWlS6QtyIQIMFB0NvVEQwf9_Mr0JHqKLipCQYHmc1qR1zSreusT6_A3n_aem_3SUrlGj0somy3UlIGb27oQ&\;twrclid=184719789929795584)"; flow:established,to_server; http.uri; content:"/inicio/index.html?utm_source=FB&|3b|utm_campaign=P67-32-R2-R30%252Fnoemi+%25E2%2580%2594+C%25C3%25B3pia+%25E2%2580%2594+C%25C3%25B3pia+%25E2%2580%2594+C%25C3%25B3pia%257C120244351874680296&|3b|utm_medium=-%257C120244351874240296&|3b|utm_content=-%257C120244351874910296&|3b|utm_term=Instagram_Reels&|3b|utm_id=120244351874680296&|3b|fbclid=PAaWdyZARu8YVleHRuA2FlbQEwAGFkaWQBqzGZ7A8ayHNydGMGYXBwX2lkDzU2NzA2NzM0MzM1MjQyNwABp88OnWlS6QtyIQIMFB0NvVEQwf9_Mr0JHqKLipCQYHmc1qR1zSreusT6_A3n_aem_3SUrlGj0somy3UlIGb27oQ&|3b|twrclid=184719789929795584"; startswith; fast_pattern; http.host; content:"consultas-descontos.vercel.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001629; classtype:social-engineering; sid:6001629; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie .pl-03049-oferta .shop/apple-iphone-15-pro-max-512gb-/41283)"; flow:established,to_server; http.uri; content:"/apple-iphone-15-pro-max-512gb-/41283"; startswith; fast_pattern; http.host; content:"allegrolokalnie.pl-03049-oferta.shop"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001630; classtype:social-engineering; sid:6001630; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dkb .neuedaten-de .info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dkb.neuedaten-de.info"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001631; classtype:social-engineering; sid:6001631; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help-NX4VMT .dansopschool .nl/swiss/)"; flow:established,to_server; http.uri; content:"/swiss/"; startswith; fast_pattern; http.host; content:"help-nx4vmt.dansopschool.nl"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001632; classtype:social-engineering; sid:6001632; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vmsteeltech .in/1001/rogers/login .html)"; flow:established,to_server; http.uri; content:"/1001/rogers/login.html"; startswith; fast_pattern; http.host; content:"vmsteeltech.in"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001633; classtype:social-engineering; sid:6001633; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezorsuit-en .wixstudio .com/usen)"; flow:established,to_server; http.uri; content:"/usen"; startswith; fast_pattern; http.host; content:"trezorsuit-en.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001634; classtype:social-engineering; sid:6001634; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bancaenlineaempresa .z13 .web .core .windows .net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bancaenlineaempresa.z13.web.core.windows.net"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001635; classtype:social-engineering; sid:6001635; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mars-0320 .pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mars-0320.pro"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001636; classtype:social-engineering; sid:6001636; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp839895 .sitebeat .crazydomains .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp839895.sitebeat.crazydomains.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001637; classtype:social-engineering; sid:6001637; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maryinternaldoc9c909448f0c5048b466d4030f0989544 .gracesabagricbusiness .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"maryinternaldoc9c909448f0c5048b466d4030f0989544.gracesabagricbusiness.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001638; classtype:social-engineering; sid:6001638; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (onlineugyintezes-villanyszamlaja-hu .com/support/payment/)"; flow:established,to_server; http.uri; content:"/support/payment/"; startswith; fast_pattern; http.host; content:"onlineugyintezes-villanyszamlaja-hu.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001639; classtype:social-engineering; sid:6001639; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (online .midvaalimports .co .za/yetfoodall/laleague2610C/login .php)"; flow:established,to_server; http.uri; content:"/yetfoodall/laleague2610C/login.php"; startswith; fast_pattern; http.host; content:"online.midvaalimports.co.za"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001640; classtype:social-engineering; sid:6001640; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qrcodeveloper .com/code/B39gvypK0-Oi8xtD)"; flow:established,to_server; http.uri; content:"/code/B39gvypK0-Oi8xtD"; startswith; fast_pattern; http.host; content:"qrcodeveloper.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001641; classtype:social-engineering; sid:6001641; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bradesco .componenteempresarial .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bradesco.componenteempresarial.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001642; classtype:social-engineering; sid:6001642; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-a52f7f04d43f467793f7040549166d62 .r2 .dev/index .html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-a52f7f04d43f467793f7040549166d62.r2.dev"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001643; classtype:social-engineering; sid:6001643; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pamelarecordzcbb43de84659d691b441405b2a778b61 .westernminingghana .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pamelarecordzcbb43de84659d691b441405b2a778b61.westernminingghana.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001644; classtype:social-engineering; sid:6001644; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro .oferta6290143 .shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.oferta6290143.shop"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001645; classtype:social-engineering; sid:6001645; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro .982340h452367482345 .lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.982340h452367482345.lat"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001646; classtype:social-engineering; sid:6001646; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .vmsteeltech .in/1001/rogers/login .html)"; flow:established,to_server; http.uri; content:"/1001/rogers/login.html"; startswith; fast_pattern; http.host; content:"www.vmsteeltech.in"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001647; classtype:social-engineering; sid:6001647; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (165 .154 .231 .146/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"165.154.231.146"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001648; classtype:social-engineering; sid:6001648; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie .smar1029638 .lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.smar1029638.lat"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001649; classtype:social-engineering; sid:6001649; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie .smart01249172847230y345823743 .lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.smart01249172847230y345823743.lat"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001650; classtype:social-engineering; sid:6001650; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp380679 .sitebeat .crazydomains .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp380679.sitebeat.crazydomains.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001651; classtype:social-engineering; sid:6001651; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-main .dev/r/?aXBkYXRhPTE0NC4zMS4yLjU1LCAxNzIuNjQuMjAwLjgxJnZib3g9JnN2PW8zNjVfMV9ub20mbT1xTiZ1aWQ9VVNFUjA5MDIyMDI2VTQyMDIwOTQzJnQ9SkU=)"; flow:established,to_server; http.uri; content:"/r/?aXBkYXRhPTE0NC4zMS4yLjU1LCAxNzIuNjQuMjAwLjgxJnZib3g9JnN2PW8zNjVfMV9ub20mbT1xTiZ1aWQ9VVNFUjA5MDIyMDI2VTQyMDIwOTQzJnQ9SkU="; startswith; fast_pattern; http.host; content:"web-main.dev"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001652; classtype:social-engineering; sid:6001652; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sw .run/page-contacts)"; flow:established,to_server; http.uri; content:"/page-contacts"; startswith; fast_pattern; http.host; content:"sw.run"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001653; classtype:social-engineering; sid:6001653; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-570ecbc453d2491bb6d62cb389ff791e .r2 .dev/index .html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-570ecbc453d2491bb6d62cb389ff791e.r2.dev"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001654; classtype:social-engineering; sid:6001654; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie .smar094235823012-y34 .shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.smar094235823012-y34.shop"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001655; classtype:social-engineering; sid:6001655; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accesobac .help/pa)"; flow:established,to_server; http.uri; content:"/pa"; startswith; fast_pattern; http.host; content:"accesobac.help"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001656; classtype:social-engineering; sid:6001656; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dbs .xjpdbsrmkf .com/index .html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"dbs.xjpdbsrmkf.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001657; classtype:social-engineering; sid:6001657; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cfg-ach-dhc .co/smt/)"; flow:established,to_server; http.uri; content:"/smt/"; startswith; fast_pattern; http.host; content:"cfg-ach-dhc.co"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001658; classtype:social-engineering; sid:6001658; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smt-doo-axx .co/smt/)"; flow:established,to_server; http.uri; content:"/smt/"; startswith; fast_pattern; http.host; content:"smt-doo-axx.co"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001659; classtype:social-engineering; sid:6001659; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie .982340h452367482345 .lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.982340h452367482345.lat"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001660; classtype:social-engineering; sid:6001660; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-7286888a4a30420ca43a0a3961b944c0 .r2 .dev/index .html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-7286888a4a30420ca43a0a3961b944c0.r2.dev"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001661; classtype:social-engineering; sid:6001661; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-5c15f6de915d475d94825387734e7c48 .r2 .dev/index .html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-5c15f6de915d475d94825387734e7c48.r2.dev"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001662; classtype:social-engineering; sid:6001662; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dsrzzi .jetgq .cn/jkautixtf/londut/)"; flow:established,to_server; http.uri; content:"/jkautixtf/londut/"; startswith; fast_pattern; http.host; content:"dsrzzi.jetgq.cn"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001663; classtype:social-engineering; sid:6001663; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (43 .153 .186 .198/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"43.153.186.198"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001664; classtype:social-engineering; sid:6001664; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ifajiabang .com/dca3ei/)"; flow:established,to_server; http.uri; content:"/dca3ei/"; startswith; fast_pattern; http.host; content:"ifajiabang.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001665; classtype:social-engineering; sid:6001665; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (illuminanceglobal .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"illuminanceglobal.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001666; classtype:social-engineering; sid:6001666; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (seur-cdefg .vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"seur-cdefg.vip"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001667; classtype:social-engineering; sid:6001667; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e-stat .online-k1 .com/home)"; flow:established,to_server; http.uri; content:"/home"; startswith; fast_pattern; http.host; content:"e-stat.online-k1.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001668; classtype:social-engineering; sid:6001668; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-ae9baf88afe44e2596e0a4b869ab2191 .r2 .dev/index .html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-ae9baf88afe44e2596e0a4b869ab2191.r2.dev"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001669; classtype:social-engineering; sid:6001669; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fazexmd .com/wordpress/fark/)"; flow:established,to_server; http.uri; content:"/wordpress/fark/"; startswith; fast_pattern; http.host; content:"fazexmd.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001670; classtype:social-engineering; sid:6001670; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (program-shopee22 .blogspot .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"program-shopee22.blogspot.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001671; classtype:social-engineering; sid:6001671; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-intellect .pages .dev/meta_for_business/)"; flow:established,to_server; http.uri; content:"/meta_for_business/"; startswith; fast_pattern; http.host; content:"meta-intellect.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001672; classtype:social-engineering; sid:6001672; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store .communityappwork .shop/workshop/AK47-EternalDecay/)"; flow:established,to_server; http.uri; content:"/workshop/AK47-EternalDecay/"; startswith; fast_pattern; http.host; content:"store.communityappwork.shop"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001673; classtype:social-engineering; sid:6001673; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-zf94w2hnv .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-zf94w2hnv.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001674; classtype:social-engineering; sid:6001674; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-1e4f4c4731564bcfb8e331f9603bf557 .r2 .dev/index .html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-1e4f4c4731564bcfb8e331f9603bf557.r2.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001675; classtype:social-engineering; sid:6001675; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yagla .tv/ck2zsbL)"; flow:established,to_server; http.uri; content:"/ck2zsbL"; startswith; fast_pattern; http.host; content:"yagla.tv"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001676; classtype:social-engineering; sid:6001676; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .kucoin_-login .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kucoin_-login.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001677; classtype:social-engineering; sid:6001677; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (barclays-banking .net/landing/form/b87ccaaf-29ad-4d9c-97e5-1fff10fbd579)"; flow:established,to_server; http.uri; content:"/landing/form/b87ccaaf-29ad-4d9c-97e5-1fff10fbd579"; startswith; fast_pattern; http.host; content:"barclays-banking.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001678; classtype:social-engineering; sid:6001678; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galabetdeportes .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galabetdeportes.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001679; classtype:social-engineering; sid:6001679; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (itinfolibrary .com/techhub/gc-measuringtheimpact12 .html)"; flow:established,to_server; http.uri; content:"/techhub/gc-measuringtheimpact12.html"; startswith; fast_pattern; http.host; content:"itinfolibrary.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001680; classtype:social-engineering; sid:6001680; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ksandaeniyan .rest/esal/srl/it/)"; flow:established,to_server; http.uri; content:"/esal/srl/it/"; startswith; fast_pattern; http.host; content:"ksandaeniyan.rest"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001681; classtype:social-engineering; sid:6001681; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (administrator-meta .busines-help-center .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"administrator-meta.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001682; classtype:social-engineering; sid:6001682; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile .bdstpa .top/pay?HKx=8uxAd?FZh=VP8ys)"; flow:established,to_server; http.uri; content:"/pay?HKx=8uxAd?FZh=VP8ys"; startswith; fast_pattern; http.host; content:"t-mobile.bdstpa.top"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001683; classtype:social-engineering; sid:6001683; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agiletransport .ch/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"agiletransport.ch"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001684; classtype:social-engineering; sid:6001684; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yagla .tv/cIqRaUh)"; flow:established,to_server; http.uri; content:"/cIqRaUh"; startswith; fast_pattern; http.host; content:"yagla.tv"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001685; classtype:social-engineering; sid:6001685; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sfgloballogisticservice .live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sfgloballogisticservice.live"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001686; classtype:social-engineering; sid:6001686; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (invoice-paymen .accounts-admin-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"invoice-paymen.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001687; classtype:social-engineering; sid:6001687; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id2337 .agency-manager-support .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id2337.agency-manager-support.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001688; classtype:social-engineering; sid:6001688; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (financialalertsystem .com/landing/form/033f1b5c-aeae-4f28-859f-1df9959fae12)"; flow:established,to_server; http.uri; content:"/landing/form/033f1b5c-aeae-4f28-859f-1df9959fae12"; startswith; fast_pattern; http.host; content:"financialalertsystem.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001689; classtype:social-engineering; sid:6001689; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumento24 .s3 .us-east-005 .backblazeb2 .com/aumento .html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumento24.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001690; classtype:social-engineering; sid:6001690; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile .xopyjl .top/pay?qKF=xwHRt?IGH=lSQ23)"; flow:established,to_server; http.uri; content:"/pay?qKF=xwHRt?IGH=lSQ23"; startswith; fast_pattern; http.host; content:"t-mobile.xopyjl.top"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001691; classtype:social-engineering; sid:6001691; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile .gftwpv .top/pay/a_index .html)"; flow:established,to_server; http.uri; content:"/pay/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.gftwpv.top"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001692; classtype:social-engineering; sid:6001692; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id19239262 .invoice-ads-program .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id19239262.invoice-ads-program.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001693; classtype:social-engineering; sid:6001693; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-auth .com/E .Nk1RYZL0a3Y)"; flow:established,to_server; http.uri; content:"/E.Nk1RYZL0a3Y"; startswith; fast_pattern; http.host; content:"sso-auth.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001694; classtype:social-engineering; sid:6001694; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mc .techdynamo .info/links/sAuJFRbZEauqKFkGxxDMsUZAfUAjdXMKFKGhXUPISuSMEfxckMCGhKynkMCAwDMkfkgXxDMchFXiMc/3652636)"; flow:established,to_server; http.uri; content:"/links/sAuJFRbZEauqKFkGxxDMsUZAfUAjdXMKFKGhXUPISuSMEfxckMCGhKynkMCAwDMkfkgXxDMchFXiMc/3652636"; startswith; fast_pattern; http.host; content:"mc.techdynamo.info"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001695; classtype:social-engineering; sid:6001695; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (supplier-gas-elpiji .duckdns .org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"supplier-gas-elpiji.duckdns.org"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001696; classtype:social-engineering; sid:6001696; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (121deo .senes .at/stakings/zpols1nz .php)"; flow:established,to_server; http.uri; content:"/stakings/zpols1nz.php"; startswith; fast_pattern; http.host; content:"121deo.senes.at"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001697; classtype:social-engineering; sid:6001697; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (citibankonlline .com/?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 .eyJhdWQiOiJKb2tlbiIsImV4cCI6MTc3ODU1MTE2OCwiaWF0IjoxNzc4NTQzOTY4LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIzMm5hZ2s2cnFkcDY2dmswcTA2ZzRyczEiLCJuYmYiOjE3Nzg1NDM5NjgsInRzIjoxNzc4NTQzOTY4MDk2NzcwfQ .n9PwIBN3pKTDAATlqQDG0prdcarrdjiC5UfcxV_UObY&sid=6001698dcb287-4d95-11f1-911d-2ded4648c92c)"; flow:established,to_server; http.uri; content:"/?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTc3ODU1MTE2OCwiaWF0IjoxNzc4NTQzOTY4LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIzMm5hZ2s2cnFkcDY2dmswcTA2ZzRyczEiLCJuYmYiOjE3Nzg1NDM5NjgsInRzIjoxNzc4NTQzOTY4MDk2NzcwfQ.n9PwIBN3pKTDAATlqQDG0prdcarrdjiC5UfcxV_UObY&sid=6001698dcb287-4d95-11f1-911d-2ded4648c92c"; startswith; fast_pattern; http.host; content:"citibankonlline.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001698; classtype:social-engineering; sid:6001698; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (redirect-f70b8973 .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"redirect-f70b8973.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001699; classtype:social-engineering; sid:6001699; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apple896a32f242594befbf0a937ab758af60 .6eqrvh .cn/Apple6ffa0925f10f4ea1b9286e1c7c5aabb9)"; flow:established,to_server; http.uri; content:"/Apple6ffa0925f10f4ea1b9286e1c7c5aabb9"; startswith; fast_pattern; http.host; content:"apple896a32f242594befbf0a937ab758af60.6eqrvh.cn"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001700; classtype:social-engineering; sid:6001700; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (orggginision2-2 .iceiy .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"orggginision2-2.iceiy.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001701; classtype:social-engineering; sid:6001701; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile .dtgpaf .top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dtgpaf.top"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001702; classtype:social-engineering; sid:6001702; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member20 .agency-connect-profile .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member20.agency-connect-profile.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001703; classtype:social-engineering; sid:6001703; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id2336 .agency-manager-support .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id2336.agency-manager-support.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001704; classtype:social-engineering; sid:6001704; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id19239263 .invoice-ads-program .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id19239263.invoice-ads-program.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001705; classtype:social-engineering; sid:6001705; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (admin-meta .busines-help-center .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"admin-meta.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001706; classtype:social-engineering; sid:6001706; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id19239256 .invoice-ads-program .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id19239256.invoice-ads-program.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001707; classtype:social-engineering; sid:6001707; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-security .com/E .29Bde8fMa9ZJCA)"; flow:established,to_server; http.uri; content:"/E.29Bde8fMa9ZJCA"; startswith; fast_pattern; http.host; content:"sso-security.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001708; classtype:social-engineering; sid:6001708; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile .nxvelh .top/pay/b_info .html)"; flow:established,to_server; http.uri; content:"/pay/b_info.html"; startswith; fast_pattern; http.host; content:"t-mobile.nxvelh.top"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001709; classtype:social-engineering; sid:6001709; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (729e49 .cn/mmixosct/)"; flow:established,to_server; http.uri; content:"/mmixosct/"; startswith; fast_pattern; http.host; content:"729e49.cn"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001710; classtype:social-engineering; sid:6001710; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member33 .agency-connection-hub .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member33.agency-connection-hub.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001711; classtype:social-engineering; sid:6001711; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vps140325 .inmotionhosting .com/sa .php)"; flow:established,to_server; http.uri; content:"/sa.php"; startswith; fast_pattern; http.host; content:"vps140325.inmotionhosting.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001712; classtype:social-engineering; sid:6001712; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ig .do/Blox-Fruits-private-Server-Code-32631241732343237023930417434378)"; flow:established,to_server; http.uri; content:"/Blox-Fruits-private-Server-Code-32631241732343237023930417434378"; startswith; fast_pattern; http.host; content:"ig.do"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001713; classtype:social-engineering; sid:6001713; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .strategycompliance .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.strategycompliance.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001714; classtype:social-engineering; sid:6001714; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (barclays-banking .net/landing/form/42cee885-454e-4e00-a090-3f8767effaf6)"; flow:established,to_server; http.uri; content:"/landing/form/42cee885-454e-4e00-a090-3f8767effaf6"; startswith; fast_pattern; http.host; content:"barclays-banking.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001715; classtype:social-engineering; sid:6001715; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-b1bc0deb082a43e7ac57352989f383e2 .r2 .dev/index .html?obf=oxcs&session=2831bbdd88b7fd51&usrn=orikx@24b48759403245a73ba5f4296815f480088b .com&client_ip=185 .98 .169 .18&ts=mtc3odi2njc1mw==&token=516d214e10ce)"; flow:established,to_server; http.uri; content:"/index.html?obf=oxcs&session=2831bbdd88b7fd51&usrn=orikx@24b48759403245a73ba5f4296815f480088b.com&client_ip=185.98.169.18&ts=mtc3odi2njc1mw==&token=516d214e10ce"; startswith; fast_pattern; http.host; content:"pub-b1bc0deb082a43e7ac57352989f383e2.r2.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001716; classtype:social-engineering; sid:6001716; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (barclays-banking .net/landing/form/c620a1c0-363c-4321-8095-90f4e084d35b)"; flow:established,to_server; http.uri; content:"/landing/form/c620a1c0-363c-4321-8095-90f4e084d35b"; startswith; fast_pattern; http.host; content:"barclays-banking.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001717; classtype:social-engineering; sid:6001717; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (barclays-banking .net/landing/form/d476527d-e94c-4440-9f88-010a98b3710a)"; flow:established,to_server; http.uri; content:"/landing/form/d476527d-e94c-4440-9f88-010a98b3710a"; startswith; fast_pattern; http.host; content:"barclays-banking.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001718; classtype:social-engineering; sid:6001718; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd .qtrplxmnvj .cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.qtrplxmnvj.cfd"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001719; classtype:social-engineering; sid:6001719; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (workingweekblessed-v7tzzbd59b .edgeone .cool/?eo_token=037beb0fdfdebd9269e61c45ac022617)"; flow:established,to_server; http.uri; content:"/?eo_token=037beb0fdfdebd9269e61c45ac022617"; startswith; fast_pattern; http.host; content:"workingweekblessed-v7tzzbd59b.edgeone.cool"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001720; classtype:social-engineering; sid:6001720; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (barclays-banking .net/landing/form/1336d6d3-914c-4471-907f-8c058cb049e4)"; flow:established,to_server; http.uri; content:"/landing/form/1336d6d3-914c-4471-907f-8c058cb049e4"; startswith; fast_pattern; http.host; content:"barclays-banking.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001721; classtype:social-engineering; sid:6001721; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-security .com/E .CBwIgE95oNhPQIxUSA)"; flow:established,to_server; http.uri; content:"/E.CBwIgE95oNhPQIxUSA"; startswith; fast_pattern; http.host; content:"sso-security.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001722; classtype:social-engineering; sid:6001722; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumento22 .s3 .us-east-005 .backblazeb2 .com/aumento .html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumento22.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001723; classtype:social-engineering; sid:6001723; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vama1089 .odns .fr/inodhl/auth/index .php)"; flow:established,to_server; http.uri; content:"/inodhl/auth/index.php"; startswith; fast_pattern; http.host; content:"vama1089.odns.fr"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001724; classtype:social-engineering; sid:6001724; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .curly-umbrella-alpha .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.curly-umbrella-alpha.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001725; classtype:social-engineering; sid:6001725; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verified-meta .busines-help-center .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"verified-meta.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001726; classtype:social-engineering; sid:6001726; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .borderclick .com/BC/media/Borderclick/Files/real-robux-codes .html)"; flow:established,to_server; http.uri; content:"/BC/media/Borderclick/Files/real-robux-codes.html"; startswith; fast_pattern; http.host; content:"www.borderclick.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001727; classtype:social-engineering; sid:6001727; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile .lmdzwk .top/pay?pIP=lxmjI?CBX=KCMtr)"; flow:established,to_server; http.uri; content:"/pay?pIP=lxmjI?CBX=KCMtr"; startswith; fast_pattern; http.host; content:"t-mobile.lmdzwk.top"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001728; classtype:social-engineering; sid:6001728; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hub-note-k4in .p-t2ctp0rk .workers .dev/lp/clGiyWtff48/)"; flow:established,to_server; http.uri; content:"/lp/clGiyWtff48/"; startswith; fast_pattern; http.host; content:"hub-note-k4in.p-t2ctp0rk.workers.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001729; classtype:social-engineering; sid:6001729; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd .qmntrvxjpl .cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.qmntrvxjpl.cfd"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001730; classtype:social-engineering; sid:6001730; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile .qwxzse .top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.qwxzse.top"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001731; classtype:social-engineering; sid:6001731; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (empresasenegocio .info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"empresasenegocio.info"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001732; classtype:social-engineering; sid:6001732; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile .loijkuj .top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.loijkuj.top"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001733; classtype:social-engineering; sid:6001733; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd .rtmzqjvxpl .cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.rtmzqjvxpl.cfd"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001734; classtype:social-engineering; sid:6001734; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd .olpknm-ie .vip/track/)"; flow:established,to_server; http.uri; content:"/track/"; startswith; fast_pattern; http.host; content:"dpd.olpknm-ie.vip"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001735; classtype:social-engineering; sid:6001735; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (multi-factor .link/E .sIZQOA8TixA)"; flow:established,to_server; http.uri; content:"/E.sIZQOA8TixA"; startswith; fast_pattern; http.host; content:"multi-factor.link"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001736; classtype:social-engineering; sid:6001736; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (access15 .agency-connect-profile .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"access15.agency-connect-profile.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001737; classtype:social-engineering; sid:6001737; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mon-espace-engie-pro-collectivite .online/messagerie-orange/orange/)"; flow:established,to_server; http.uri; content:"/messagerie-orange/orange/"; startswith; fast_pattern; http.host; content:"mon-espace-engie-pro-collectivite.online"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001738; classtype:social-engineering; sid:6001738; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www-mfacebook .com .vn/qyzgj6it5b)"; flow:established,to_server; http.uri; content:"/qyzgj6it5b"; startswith; fast_pattern; http.host; content:"www-mfacebook.com.vn"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001739; classtype:social-engineering; sid:6001739; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .mycom .cl/a/)"; flow:established,to_server; http.uri; content:"/a/"; startswith; fast_pattern; http.host; content:"www.mycom.cl"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001740; classtype:social-engineering; sid:6001740; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumento12 .s3 .us-east-005 .backblazeb2 .com/aumento .html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumento12.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001741; classtype:social-engineering; sid:6001741; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ozd .cfl .mybluehost .me/Mycss/mycss/)"; flow:established,to_server; http.uri; content:"/Mycss/mycss/"; startswith; fast_pattern; http.host; content:"ozd.cfl.mybluehost.me"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001742; classtype:social-engineering; sid:6001742; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (konto-aktualisiert-werden .sellarepartire .it/3cc08211d63465a33adec6f6cd376b10/?3cc08211d63465a33adec6f6cd376b10=yNnApML25lR&payer)"; flow:established,to_server; http.uri; content:"/3cc08211d63465a33adec6f6cd376b10/?3cc08211d63465a33adec6f6cd376b10=yNnApML25lR&payer"; startswith; fast_pattern; http.host; content:"konto-aktualisiert-werden.sellarepartire.it"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001743; classtype:social-engineering; sid:6001743; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .supplier-gas-elpiji .duckdns .org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.supplier-gas-elpiji.duckdns.org"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001744; classtype:social-engineering; sid:6001744; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dana .store-app .web .id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dana.store-app.web.id"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001745; classtype:social-engineering; sid:6001745; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (computcenters .abrdns .com/CA923064849/CA/)"; flow:established,to_server; http.uri; content:"/CA923064849/CA/"; startswith; fast_pattern; http.host; content:"computcenters.abrdns.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001746; classtype:social-engineering; sid:6001746; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .eazcp .buzz/ajZBIMcxx/br-pt/)"; flow:established,to_server; http.uri; content:"/ajZBIMcxx/br-pt/"; startswith; fast_pattern; http.host; content:"www.eazcp.buzz"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001747; classtype:social-engineering; sid:6001747; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile .vluhnf .top/pay?Opq=tvY0v?LlX=4T5Ma)"; flow:established,to_server; http.uri; content:"/pay?Opq=tvY0v?LlX=4T5Ma"; startswith; fast_pattern; http.host; content:"t-mobile.vluhnf.top"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001748; classtype:social-engineering; sid:6001748; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id2334 .agency-manager-support .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id2334.agency-manager-support.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001749; classtype:social-engineering; sid:6001749; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (very-meta .busines-help-center .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"very-meta.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001750; classtype:social-engineering; sid:6001750; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (credi-emprende-ec .xo .je/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"credi-emprende-ec.xo.je"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001751; classtype:social-engineering; sid:6001751; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (97ee6 .catex .at/cnbcard/cardentw .php)"; flow:established,to_server; http.uri; content:"/cnbcard/cardentw.php"; startswith; fast_pattern; http.host; content:"97ee6.catex.at"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001752; classtype:social-engineering; sid:6001752; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .site-zf94w2hnv .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.site-zf94w2hnv.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001753; classtype:social-engineering; sid:6001753; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id2338 .agency-manager-support .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id2338.agency-manager-support.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001754; classtype:social-engineering; sid:6001754; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd .plmnvxqjtr .cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.plmnvxqjtr.cfd"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001755; classtype:social-engineering; sid:6001755; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pancak-eswap .github .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pancak-eswap.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001756; classtype:social-engineering; sid:6001756; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .oldydoldyfacdevs .duckdns .org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.oldydoldyfacdevs.duckdns.org"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001757; classtype:social-engineering; sid:6001757; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (confirmed-meta .busines-help-center .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"confirmed-meta.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001758; classtype:social-engineering; sid:6001758; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (udev .informedgreetings .com/create-greeting)"; flow:established,to_server; http.uri; content:"/create-greeting"; startswith; fast_pattern; http.host; content:"udev.informedgreetings.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001759; classtype:social-engineering; sid:6001759; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bill-meta .busines-help-center .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bill-meta.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001760; classtype:social-engineering; sid:6001760; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .eavizer .com/portal)"; flow:established,to_server; http.uri; content:"/portal"; startswith; fast_pattern; http.host; content:"www.eavizer.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001761; classtype:social-engineering; sid:6001761; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile .estauf .top/pay/a_index .html)"; flow:established,to_server; http.uri; content:"/pay/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.estauf.top"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001762; classtype:social-engineering; sid:6001762; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (barclays-banking .net/landing/form/7d1c95f9-a4db-4ea4-a3b5-71952ab55d56)"; flow:established,to_server; http.uri; content:"/landing/form/7d1c95f9-a4db-4ea4-a3b5-71952ab55d56"; startswith; fast_pattern; http.host; content:"barclays-banking.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001763; classtype:social-engineering; sid:6001763; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hkg .whassg .top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hkg.whassg.top"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001764; classtype:social-engineering; sid:6001764; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .dervy .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.dervy.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001765; classtype:social-engineering; sid:6001765; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .hdef .online/Facebooksupport .CZ/)"; flow:established,to_server; http.uri; content:"/Facebooksupport.CZ/"; startswith; fast_pattern; http.host; content:"www.hdef.online"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001766; classtype:social-engineering; sid:6001766; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (itinfolibrary .com/techhub/gc-modernizing2703download .jsp)"; flow:established,to_server; http.uri; content:"/techhub/gc-modernizing2703download.jsp"; startswith; fast_pattern; http.host; content:"itinfolibrary.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001767; classtype:social-engineering; sid:6001767; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id19239259 .invoice-ads-program .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id19239259.invoice-ads-program.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001768; classtype:social-engineering; sid:6001768; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (technical-system-platform-service .pages .dev/heartily_welcome?id=686053434599538&page_name=Seguros%20Sanitas%20agente%20exclusivo%2035058/)"; flow:established,to_server; http.uri; content:"/heartily_welcome?id=686053434599538&page_name=Seguros%20Sanitas%20agente%20exclusivo%2035058/"; startswith; fast_pattern; http.host; content:"technical-system-platform-service.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001769; classtype:social-engineering; sid:6001769; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (invoice-billin .accounts-admin-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"invoice-billin.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001770; classtype:social-engineering; sid:6001770; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd .rdfgty-ie .org/track/)"; flow:established,to_server; http.uri; content:"/track/"; startswith; fast_pattern; http.host; content:"dpd.rdfgty-ie.org"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001771; classtype:social-engineering; sid:6001771; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (barclays-banking .net/landing/form/8264e407-a0db-4868-a4a3-a4a9731e1e69)"; flow:established,to_server; http.uri; content:"/landing/form/8264e407-a0db-4868-a4a3-a4a9731e1e69"; startswith; fast_pattern; http.host; content:"barclays-banking.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001772; classtype:social-engineering; sid:6001772; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile .nzghcp .top/pay?zIP=Lmitb?vMq=8HPs8)"; flow:established,to_server; http.uri; content:"/pay?zIP=Lmitb?vMq=8HPs8"; startswith; fast_pattern; http.host; content:"t-mobile.nzghcp.top"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001773; classtype:social-engineering; sid:6001773; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (invoice-syste .accounts-admin-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"invoice-syste.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001774; classtype:social-engineering; sid:6001774; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .dpdlocabb .cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.dpdlocabb.cyou"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001775; classtype:social-engineering; sid:6001775; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (email-y87mxhwnvfiu4wu2favff3t4dgthtbb4pm9jtpbfhlcjbnet .aynatv .news/OWafkwr/)"; flow:established,to_server; http.uri; content:"/OWafkwr/"; startswith; fast_pattern; http.host; content:"email-y87mxhwnvfiu4wu2favff3t4dgthtbb4pm9jtpbfhlcjbnet.aynatv.news"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001776; classtype:social-engineering; sid:6001776; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galabet-2026-giris-adresiniz .org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galabet-2026-giris-adresiniz.org"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001777; classtype:social-engineering; sid:6001777; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile .dxlfin .top/pay/a_shop .html)"; flow:established,to_server; http.uri; content:"/pay/a_shop.html"; startswith; fast_pattern; http.host; content:"t-mobile.dxlfin.top"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001778; classtype:social-engineering; sid:6001778; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-auth .com/E .TKE7Iu5m64o)"; flow:established,to_server; http.uri; content:"/E.TKE7Iu5m64o"; startswith; fast_pattern; http.host; content:"sso-auth.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001779; classtype:social-engineering; sid:6001779; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd .plokij-ie .link/track/)"; flow:established,to_server; http.uri; content:"/track/"; startswith; fast_pattern; http.host; content:"dpd.plokij-ie.link"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001780; classtype:social-engineering; sid:6001780; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kkuiiicnn110giin .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kkuiiicnn110giin.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001781; classtype:social-engineering; sid:6001781; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (khankhaznavik-spec .github .io/Face-book-Authentication/)"; flow:established,to_server; http.uri; content:"/Face-book-Authentication/"; startswith; fast_pattern; http.host; content:"khankhaznavik-spec.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001782; classtype:social-engineering; sid:6001782; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id19239261 .invoice-ads-program .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id19239261.invoice-ads-program.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001783; classtype:social-engineering; sid:6001783; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinit-gold .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinit-gold.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001784; classtype:social-engineering; sid:6001784; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (invoice-datat .accounts-admin-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"invoice-datat.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001785; classtype:social-engineering; sid:6001785; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (barclays-banking .net/landing/form/c936cf47-7665-4e88-b8a4-85c9fbca231c)"; flow:established,to_server; http.uri; content:"/landing/form/c936cf47-7665-4e88-b8a4-85c9fbca231c"; startswith; fast_pattern; http.host; content:"barclays-banking.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001786; classtype:social-engineering; sid:6001786; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile .ergdai .top/pay?DNk=rZRFn?kkB=e4Hgb)"; flow:established,to_server; http.uri; content:"/pay?DNk=rZRFn?kkB=e4Hgb"; startswith; fast_pattern; http.host; content:"t-mobile.ergdai.top"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001787; classtype:social-engineering; sid:6001787; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (barclays-banking .net/landing/form/1bf3e972-75f4-4d33-b9c5-963d4666e092)"; flow:established,to_server; http.uri; content:"/landing/form/1bf3e972-75f4-4d33-b9c5-963d4666e092"; startswith; fast_pattern; http.host; content:"barclays-banking.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001788; classtype:social-engineering; sid:6001788; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hr .apple-cl0ud .com/corporatepoll/new/homepage/dBvu/iia/97466415243419?rid=2hcTp5E)"; flow:established,to_server; http.uri; content:"/corporatepoll/new/homepage/dBvu/iia/97466415243419?rid=2hcTp5E"; startswith; fast_pattern; http.host; content:"hr.apple-cl0ud.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001789; classtype:social-engineering; sid:6001789; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17657 .invoice-ads-manager .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17657.invoice-ads-manager.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001790; classtype:social-engineering; sid:6001790; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-auth .com/E .Ro98KKVYoNdVyf4)"; flow:established,to_server; http.uri; content:"/E.Ro98KKVYoNdVyf4"; startswith; fast_pattern; http.host; content:"sso-auth.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001791; classtype:social-engineering; sid:6001791; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yagla .tv/cD6WWh2)"; flow:established,to_server; http.uri; content:"/cD6WWh2"; startswith; fast_pattern; http.host; content:"yagla.tv"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001792; classtype:social-engineering; sid:6001792; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile .gonuia .top/pay?nMw=Vrb3F?NAh=JAtXU)"; flow:established,to_server; http.uri; content:"/pay?nMw=Vrb3F?NAh=JAtXU"; startswith; fast_pattern; http.host; content:"t-mobile.gonuia.top"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001793; classtype:social-engineering; sid:6001793; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (barclays-banking .net/landing/form/6a4880f4-3ba5-4630-bd97-8421ef09c442)"; flow:established,to_server; http.uri; content:"/landing/form/6a4880f4-3ba5-4630-bd97-8421ef09c442"; startswith; fast_pattern; http.host; content:"barclays-banking.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001794; classtype:social-engineering; sid:6001794; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile .rwidlf .top/pay/b_info .html)"; flow:established,to_server; http.uri; content:"/pay/b_info.html"; startswith; fast_pattern; http.host; content:"t-mobile.rwidlf.top"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001795; classtype:social-engineering; sid:6001795; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .bitminetechcompliance .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bitminetechcompliance.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001796; classtype:social-engineering; sid:6001796; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mc .techdynamo .info/links/sAuJFRbZEauqKFkGxxDMsUZAfUAjdXMKFKGhXUPISuSMEfxckMCGhKynkMCAwDMkfkgXxDMchFXiMc/3652637/)"; flow:established,to_server; http.uri; content:"/links/sAuJFRbZEauqKFkGxxDMsUZAfUAjdXMKFKGhXUPISuSMEfxckMCGhKynkMCAwDMkfkgXxDMchFXiMc/3652637/"; startswith; fast_pattern; http.host; content:"mc.techdynamo.info"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001797; classtype:social-engineering; sid:6001797; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (techdynamo .info/reports/msft-howagent871 .html)"; flow:established,to_server; http.uri; content:"/reports/msft-howagent871.html"; startswith; fast_pattern; http.host; content:"techdynamo.info"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001798; classtype:social-engineering; sid:6001798; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dana-indonesia .help-official .biz .id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dana-indonesia.help-official.biz.id"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001799; classtype:social-engineering; sid:6001799; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (invoice-reportin .accounts-admin-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"invoice-reportin.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001800; classtype:social-engineering; sid:6001800; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie .lokalna-ofeta2 .shop/oferta/Xiaomi-17-Pro-256-GB/214503809)"; flow:established,to_server; http.uri; content:"/oferta/Xiaomi-17-Pro-256-GB/214503809"; startswith; fast_pattern; http.host; content:"allegrolokalnie.lokalna-ofeta2.shop"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001801; classtype:social-engineering; sid:6001801; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17662 .invoice-ads-manager .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17662.invoice-ads-manager.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001802; classtype:social-engineering; sid:6001802; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (windoww .b-cdn .net/11a .html?eta=falossys@b49bbf7db86c588a1447e3c1d57b7d54da54 .org/)"; flow:established,to_server; http.uri; content:"/11a.html?eta=falossys@b49bbf7db86c588a1447e3c1d57b7d54da54.org/"; startswith; fast_pattern; http.host; content:"windoww.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001803; classtype:social-engineering; sid:6001803; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd .parlometi .club/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.parlometi.club"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001804; classtype:social-engineering; sid:6001804; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1sh .pl/xlaKrj)"; flow:established,to_server; http.uri; content:"/xlaKrj"; startswith; fast_pattern; http.host; content:"1sh.pl"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001805; classtype:social-engineering; sid:6001805; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd .hjkmno-ie .icu/track/)"; flow:established,to_server; http.uri; content:"/track/"; startswith; fast_pattern; http.host; content:"dpd.hjkmno-ie.icu"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001806; classtype:social-engineering; sid:6001806; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mohsinabbas19 .github .io/fsh/)"; flow:established,to_server; http.uri; content:"/fsh/"; startswith; fast_pattern; http.host; content:"mohsinabbas19.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001807; classtype:social-engineering; sid:6001807; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .altriglifting .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.altriglifting.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001808; classtype:social-engineering; sid:6001808; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (access17 .agency-connect-profile .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"access17.agency-connect-profile.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001809; classtype:social-engineering; sid:6001809; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id19239258 .invoice-ads-program .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id19239258.invoice-ads-program.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001810; classtype:social-engineering; sid:6001810; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .reimagined-funicular-ivory .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.reimagined-funicular-ivory.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001811; classtype:social-engineering; sid:6001811; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (barclays-banking .net/landing/form/376d97c8-1405-4155-b718-73722204b418)"; flow:established,to_server; http.uri; content:"/landing/form/376d97c8-1405-4155-b718-73722204b418"; startswith; fast_pattern; http.host; content:"barclays-banking.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001812; classtype:social-engineering; sid:6001812; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (program-system .accounts-admin-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"program-system.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001813; classtype:social-engineering; sid:6001813; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (barclays-banking .net/landing/form/4bacd4e8-3d58-43aa-88ba-62afa565d3a0)"; flow:established,to_server; http.uri; content:"/landing/form/4bacd4e8-3d58-43aa-88ba-62afa565d3a0"; startswith; fast_pattern; http.host; content:"barclays-banking.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001814; classtype:social-engineering; sid:6001814; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (barclays-banking .net/landing/form/9de2e6dc-a562-43c9-8e54-2ec8b2cc81b0)"; flow:established,to_server; http.uri; content:"/landing/form/9de2e6dc-a562-43c9-8e54-2ec8b2cc81b0"; startswith; fast_pattern; http.host; content:"barclays-banking.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001815; classtype:social-engineering; sid:6001815; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (curly-umbrella-alpha .vercel .app/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"curly-umbrella-alpha.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001816; classtype:social-engineering; sid:6001816; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-auth .com/E .6t4fYqU33azMEm0S)"; flow:established,to_server; http.uri; content:"/E.6t4fYqU33azMEm0S"; startswith; fast_pattern; http.host; content:"sso-auth.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001817; classtype:social-engineering; sid:6001817; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member12 .agency-ad-meta .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member12.agency-ad-meta.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001818; classtype:social-engineering; sid:6001818; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mauanh .com .vn/rt8hiupv0pf)"; flow:established,to_server; http.uri; content:"/rt8hiupv0pf"; startswith; fast_pattern; http.host; content:"mauanh.com.vn"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001819; classtype:social-engineering; sid:6001819; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt .rtjpwe .cc/track/it)"; flow:established,to_server; http.uri; content:"/track/it"; startswith; fast_pattern; http.host; content:"brt.rtjpwe.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001820; classtype:social-engineering; sid:6001820; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (financialdept1 .com/?r=338663d4-6373-4413-b7b4-b497f8e9f4a5)"; flow:established,to_server; http.uri; content:"/?r=338663d4-6373-4413-b7b4-b497f8e9f4a5"; startswith; fast_pattern; http.host; content:"financialdept1.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001821; classtype:social-engineering; sid:6001821; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .pegakent .com .tr/Scripts/js/santntander-es/login .php)"; flow:established,to_server; http.uri; content:"/Scripts/js/santntander-es/login.php"; startswith; fast_pattern; http.host; content:"www.pegakent.com.tr"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001822; classtype:social-engineering; sid:6001822; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-auth .com/E .jKKss5CbxHH9hKyh)"; flow:established,to_server; http.uri; content:"/E.jKKss5CbxHH9hKyh"; startswith; fast_pattern; http.host; content:"sso-auth.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001823; classtype:social-engineering; sid:6001823; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-meta .busines-help-center .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"business-meta.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001824; classtype:social-engineering; sid:6001824; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (barclays-banking .net/landing/form/09bed885-8f34-4996-91d3-8e6be3aaa39f)"; flow:established,to_server; http.uri; content:"/landing/form/09bed885-8f34-4996-91d3-8e6be3aaa39f"; startswith; fast_pattern; http.host; content:"barclays-banking.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001825; classtype:social-engineering; sid:6001825; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coinabesperologinunqz .gitbook .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coinabesperologinunqz.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001826; classtype:social-engineering; sid:6001826; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (barclays-banking .net/landing/form/652e1755-3215-4d33-ad3a-b8a16444b4ba)"; flow:established,to_server; http.uri; content:"/landing/form/652e1755-3215-4d33-ad3a-b8a16444b4ba"; startswith; fast_pattern; http.host; content:"barclays-banking.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001827; classtype:social-engineering; sid:6001827; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s .teamfe .world/p/vwj-syw/hftjkjnc/)"; flow:established,to_server; http.uri; content:"/p/vwj-syw/hftjkjnc/"; startswith; fast_pattern; http.host; content:"s.teamfe.world"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001828; classtype:social-engineering; sid:6001828; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (health-management-checkup-list .s3 .ap-northeast-2 .amazonaws .com/New+life .html)"; flow:established,to_server; http.uri; content:"/New+life.html"; startswith; fast_pattern; http.host; content:"health-management-checkup-list.s3.ap-northeast-2.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001829; classtype:social-engineering; sid:6001829; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enrichsupplies .com/admin/)"; flow:established,to_server; http.uri; content:"/admin/"; startswith; fast_pattern; http.host; content:"enrichsupplies.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001830; classtype:social-engineering; sid:6001830; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .kkuiiicnn110giin .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kkuiiicnn110giin.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001831; classtype:social-engineering; sid:6001831; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member04 .agency-ad-meta .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member04.agency-ad-meta.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001832; classtype:social-engineering; sid:6001832; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store .workshopscommunityvoting .com/sharedfiles/filesdetails/id=3669539905/)"; flow:established,to_server; http.uri; content:"/sharedfiles/filesdetails/id=3669539905/"; startswith; fast_pattern; http.host; content:"store.workshopscommunityvoting.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001833; classtype:social-engineering; sid:6001833; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .hdef .online/Facebooksupport .CZ)"; flow:established,to_server; http.uri; content:"/Facebooksupport.CZ"; startswith; fast_pattern; http.host; content:"www.hdef.online"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001834; classtype:social-engineering; sid:6001834; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagramloginforyou .github .io/ig)"; flow:established,to_server; http.uri; content:"/ig"; startswith; fast_pattern; http.host; content:"instagramloginforyou.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001835; classtype:social-engineering; sid:6001835; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coinabesperologinunqz .gitbook .io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"coinabesperologinunqz.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001836; classtype:social-engineering; sid:6001836; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (barclays-banking .net/landing/form/cbe8ab16-ad05-4b7f-befc-a90b2409c007)"; flow:established,to_server; http.uri; content:"/landing/form/cbe8ab16-ad05-4b7f-befc-a90b2409c007"; startswith; fast_pattern; http.host; content:"barclays-banking.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001837; classtype:social-engineering; sid:6001837; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (barclays-banking .net/landing/form/8f3e535f-d24b-4f8c-98d0-0e088fbb11ec)"; flow:established,to_server; http.uri; content:"/landing/form/8f3e535f-d24b-4f8c-98d0-0e088fbb11ec"; startswith; fast_pattern; http.host; content:"barclays-banking.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001838; classtype:social-engineering; sid:6001838; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vr-codep .github .io/portalbancolseguro)"; flow:established,to_server; http.uri; content:"/portalbancolseguro"; startswith; fast_pattern; http.host; content:"vr-codep.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001839; classtype:social-engineering; sid:6001839; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail232770 .kmdastur .co/r?auth=7254b8790288357e)"; flow:established,to_server; http.uri; content:"/r?auth=7254b8790288357e"; startswith; fast_pattern; http.host; content:"webmail232770.kmdastur.co"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001840; classtype:social-engineering; sid:6001840; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qvfhwfh .ztvpanm .cn/apusetop/jupindx/)"; flow:established,to_server; http.uri; content:"/apusetop/jupindx/"; startswith; fast_pattern; http.host; content:"qvfhwfh.ztvpanm.cn"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001841; classtype:social-engineering; sid:6001841; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile .xezsqa .top/pay?HAu=pthI1?pTU=mXaFF)"; flow:established,to_server; http.uri; content:"/pay?HAu=pthI1?pTU=mXaFF"; startswith; fast_pattern; http.host; content:"t-mobile.xezsqa.top"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001842; classtype:social-engineering; sid:6001842; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vps140566 .inmotionhosting .com/my .php)"; flow:established,to_server; http.uri; content:"/my.php"; startswith; fast_pattern; http.host; content:"vps140566.inmotionhosting.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001843; classtype:social-engineering; sid:6001843; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .adaccount-validationcenter .me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.adaccount-validationcenter.me"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001844; classtype:social-engineering; sid:6001844; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m .galabetl075 .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.galabetl075.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001845; classtype:social-engineering; sid:6001845; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yagla .tv/clLHwaq)"; flow:established,to_server; http.uri; content:"/clLHwaq"; startswith; fast_pattern; http.host; content:"yagla.tv"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001846; classtype:social-engineering; sid:6001846; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (barclays-banking .net/landing/form/a7eec8ed-7f75-4c5e-a1b9-d387f2b8fef8)"; flow:established,to_server; http.uri; content:"/landing/form/a7eec8ed-7f75-4c5e-a1b9-d387f2b8fef8"; startswith; fast_pattern; http.host; content:"barclays-banking.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001847; classtype:social-engineering; sid:6001847; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member09 .marketing-agency-network .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member09.marketing-agency-network.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001848; classtype:social-engineering; sid:6001848; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fb100818292867939-8oai1rcr5viadkyc5tozt .vercel .app/uyrgsbnw534rhfsbdvz)"; flow:established,to_server; http.uri; content:"/uyrgsbnw534rhfsbdvz"; startswith; fast_pattern; http.host; content:"fb100818292867939-8oai1rcr5viadkyc5tozt.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001849; classtype:social-engineering; sid:6001849; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xyfvvfyy .elementor .cloud/PT/PT6898SFGCCD/BOBMSX02X1/index .html)"; flow:established,to_server; http.uri; content:"/PT/PT6898SFGCCD/BOBMSX02X1/index.html"; startswith; fast_pattern; http.host; content:"xyfvvfyy.elementor.cloud"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001850; classtype:social-engineering; sid:6001850; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webookmarks .com/story7110685/cisco-300-710-%E5%B0%82%E9%96%80%E7%9F%A5%E8%AD%98%E5%86%85%E5%AE%B9)"; flow:established,to_server; http.uri; content:"/story7110685/cisco-300-710-%E5%B0%82%E9%96%80%E7%9F%A5%E8%AD%98%E5%86%85%E5%AE%B9"; startswith; fast_pattern; http.host; content:"webookmarks.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001851; classtype:social-engineering; sid:6001851; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id19239260 .invoice-ads-program .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id19239260.invoice-ads-program.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001852; classtype:social-engineering; sid:6001852; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yagla .tv/cfHripR)"; flow:established,to_server; http.uri; content:"/cfHripR"; startswith; fast_pattern; http.host; content:"yagla.tv"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001853; classtype:social-engineering; sid:6001853; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id2333 .agency-manager-support .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id2333.agency-manager-support.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001854; classtype:social-engineering; sid:6001854; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-auth .com/E .niXDtItqV_QAQcryFQ)"; flow:established,to_server; http.uri; content:"/E.niXDtItqV_QAQcryFQ"; startswith; fast_pattern; http.host; content:"sso-auth.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001855; classtype:social-engineering; sid:6001855; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (barclays-banking .net/landing/form/0179ab4d-90f8-4293-abca-8b36e4fadfe9)"; flow:established,to_server; http.uri; content:"/landing/form/0179ab4d-90f8-4293-abca-8b36e4fadfe9"; startswith; fast_pattern; http.host; content:"barclays-banking.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001856; classtype:social-engineering; sid:6001856; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reimagined-funicular-ivory .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"reimagined-funicular-ivory.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001857; classtype:social-engineering; sid:6001857; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (danaaa-paylaaateerr .acdgx .my .id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"danaaa-paylaaateerr.acdgx.my.id"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001858; classtype:social-engineering; sid:6001858; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s .teamat .world/p/vsq-ner/iqnspgt/)"; flow:established,to_server; http.uri; content:"/p/vsq-ner/iqnspgt/"; startswith; fast_pattern; http.host; content:"s.teamat.world"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001859; classtype:social-engineering; sid:6001859; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile .ekpygh .top/pay/a_shop .html)"; flow:established,to_server; http.uri; content:"/pay/a_shop.html"; startswith; fast_pattern; http.host; content:"t-mobile.ekpygh.top"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001860; classtype:social-engineering; sid:6001860; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whats-doc .vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whats-doc.vip"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001861; classtype:social-engineering; sid:6001861; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (molar-canal .s3 .us-east-2 .amazonaws .com/Ochpdimpact .html)"; flow:established,to_server; http.uri; content:"/Ochpdimpact.html"; startswith; fast_pattern; http.host; content:"molar-canal.s3.us-east-2.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001862; classtype:social-engineering; sid:6001862; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd .plmntrxqjv .cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.plmntrxqjv.cfd"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001863; classtype:social-engineering; sid:6001863; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m .padisahbet-mayisguncelgiris .vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.padisahbet-mayisguncelgiris.vip"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001864; classtype:social-engineering; sid:6001864; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (triobm .xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"triobm.xyz"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001865; classtype:social-engineering; sid:6001865; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (update-billing-netflix .shekinahglory .co .zw/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"update-billing-netflix.shekinahglory.co.zw"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001866; classtype:social-engineering; sid:6001866; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (barclays-banking .net/landing/form/b930167f-77bc-4219-bff7-a0afcb7993cb)"; flow:established,to_server; http.uri; content:"/landing/form/b930167f-77bc-4219-bff7-a0afcb7993cb"; startswith; fast_pattern; http.host; content:"barclays-banking.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001867; classtype:social-engineering; sid:6001867; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .loogin-comndex .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.loogin-comndex.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001868; classtype:social-engineering; sid:6001868; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .dpdlocanm .cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.dpdlocanm.cyou"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001869; classtype:social-engineering; sid:6001869; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iwinaror .store/mysft/mic-main/)"; flow:established,to_server; http.uri; content:"/mysft/mic-main/"; startswith; fast_pattern; http.host; content:"iwinaror.store"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001870; classtype:social-engineering; sid:6001870; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (system-meta .busines-help-center .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"system-meta.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001871; classtype:social-engineering; sid:6001871; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (barclays-banking .net/landing/form/30b411f9-c716-4d61-9622-39374cf1511e)"; flow:established,to_server; http.uri; content:"/landing/form/30b411f9-c716-4d61-9622-39374cf1511e"; startswith; fast_pattern; http.host; content:"barclays-banking.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001872; classtype:social-engineering; sid:6001872; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .facebook-frontend-capstone .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-frontend-capstone.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001873; classtype:social-engineering; sid:6001873; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (companylegal .co .uk/?r=ecc59deb-c0b9-44f9-9caa-2860182468b6)"; flow:established,to_server; http.uri; content:"/?r=ecc59deb-c0b9-44f9-9caa-2860182468b6"; startswith; fast_pattern; http.host; content:"companylegal.co.uk"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001874; classtype:social-engineering; sid:6001874; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .update .youcreadio .cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.update.youcreadio.cfd"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001875; classtype:social-engineering; sid:6001875; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member329 .partner-business-hub .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member329.partner-business-hub.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001876; classtype:social-engineering; sid:6001876; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (option-meta .busines-help-center .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"option-meta.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001877; classtype:social-engineering; sid:6001877; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (channelhub .info/56a4fb6efe317947c5691bfc862q9d69151f .html)"; flow:established,to_server; http.uri; content:"/56a4fb6efe317947c5691bfc862q9d69151f.html"; startswith; fast_pattern; http.host; content:"channelhub.info"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001878; classtype:social-engineering; sid:6001878; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kucoinelogie .webflow .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kucoinelogie.webflow.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001879; classtype:social-engineering; sid:6001879; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .uzuhm .buzz/EOODLE/br-pt/)"; flow:established,to_server; http.uri; content:"/EOODLE/br-pt/"; startswith; fast_pattern; http.host; content:"www.uzuhm.buzz"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001880; classtype:social-engineering; sid:6001880; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile .jybzes .top/pay?eGv=YkP8q?Esb=iL80O)"; flow:established,to_server; http.uri; content:"/pay?eGv=YkP8q?Esb=iL80O"; startswith; fast_pattern; http.host; content:"t-mobile.jybzes.top"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001881; classtype:social-engineering; sid:6001881; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (14100 .xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"14100.xyz"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001882; classtype:social-engineering; sid:6001882; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oiupiguo .b-cdn .net/all1 .html?eta=belos7@0afd9f9c915cd03b98add412cc0c91b93f35 .com)"; flow:established,to_server; http.uri; content:"/all1.html?eta=belos7@0afd9f9c915cd03b98add412cc0c91b93f35.com"; startswith; fast_pattern; http.host; content:"oiupiguo.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001883; classtype:social-engineering; sid:6001883; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rhinhoodlogi-in .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rhinhoodlogi-in.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001884; classtype:social-engineering; sid:6001884; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile .gbiezk .top/pay?guI=rwhl5?qyT=mJSYs)"; flow:established,to_server; http.uri; content:"/pay?guI=rwhl5?qyT=mJSYs"; startswith; fast_pattern; http.host; content:"t-mobile.gbiezk.top"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001885; classtype:social-engineering; sid:6001885; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mc .techdynamo .info/links/sAuJFRbZEauqKFkGxxDMsUZAfUAjdXMKFKGhXUPISuSMEfxckMCGhKynkMCAwDMkfkgXxDMchFXiMc/3652635)"; flow:established,to_server; http.uri; content:"/links/sAuJFRbZEauqKFkGxxDMsUZAfUAjdXMKFKGhXUPISuSMEfxckMCGhKynkMCAwDMkfkgXxDMchFXiMc/3652635"; startswith; fast_pattern; http.host; content:"mc.techdynamo.info"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001886; classtype:social-engineering; sid:6001886; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .redirect-256b1065 .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.redirect-256b1065.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001887; classtype:social-engineering; sid:6001887; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .xfinit-gold .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfinit-gold.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001888; classtype:social-engineering; sid:6001888; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jacksonpaper-nc .com/verify-update)"; flow:established,to_server; http.uri; content:"/verify-update"; startswith; fast_pattern; http.host; content:"jacksonpaper-nc.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001889; classtype:social-engineering; sid:6001889; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .eavizer .com/awb-login/pRVAQ9gQYB/)"; flow:established,to_server; http.uri; content:"/awb-login/pRVAQ9gQYB/"; startswith; fast_pattern; http.host; content:"www.eavizer.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001890; classtype:social-engineering; sid:6001890; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd .xmrvbn-ie .vip/track/)"; flow:established,to_server; http.uri; content:"/track/"; startswith; fast_pattern; http.host; content:"dpd.xmrvbn-ie.vip"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001891; classtype:social-engineering; sid:6001891; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .adaccount-validationcenter .me/public/index?ref=business-support-center-DASDFDSYUYEE43FJDSHFSDFsetting%25popup%3fclient_id=889943718806-ual26tplnot2ea8b7n5t4p77keo8eb)"; flow:established,to_server; http.uri; content:"/public/index?ref=business-support-center-DASDFDSYUYEE43FJDSHFSDFsetting%25popup%3fclient_id=889943718806-ual26tplnot2ea8b7n5t4p77keo8eb"; startswith; fast_pattern; http.host; content:"www.adaccount-validationcenter.me"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001892; classtype:social-engineering; sid:6001892; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile .xdohsg .top/pay?PBb=ITNAl?ijB=WtyUe)"; flow:established,to_server; http.uri; content:"/pay?PBb=ITNAl?ijB=WtyUe"; startswith; fast_pattern; http.host; content:"t-mobile.xdohsg.top"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001893; classtype:social-engineering; sid:6001893; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hook .alwaysdata .net/VIP/facebook)"; flow:established,to_server; http.uri; content:"/VIP/facebook"; startswith; fast_pattern; http.host; content:"hook.alwaysdata.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001894; classtype:social-engineering; sid:6001894; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-7b9dc54f172c4efbb2c731d4aa2f884a .r2 .dev/index .html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-7b9dc54f172c4efbb2c731d4aa2f884a.r2.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001895; classtype:social-engineering; sid:6001895; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store .communitystartgame .shop/workshop/AK47-EternalDecay/)"; flow:established,to_server; http.uri; content:"/workshop/AK47-EternalDecay/"; startswith; fast_pattern; http.host; content:"store.communitystartgame.shop"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001896; classtype:social-engineering; sid:6001896; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8dx4wy .cn/mmixosct/)"; flow:established,to_server; http.uri; content:"/mmixosct/"; startswith; fast_pattern; http.host; content:"8dx4wy.cn"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001897; classtype:social-engineering; sid:6001897; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trustdappweb .web .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trustdappweb.web.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001898; classtype:social-engineering; sid:6001898; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yagla .tv/cpBo7Ta)"; flow:established,to_server; http.uri; content:"/cpBo7Ta"; startswith; fast_pattern; http.host; content:"yagla.tv"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001899; classtype:social-engineering; sid:6001899; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .wwbellca .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.wwbellca.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001900; classtype:social-engineering; sid:6001900; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (switchcarrierdeals .pages .dev/deals/att/)"; flow:established,to_server; http.uri; content:"/deals/att/"; startswith; fast_pattern; http.host; content:"switchcarrierdeals.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001901; classtype:social-engineering; sid:6001901; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dervy .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dervy.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001902; classtype:social-engineering; sid:6001902; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile .wrjxlt .top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wrjxlt.top"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001903; classtype:social-engineering; sid:6001903; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yagla .tv/cPjyBjw)"; flow:established,to_server; http.uri; content:"/cPjyBjw"; startswith; fast_pattern; http.host; content:"yagla.tv"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001904; classtype:social-engineering; sid:6001904; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (barclays-banking .net/landing/form/4da4cf61-1ca7-4f03-bbe1-ff9a103192dc)"; flow:established,to_server; http.uri; content:"/landing/form/4da4cf61-1ca7-4f03-bbe1-ff9a103192dc"; startswith; fast_pattern; http.host; content:"barclays-banking.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001905; classtype:social-engineering; sid:6001905; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile .qfozbv .top/pay/b_info .html)"; flow:established,to_server; http.uri; content:"/pay/b_info.html"; startswith; fast_pattern; http.host; content:"t-mobile.qfozbv.top"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001906; classtype:social-engineering; sid:6001906; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .update-billing-netflix .shekinahglory .co .zw/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.update-billing-netflix.shekinahglory.co.zw"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001907; classtype:social-engineering; sid:6001907; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (barclays-banking .net/landing/form/7bcb20db-71ef-4497-95b6-ba4887b12c7b)"; flow:established,to_server; http.uri; content:"/landing/form/7bcb20db-71ef-4497-95b6-ba4887b12c7b"; startswith; fast_pattern; http.host; content:"barclays-banking.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001908; classtype:social-engineering; sid:6001908; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (renewed-blue-nxwklyvz1l .edgeone .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"renewed-blue-nxwklyvz1l.edgeone.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001909; classtype:social-engineering; sid:6001909; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (barclays-banking .net/landing/form/cc8a285e-5a1a-4252-838c-17a61adb40cf)"; flow:established,to_server; http.uri; content:"/landing/form/cc8a285e-5a1a-4252-838c-17a61adb40cf"; startswith; fast_pattern; http.host; content:"barclays-banking.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001910; classtype:social-engineering; sid:6001910; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-auth .com/E .PXlhRpyc4cN-gQ)"; flow:established,to_server; http.uri; content:"/E.PXlhRpyc4cN-gQ"; startswith; fast_pattern; http.host; content:"sso-auth.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001911; classtype:social-engineering; sid:6001911; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fb100818292867939-8oai1rcr5viadkyc5tozt .vercel .app/uyrgsbnw534rhfsbdvz .html)"; flow:established,to_server; http.uri; content:"/uyrgsbnw534rhfsbdvz.html"; startswith; fast_pattern; http.host; content:"fb100818292867939-8oai1rcr5viadkyc5tozt.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001912; classtype:social-engineering; sid:6001912; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile .fbrdwi .top/pay?MPY=WfLhP?EbK=QUj2W)"; flow:established,to_server; http.uri; content:"/pay?MPY=WfLhP?EbK=QUj2W"; startswith; fast_pattern; http.host; content:"t-mobile.fbrdwi.top"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001913; classtype:social-engineering; sid:6001913; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sweet-credit-9cdf .pages .dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sweet-credit-9cdf.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001914; classtype:social-engineering; sid:6001914; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (program-shopee22 .blogspot .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"program-shopee22.blogspot.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001915; classtype:social-engineering; sid:6001915; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mpowerconsultlngllc .org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mpowerconsultlngllc.org"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001916; classtype:social-engineering; sid:6001916; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aarowingclub .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aarowingclub.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001917; classtype:social-engineering; sid:6001917; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zesty-begonia-8eecb4 .netlify .app/pass .html)"; flow:established,to_server; http.uri; content:"/pass.html"; startswith; fast_pattern; http.host; content:"zesty-begonia-8eecb4.netlify.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001918; classtype:social-engineering; sid:6001918; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (20gtw5fw .top/1ul311yx/G0trut/ovlzZZ)"; flow:established,to_server; http.uri; content:"/1ul311yx/G0trut/ovlzZZ"; startswith; fast_pattern; http.host; content:"20gtw5fw.top"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001919; classtype:social-engineering; sid:6001919; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (seblevqc .com/cgi-sys/suspendedpage .cgi)"; flow:established,to_server; http.uri; content:"/cgi-sys/suspendedpage.cgi"; startswith; fast_pattern; http.host; content:"seblevqc.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001920; classtype:social-engineering; sid:6001920; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2097lka .top/1ul311yx/G0trut/ovlzZZ)"; flow:established,to_server; http.uri; content:"/1ul311yx/G0trut/ovlzZZ"; startswith; fast_pattern; http.host; content:"2097lka.top"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001921; classtype:social-engineering; sid:6001921; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1784vxe .cfd/1ul311yx/G0trut/ovlzZZ)"; flow:established,to_server; http.uri; content:"/1ul311yx/G0trut/ovlzZZ"; startswith; fast_pattern; http.host; content:"1784vxe.cfd"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001922; classtype:social-engineering; sid:6001922; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (magentamailposteingang .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"magentamailposteingang.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001923; classtype:social-engineering; sid:6001923; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lite .evernote .com/note/def7c487-d207-e873-7d46-5b1bf924f520)"; flow:established,to_server; http.uri; content:"/note/def7c487-d207-e873-7d46-5b1bf924f520"; startswith; fast_pattern; http.host; content:"lite.evernote.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001924; classtype:social-engineering; sid:6001924; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3hv33d .cfd/1ul311yx/G0trut/ovlzZZ)"; flow:established,to_server; http.uri; content:"/1ul311yx/G0trut/ovlzZZ"; startswith; fast_pattern; http.host; content:"3hv33d.cfd"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001925; classtype:social-engineering; sid:6001925; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (seblevpqs .com/cgi-sys/suspendedpage .cgi)"; flow:established,to_server; http.uri; content:"/cgi-sys/suspendedpage.cgi"; startswith; fast_pattern; http.host; content:"seblevpqs.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001926; classtype:social-engineering; sid:6001926; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (securentuedutwteam .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"securentuedutwteam.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001927; classtype:social-engineering; sid:6001927; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jovial-longma-327171 .netlify .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jovial-longma-327171.netlify.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001928; classtype:social-engineering; sid:6001928; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7658945643 .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7658945643.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001929; classtype:social-engineering; sid:6001929; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .maxis .com .my/en/home/)"; flow:established,to_server; http.uri; content:"/en/home/"; startswith; fast_pattern; http.host; content:"www.maxis.com.my"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001930; classtype:social-engineering; sid:6001930; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (laforet .hub-26589538 .pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"laforet.hub-26589538.pro"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001931; classtype:social-engineering; sid:6001931; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vival .hub-26589538 .pro/captcha .php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"vival.hub-26589538.pro"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001932; classtype:social-engineering; sid:6001932; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reversemortgagesinbc .flywheelstaging .com/images/oguehyi/gofmyru/atpyld1/ccc/safe .html#random@random .com)"; flow:established,to_server; http.uri; content:"/images/oguehyi/gofmyru/atpyld1/ccc/safe.html#random@random.com"; startswith; fast_pattern; http.host; content:"reversemortgagesinbc.flywheelstaging.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001933; classtype:social-engineering; sid:6001933; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bgpnd2025 .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bgpnd2025.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001934; classtype:social-engineering; sid:6001934; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (supporttelkommail .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"supporttelkommail.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001935; classtype:social-engineering; sid:6001935; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (74-248-185-169 .cprapid .com/eu/date .php)"; flow:established,to_server; http.uri; content:"/eu/date.php"; startswith; fast_pattern; http.host; content:"74-248-185-169.cprapid.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001936; classtype:social-engineering; sid:6001936; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (duval .hub-26589538 .pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"duval.hub-26589538.pro"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001937; classtype:social-engineering; sid:6001937; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3907zke .top/1ul311yx/G0trut/ovlzZZ)"; flow:established,to_server; http.uri; content:"/1ul311yx/G0trut/ovlzZZ"; startswith; fast_pattern; http.host; content:"3907zke.top"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001938; classtype:social-engineering; sid:6001938; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sfrmessagerie .ddns-ip .net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sfrmessagerie.ddns-ip.net"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001939; classtype:social-engineering; sid:6001939; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shorturl .at/tojqB)"; flow:established,to_server; http.uri; content:"/tojqB"; startswith; fast_pattern; http.host; content:"shorturl.at"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001940; classtype:social-engineering; sid:6001940; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (admin-index-mail-dex .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"admin-index-mail-dex.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001941; classtype:social-engineering; sid:6001941; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro .pl-oferta09599223423 .sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.pl-oferta09599223423.sbs"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001942; classtype:social-engineering; sid:6001942; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (logicorreo .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"logicorreo.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001943; classtype:social-engineering; sid:6001943; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreihouuccj7whw7vebks2p2nmxvpqdb5ta6b35uc26zg445rnorscqu .ipfs .dweb .link/#random@random .com)"; flow:established,to_server; http.uri; content:"/#random@random.com"; startswith; fast_pattern; http.host; content:"bafkreihouuccj7whw7vebks2p2nmxvpqdb5ta6b35uc26zg445rnorscqu.ipfs.dweb.link"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001944; classtype:social-engineering; sid:6001944; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shorturl .at/sQxf0)"; flow:established,to_server; http.uri; content:"/sQxf0"; startswith; fast_pattern; http.host; content:"shorturl.at"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001945; classtype:social-engineering; sid:6001945; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faridlmath1778099897886 .1481832 .meusitehostgator .com .br/wp-includes/Requests/src/Auth/pko/vbb/pages/login .php)"; flow:established,to_server; http.uri; content:"/wp-includes/Requests/src/Auth/pko/vbb/pages/login.php"; startswith; fast_pattern; http.host; content:"faridlmath1778099897886.1481832.meusitehostgator.com.br"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001946; classtype:social-engineering; sid:6001946; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (colormusic .sgp1 .digitaloceanspaces .com/sunbooknature)"; flow:established,to_server; http.uri; content:"/sunbooknature"; startswith; fast_pattern; http.host; content:"colormusic.sgp1.digitaloceanspaces.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001947; classtype:social-engineering; sid:6001947; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (r1 .servicevigevano .it/?TMT037GK1=08LW46JNM)"; flow:established,to_server; http.uri; content:"/?TMT037GK1=08LW46JNM"; startswith; fast_pattern; http.host; content:"r1.servicevigevano.it"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001948; classtype:social-engineering; sid:6001948; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .hub-26589538 .pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hub-26589538.pro"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001949; classtype:social-engineering; sid:6001949; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qkj .huh .mybluehost .me/404 .html)"; flow:established,to_server; http.uri; content:"/404.html"; startswith; fast_pattern; http.host; content:"qkj.huh.mybluehost.me"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001950; classtype:social-engineering; sid:6001950; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .mytransporteur-pointmrelay .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mytransporteur-pointmrelay.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001951; classtype:social-engineering; sid:6001951; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (omgduintasiom .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"omgduintasiom.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001952; classtype:social-engineering; sid:6001952; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ben-jemaa .zy3852 .pro/as .php)"; flow:established,to_server; http.uri; content:"/as.php"; startswith; fast_pattern; http.host; content:"ben-jemaa.zy3852.pro"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001953; classtype:social-engineering; sid:6001953; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (livraison-pickup .com/check/calcul .php)"; flow:established,to_server; http.uri; content:"/check/calcul.php"; startswith; fast_pattern; http.host; content:"livraison-pickup.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001954; classtype:social-engineering; sid:6001954; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tortest1-nqvb .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tortest1-nqvb.vercel.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001955; classtype:social-engineering; sid:6001955; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie .534820f-g34 .shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.534820f-g34.shop"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001956; classtype:social-engineering; sid:6001956; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mytransporteur-pointmrelay .com/captcha .php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"mytransporteur-pointmrelay.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001957; classtype:social-engineering; sid:6001957; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fsyqa .com/wordpress/it)"; flow:established,to_server; http.uri; content:"/wordpress/it"; startswith; fast_pattern; http.host; content:"fsyqa.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001958; classtype:social-engineering; sid:6001958; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .direct-8812171 .pro/captcha .php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"www.direct-8812171.pro"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001959; classtype:social-engineering; sid:6001959; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (relacionamentoempresarial .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"relacionamentoempresarial.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001960; classtype:social-engineering; sid:6001960; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nafrokert .weebly .com/administratora .html)"; flow:established,to_server; http.uri; content:"/administratora.html"; startswith; fast_pattern; http.host; content:"nafrokert.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001961; classtype:social-engineering; sid:6001961; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pl .eu-mainside .com/pl)"; flow:established,to_server; http.uri; content:"/pl"; startswith; fast_pattern; http.host; content:"pl.eu-mainside.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001962; classtype:social-engineering; sid:6001962; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prairtesltbigp .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"prairtesltbigp.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001963; classtype:social-engineering; sid:6001963; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (skysoftmusic .nyc3 .digitaloceanspaces .com/funnaturecolor)"; flow:established,to_server; http.uri; content:"/funnaturecolor"; startswith; fast_pattern; http.host; content:"skysoftmusic.nyc3.digitaloceanspaces.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001964; classtype:social-engineering; sid:6001964; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mynew-update-mail .weeblysite .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mynew-update-mail.weeblysite.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001965; classtype:social-engineering; sid:6001965; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loginso .fr/Ameliz/Assurance-Maladie/)"; flow:established,to_server; http.uri; content:"/Ameliz/Assurance-Maladie/"; startswith; fast_pattern; http.host; content:"loginso.fr"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001966; classtype:social-engineering; sid:6001966; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loginso .fr/Ameliz/Assurance-Maladie)"; flow:established,to_server; http.uri; content:"/Ameliz/Assurance-Maladie"; startswith; fast_pattern; http.host; content:"loginso.fr"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001967; classtype:social-engineering; sid:6001967; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie .9329304g12-4g .lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.9329304g12-4g.lat"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001968; classtype:social-engineering; sid:6001968; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (espacedelasante .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"espacedelasante.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001969; classtype:social-engineering; sid:6001969; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shppebr-blue .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shppebr-blue.vercel.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001970; classtype:social-engineering; sid:6001970; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie .pl-050902-oferta .shop/aparat-canon-eos-m50-mark-ii-o/78834)"; flow:established,to_server; http.uri; content:"/aparat-canon-eos-m50-mark-ii-o/78834"; startswith; fast_pattern; http.host; content:"allegrolokalnie.pl-050902-oferta.shop"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001971; classtype:social-engineering; sid:6001971; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s .raumwerk-reichel .de/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"s.raumwerk-reichel.de"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001972; classtype:social-engineering; sid:6001972; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bertran .direct-8812171 .pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bertran.direct-8812171.pro"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001973; classtype:social-engineering; sid:6001973; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie .polk78920643-230 .lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.polk78920643-230.lat"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001974; classtype:social-engineering; sid:6001974; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kyc .digitalmps .app/pri-login/SG_q9yHlm4g/login .php?rand=4groeukflzwl7vhv&\;mod=1)"; flow:established,to_server; http.uri; content:"/pri-login/SG_q9yHlm4g/login.php?rand=4groeukflzwl7vhv&|3b|mod=1"; startswith; fast_pattern; http.host; content:"kyc.digitalmps.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001975; classtype:social-engineering; sid:6001975; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .staypuglia .com/wp-aruba/#cmFuZG9tQHJhbmRvbS5jb20=)"; flow:established,to_server; http.uri; content:"/wp-aruba/#cmFuZG9tQHJhbmRvbS5jb20="; startswith; fast_pattern; http.host; content:"www.staypuglia.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001976; classtype:social-engineering; sid:6001976; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lbpiaccess-web-app .shares .zrok .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lbpiaccess-web-app.shares.zrok.io"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001977; classtype:social-engineering; sid:6001977; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gov .consultaimediatacpf .org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gov.consultaimediatacpf.org"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001978; classtype:social-engineering; sid:6001978; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (almarexhaust .com/nhs .uk/)"; flow:established,to_server; http.uri; content:"/nhs.uk/"; startswith; fast_pattern; http.host; content:"almarexhaust.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001979; classtype:social-engineering; sid:6001979; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info .mailer .testbook .com/BAKREVOJUT?id=178324=dxpUVVQKAVNQTVUCAVcFBQhQVVALUgBTAVAMBFRSCgcHUFxRAAoEVwUBBwJXB1QPDQJPUlEdW1hED0F3UAhZCFhIBwsOTgNWUwlQVVwGAAUAAAQEAQEOS14VQEdEXxdOXQgCC01fUwgIVBZIEFRFQlpaXFgcUFdaGSN1fGUgbi5+MzBbClZOF1c=&\;fl=XBIQFBAIHU4BXAUPCBxFWFtTHlBdXVZSVRUaVFgI)"; flow:established,to_server; http.uri; content:"/BAKREVOJUT?id=178324=dxpUVVQKAVNQTVUCAVcFBQhQVVALUgBTAVAMBFRSCgcHUFxRAAoEVwUBBwJXB1QPDQJPUlEdW1hED0F3UAhZCFhIBwsOTgNWUwlQVVwGAAUAAAQEAQEOS14VQEdEXxdOXQgCC01fUwgIVBZIEFRFQlpaXFgcUFdaGSN1fGUgbi5+MzBbClZOF1c=&|3b|fl=XBIQFBAIHU4BXAUPCBxFWFtTHlBdXVZSVRUaVFgI"; startswith; fast_pattern; http.host; content:"info.mailer.testbook.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001980; classtype:social-engineering; sid:6001980; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (restark .z13 .web .core .windows .net/pch .html)"; flow:established,to_server; http.uri; content:"/pch.html"; startswith; fast_pattern; http.host; content:"restark.z13.web.core.windows.net"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001981; classtype:social-engineering; sid:6001981; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (marlo .direct-8812171 .pro/captcha .php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"marlo.direct-8812171.pro"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001982; classtype:social-engineering; sid:6001982; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr .ee/MiOiT2)"; flow:established,to_server; http.uri; content:"/MiOiT2"; startswith; fast_pattern; http.host; content:"tr.ee"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001983; classtype:social-engineering; sid:6001983; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (louchagne .direct-8812171 .pro/captcha .php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"louchagne.direct-8812171.pro"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001984; classtype:social-engineering; sid:6001984; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie .pl/o/oferta/Xiaomi-17-Pro-256-GB/214503809)"; flow:established,to_server; http.uri; content:"/o/oferta/Xiaomi-17-Pro-256-GB/214503809"; startswith; fast_pattern; http.host; content:"allegrolokalnie.pl"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001985; classtype:social-engineering; sid:6001985; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ohbestdayever .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ohbestdayever.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001986; classtype:social-engineering; sid:6001986; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help-KoV9Vv .dansopschool .nl/swiss/)"; flow:established,to_server; http.uri; content:"/swiss/"; startswith; fast_pattern; http.host; content:"help-kov9vv.dansopschool.nl"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001987; classtype:social-engineering; sid:6001987; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (marlo .direct-8812171 .pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"marlo.direct-8812171.pro"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001988; classtype:social-engineering; sid:6001988; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (taxe-dedouanement .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"taxe-dedouanement.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001989; classtype:social-engineering; sid:6001989; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (picpay-roleta .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"picpay-roleta.vercel.app"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6001990; classtype:social-engineering; sid:6001990; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kgq.glj.mybluehost.me/wp-includes/assets/de/ATT/us/index.asp.php?579aa8b2451293fc87c1f61b87b4c034)"; flow:established,to_server; http.uri; content:"/wp-includes/assets/de/ATT/us/index.asp.php?579aa8b2451293fc87c1f61b87b4c034"; startswith; fast_pattern; http.host; content:"kgq.glj.mybluehost.me"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001991; classtype:social-engineering; sid:6001991; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netempresapjcontato.digital/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netempresapjcontato.digital"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001992; classtype:social-engineering; sid:6001992; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instant-apply-get-free-verified.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instant-apply-get-free-verified.surge.sh"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001993; classtype:social-engineering; sid:6001993; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paypay-card.trtwowf.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paypay-card.trtwowf.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001994; classtype:social-engineering; sid:6001994; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (93ai.mobi/dfg/efdg/reg/dfg/d7/)"; flow:established,to_server; http.uri; content:"/dfg/efdg/reg/dfg/d7/"; startswith; fast_pattern; http.host; content:"93ai.mobi"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001995; classtype:social-engineering; sid:6001995; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (simuladorpichinchapro.zya.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"simuladorpichinchapro.zya.me"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001996; classtype:social-engineering; sid:6001996; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oegk.meineogk-at.site/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"oegk.meineogk-at.site"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001997; classtype:social-engineering; sid:6001997; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meine99.meineblank99-at.site/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"meine99.meineblank99-at.site"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001998; classtype:social-engineering; sid:6001998; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atualize-netempresa.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"atualize-netempresa.info"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001999; classtype:social-engineering; sid:6001999; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mctegypt.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mctegypt.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002000; classtype:social-engineering; sid:6002000; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netlixrenouvellement.my/pages/captcha.php)"; flow:established,to_server; http.uri; content:"/pages/captcha.php"; startswith; fast_pattern; http.host; content:"netlixrenouvellement.my"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002001; classtype:social-engineering; sid:6002001; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lzkdcr.top/pay?xml=QCVYf?YXA=hCgI2)"; flow:established,to_server; http.uri; content:"/pay?xml=QCVYf?YXA=hCgI2"; startswith; fast_pattern; http.host; content:"t-mobile.lzkdcr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002002; classtype:social-engineering; sid:6002002; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nerdesnzbenbendeufndd74278r88e91ro3.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nerdesnzbenbendeufndd74278r88e91ro3.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002003; classtype:social-engineering; sid:6002003; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.uklvhb.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.uklvhb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002004; classtype:social-engineering; sid:6002004; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ivyqup.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ivyqup.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002005; classtype:social-engineering; sid:6002005; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reactivar-outlook365.iceiy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"reactivar-outlook365.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002006; classtype:social-engineering; sid:6002006; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b35aaa.com/fish/260)"; flow:established,to_server; http.uri; content:"/fish/260"; startswith; fast_pattern; http.host; content:"b35aaa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002007; classtype:social-engineering; sid:6002007; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gilknz.top/pay?oyA=nAhrB?znQ=HCQoO)"; flow:established,to_server; http.uri; content:"/pay?oyA=nAhrB?znQ=HCQoO"; startswith; fast_pattern; http.host; content:"t-mobile.gilknz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002008; classtype:social-engineering; sid:6002008; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ypsalm.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ypsalm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002009; classtype:social-engineering; sid:6002009; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hjllop.top/pay?yMi=ndjqi?odh=pK7Jw)"; flow:established,to_server; http.uri; content:"/pay?yMi=ndjqi?odh=pK7Jw"; startswith; fast_pattern; http.host; content:"t-mobile.hjllop.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002010; classtype:social-engineering; sid:6002010; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.twudnj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.twudnj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002011; classtype:social-engineering; sid:6002011; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiackahjsbfnc2ncov3pef52rrtqs5i2bdmfpm4ranevpvg6d34u64.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiackahjsbfnc2ncov3pef52rrtqs5i2bdmfpm4ranevpvg6d34u64.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002012; classtype:social-engineering; sid:6002012; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.sogczk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.sogczk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002013; classtype:social-engineering; sid:6002013; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ksfheb.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ksfheb.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002014; classtype:social-engineering; sid:6002014; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiga6px3lueaki24tsx4oi7kdavctjkxpiobmcqllnr2duqahghtoa.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiga6px3lueaki24tsx4oi7kdavctjkxpiobmcqllnr2duqahghtoa.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002015; classtype:social-engineering; sid:6002015; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deerpark.spahotel.guru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"deerpark.spahotel.guru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002016; classtype:social-engineering; sid:6002016; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.awvgkz.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.awvgkz.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002017; classtype:social-engineering; sid:6002017; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pfgvcw.top/pay?SYX=m8vZa?Wvl=FFTOQ)"; flow:established,to_server; http.uri; content:"/pay?SYX=m8vZa?Wvl=FFTOQ"; startswith; fast_pattern; http.host; content:"t-mobile.pfgvcw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002018; classtype:social-engineering; sid:6002018; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id99998.agency-manager-support.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id99998.agency-manager-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002019; classtype:social-engineering; sid:6002019; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17698.invoice-ads-manager.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17698.invoice-ads-manager.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002020; classtype:social-engineering; sid:6002020; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sana-khan2776.github.io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"sana-khan2776.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002021; classtype:social-engineering; sid:6002021; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17693.invoice-ads-manager.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17693.invoice-ads-manager.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002022; classtype:social-engineering; sid:6002022; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblotx.co/users/1359609853/profile)"; flow:established,to_server; http.uri; content:"/users/1359609853/profile"; startswith; fast_pattern; http.host; content:"roblotx.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002023; classtype:social-engineering; sid:6002023; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (grartfixstudio-commits.github.io/Bank_of_America/)"; flow:established,to_server; http.uri; content:"/Bank_of_America/"; startswith; fast_pattern; http.host; content:"grartfixstudio-commits.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002024; classtype:social-engineering; sid:6002024; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jtinas.top/pay?rvr=dgR5K?xXI=gFUfa)"; flow:established,to_server; http.uri; content:"/pay?rvr=dgR5K?xXI=gFUfa"; startswith; fast_pattern; http.host; content:"t-mobile.jtinas.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002025; classtype:social-engineering; sid:6002025; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.olqsuw.top/pay?jpK=jOtWa?NUw=h5Yxl)"; flow:established,to_server; http.uri; content:"/pay?jpK=jOtWa?NUw=h5Yxl"; startswith; fast_pattern; http.host; content:"t-mobile.olqsuw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002026; classtype:social-engineering; sid:6002026; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jqiltd.top/pay?oqn=rd5w7?AmS=LevAd)"; flow:established,to_server; http.uri; content:"/pay?oqn=rd5w7?AmS=LevAd"; startswith; fast_pattern; http.host; content:"t-mobile.jqiltd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002027; classtype:social-engineering; sid:6002027; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ukvgdb.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ukvgdb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002028; classtype:social-engineering; sid:6002028; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hwsmpz.top/pay?MJN=79xv6?yxX=X1xSB)"; flow:established,to_server; http.uri; content:"/pay?MJN=79xv6?yxX=X1xSB"; startswith; fast_pattern; http.host; content:"t-mobile.hwsmpz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002029; classtype:social-engineering; sid:6002029; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.djoywg.top/pay?oeF=9kk6w?Ftr=UU1kJ)"; flow:established,to_server; http.uri; content:"/pay?oeF=9kk6w?Ftr=UU1kJ"; startswith; fast_pattern; http.host; content:"t-mobile.djoywg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002030; classtype:social-engineering; sid:6002030; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (incxz-ld.anym.biz.id/xid/p6/login.php)"; flow:established,to_server; http.uri; content:"/xid/p6/login.php"; startswith; fast_pattern; http.host; content:"incxz-ld.anym.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002031; classtype:social-engineering; sid:6002031; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (core-access.partner-programhub.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"core-access.partner-programhub.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002032; classtype:social-engineering; sid:6002032; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wmvnkd.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wmvnkd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002033; classtype:social-engineering; sid:6002033; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wechath5.westernunion.cloud/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wechath5.westernunion.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002034; classtype:social-engineering; sid:6002034; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (to.lk/CnuiRd)"; flow:established,to_server; http.uri; content:"/CnuiRd"; startswith; fast_pattern; http.host; content:"to.lk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002035; classtype:social-engineering; sid:6002035; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xrgosh.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xrgosh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002036; classtype:social-engineering; sid:6002036; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tinu.be/www.rblox.prflie.com)"; flow:established,to_server; http.uri; content:"/www.rblox.prflie.com"; startswith; fast_pattern; http.host; content:"www.tinu.be"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002037; classtype:social-engineering; sid:6002037; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (customer-sp-alexk.pages.dev/help/contact/845811820275247)"; flow:established,to_server; http.uri; content:"/help/contact/845811820275247"; startswith; fast_pattern; http.host; content:"customer-sp-alexk.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002038; classtype:social-engineering; sid:6002038; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (doeusignsafe.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"doeusignsafe.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002039; classtype:social-engineering; sid:6002039; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (partner-gateway.partner-programhub.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"partner-gateway.partner-programhub.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002040; classtype:social-engineering; sid:6002040; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (epass-ec7af8f39e70.s3.amazonaws.com/index.html?email=example@invalid.local)"; flow:established,to_server; http.uri; content:"/index.html?email=example@invalid.local"; startswith; fast_pattern; http.host; content:"epass-ec7af8f39e70.s3.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002041; classtype:social-engineering; sid:6002041; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.prlsuy.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.prlsuy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002042; classtype:social-engineering; sid:6002042; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smamanoor79-stack.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"smamanoor79-stack.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002043; classtype:social-engineering; sid:6002043; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.oybepr.top/pay?UTi=OsxsH?xnp=YBmJV)"; flow:established,to_server; http.uri; content:"/pay?UTi=OsxsH?xnp=YBmJV"; startswith; fast_pattern; http.host; content:"t-mobile.oybepr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002044; classtype:social-engineering; sid:6002044; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kojcfu.top/pay?yzw=rk1ey?hkn=vSWF6)"; flow:established,to_server; http.uri; content:"/pay?yzw=rk1ey?hkn=vSWF6"; startswith; fast_pattern; http.host; content:"t-mobile.kojcfu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002045; classtype:social-engineering; sid:6002045; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth-secure.me/E.mVC-Eh1CYeJ5zfx1kg)"; flow:established,to_server; http.uri; content:"/E.mVC-Eh1CYeJ5zfx1kg"; startswith; fast_pattern; http.host; content:"auth-secure.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002046; classtype:social-engineering; sid:6002046; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gvwspn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gvwspn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002047; classtype:social-engineering; sid:6002047; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nfkiyz.top/pay?Pbs=2XtZn?Xzr=Ew1v3)"; flow:established,to_server; http.uri; content:"/pay?Pbs=2XtZn?Xzr=Ew1v3"; startswith; fast_pattern; http.host; content:"t-mobile.nfkiyz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002048; classtype:social-engineering; sid:6002048; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mxrkag.top/pay?QHy=70O38?Squ=l8O7r)"; flow:established,to_server; http.uri; content:"/pay?QHy=70O38?Squ=l8O7r"; startswith; fast_pattern; http.host; content:"t-mobile.mxrkag.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002049; classtype:social-engineering; sid:6002049; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (customer-sp-alexk.pages.dev/help/contact/282824571426767)"; flow:established,to_server; http.uri; content:"/help/contact/282824571426767"; startswith; fast_pattern; http.host; content:"customer-sp-alexk.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002050; classtype:social-engineering; sid:6002050; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.smikea.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.smikea.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002051; classtype:social-engineering; sid:6002051; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hxvkoj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hxvkoj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002052; classtype:social-engineering; sid:6002052; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fbcloned.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fbcloned.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002053; classtype:social-engineering; sid:6002053; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1405qzrwml.adcampaign-identitycontrolgrid.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1405qzrwml.adcampaign-identitycontrolgrid.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002054; classtype:social-engineering; sid:6002054; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.oeaxvv.top/pay?iuz=iTQf6?VLG=HZsGC)"; flow:established,to_server; http.uri; content:"/pay?iuz=iTQf6?VLG=HZsGC"; startswith; fast_pattern; http.host; content:"t-mobile.oeaxvv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002055; classtype:social-engineering; sid:6002055; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (customer-sp-alexk.pages.dev/help/contact/870369684859151)"; flow:established,to_server; http.uri; content:"/help/contact/870369684859151"; startswith; fast_pattern; http.host; content:"customer-sp-alexk.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002056; classtype:social-engineering; sid:6002056; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblotx.co/charts)"; flow:established,to_server; http.uri; content:"/charts"; startswith; fast_pattern; http.host; content:"roblotx.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002057; classtype:social-engineering; sid:6002057; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hxpvto.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hxpvto.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002058; classtype:social-engineering; sid:6002058; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lafqre.top/pay?Dzb=kswd1?nXD=Z6Rim)"; flow:established,to_server; http.uri; content:"/pay?Dzb=kswd1?nXD=Z6Rim"; startswith; fast_pattern; http.host; content:"t-mobile.lafqre.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002059; classtype:social-engineering; sid:6002059; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member327.partner-invite-business-hub.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member327.partner-invite-business-hub.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002060; classtype:social-engineering; sid:6002060; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblotx.co/login?returlUrl=334614924)"; flow:established,to_server; http.uri; content:"/login?returlUrl=334614924"; startswith; fast_pattern; http.host; content:"roblotx.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002061; classtype:social-engineering; sid:6002061; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.uptajw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.uptajw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002062; classtype:social-engineering; sid:6002062; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dgpn-crypto.fr/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dgpn-crypto.fr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002063; classtype:social-engineering; sid:6002063; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.wadtsh.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.wadtsh.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002064; classtype:social-engineering; sid:6002064; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.sypzma.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.sypzma.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002065; classtype:social-engineering; sid:6002065; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rbzuid.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rbzuid.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002066; classtype:social-engineering; sid:6002066; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member517.center-meta-agency.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member517.center-meta-agency.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002067; classtype:social-engineering; sid:6002067; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17697.invoice-ads-manager.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17697.invoice-ads-manager.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002068; classtype:social-engineering; sid:6002068; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.aqvmjh.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.aqvmjh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002069; classtype:social-engineering; sid:6002069; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qtdryv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qtdryv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002070; classtype:social-engineering; sid:6002070; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (contribuinte2026.icu/v/peda/)"; flow:established,to_server; http.uri; content:"/v/peda/"; startswith; fast_pattern; http.host; content:"contribuinte2026.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002071; classtype:social-engineering; sid:6002071; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jtinas.top/pay?JPk=Wbmbu?Bct=loZaK)"; flow:established,to_server; http.uri; content:"/pay?JPk=Wbmbu?Bct=loZaK"; startswith; fast_pattern; http.host; content:"t-mobile.jtinas.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002072; classtype:social-engineering; sid:6002072; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.guvqyk.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.guvqyk.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002073; classtype:social-engineering; sid:6002073; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.iqocdq.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.iqocdq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002074; classtype:social-engineering; sid:6002074; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rvhday.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rvhday.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002075; classtype:social-engineering; sid:6002075; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id99996.agency-manager-support.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id99996.agency-manager-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002076; classtype:social-engineering; sid:6002076; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dunh1ll.github.io/Netflix-clone)"; flow:established,to_server; http.uri; content:"/Netflix-clone"; startswith; fast_pattern; http.host; content:"dunh1ll.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002077; classtype:social-engineering; sid:6002077; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (premiata.rest/premiata)"; flow:established,to_server; http.uri; content:"/premiata"; startswith; fast_pattern; http.host; content:"premiata.rest"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002078; classtype:social-engineering; sid:6002078; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aracfiyatlari.com.tr/xifix/xinfini/)"; flow:established,to_server; http.uri; content:"/xifix/xinfini/"; startswith; fast_pattern; http.host; content:"aracfiyatlari.com.tr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002079; classtype:social-engineering; sid:6002079; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (novoaumentoemergencial.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"novoaumentoemergencial.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002080; classtype:social-engineering; sid:6002080; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gwnivh.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gwnivh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002081; classtype:social-engineering; sid:6002081; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-user3282.program-ads-agency.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-user3282.program-ads-agency.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002082; classtype:social-engineering; sid:6002082; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pfvbyw.top/pay?JPY=BAWTQ?WOn=R3hIL)"; flow:established,to_server; http.uri; content:"/pay?JPY=BAWTQ?WOn=R3hIL"; startswith; fast_pattern; http.host; content:"t-mobile.pfvbyw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002083; classtype:social-engineering; sid:6002083; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth-secure.me/E.3d1GYocKR07Z)"; flow:established,to_server; http.uri; content:"/E.3d1GYocKR07Z"; startswith; fast_pattern; http.host; content:"auth-secure.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002084; classtype:social-engineering; sid:6002084; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-final.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-final.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002085; classtype:social-engineering; sid:6002085; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.evuvql.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.evuvql.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002086; classtype:social-engineering; sid:6002086; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b891886.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b891886.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002087; classtype:social-engineering; sid:6002087; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (choamdeugia.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"choamdeugia.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002088; classtype:social-engineering; sid:6002088; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zplivg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zplivg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002089; classtype:social-engineering; sid:6002089; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ovefav.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ovefav.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002090; classtype:social-engineering; sid:6002090; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jzvamq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jzvamq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002091; classtype:social-engineering; sid:6002091; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id358.agency-manager-support.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id358.agency-manager-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002092; classtype:social-engineering; sid:6002092; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.odlcmp.top/pay?Djl=mNPtl?nCL=1y2oz)"; flow:established,to_server; http.uri; content:"/pay?Djl=mNPtl?nCL=1y2oz"; startswith; fast_pattern; http.host; content:"t-mobile.odlcmp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002093; classtype:social-engineering; sid:6002093; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (to.lk/AnRcYL)"; flow:established,to_server; http.uri; content:"/AnRcYL"; startswith; fast_pattern; http.host; content:"to.lk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002094; classtype:social-engineering; sid:6002094; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vmxlgz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vmxlgz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002095; classtype:social-engineering; sid:6002095; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.swdcpr.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.swdcpr.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002096; classtype:social-engineering; sid:6002096; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fbkjmq.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fbkjmq.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002097; classtype:social-engineering; sid:6002097; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mi-rushang.github.io/instagram.com/)"; flow:established,to_server; http.uri; content:"/instagram.com/"; startswith; fast_pattern; http.host; content:"mi-rushang.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002098; classtype:social-engineering; sid:6002098; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qtvndf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qtvndf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002099; classtype:social-engineering; sid:6002099; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id99999.agency-manager-support.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id99999.agency-manager-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002100; classtype:social-engineering; sid:6002100; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.euvwkf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.euvwkf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002101; classtype:social-engineering; sid:6002101; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vlhevc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vlhevc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002102; classtype:social-engineering; sid:6002102; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hznodi.top/pay?jvA=dl5Yk?sAQ=u8aLM)"; flow:established,to_server; http.uri; content:"/pay?jvA=dl5Yk?sAQ=u8aLM"; startswith; fast_pattern; http.host; content:"t-mobile.hznodi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002103; classtype:social-engineering; sid:6002103; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.revolusysinc.com/tcgc/)"; flow:established,to_server; http.uri; content:"/tcgc/"; startswith; fast_pattern; http.host; content:"www.revolusysinc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002104; classtype:social-engineering; sid:6002104; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qstvlz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qstvlz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002105; classtype:social-engineering; sid:6002105; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.heinvu.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app.heinvu.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002106; classtype:social-engineering; sid:6002106; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreia5ut2wehdsd2ya7pjtixidtkrtn5eee3p6vdwkxzf2opo54kuutm.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreia5ut2wehdsd2ya7pjtixidtkrtn5eee3p6vdwkxzf2opo54kuutm.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002107; classtype:social-engineering; sid:6002107; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.iylpkv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.iylpkv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002108; classtype:social-engineering; sid:6002108; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (continue-book-call.com/facebook/login?t=1778819297666)"; flow:established,to_server; http.uri; content:"/facebook/login?t=1778819297666"; startswith; fast_pattern; http.host; content:"continue-book-call.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002109; classtype:social-engineering; sid:6002109; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (outlook-office365.protect-login.com/landing/form/f63276bb-f0bf-415f-bf7b-1e9c8967e63c)"; flow:established,to_server; http.uri; content:"/landing/form/f63276bb-f0bf-415f-bf7b-1e9c8967e63c"; startswith; fast_pattern; http.host; content:"outlook-office365.protect-login.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002110; classtype:social-engineering; sid:6002110; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b35aaa.com/fish/288)"; flow:established,to_server; http.uri; content:"/fish/288"; startswith; fast_pattern; http.host; content:"b35aaa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002111; classtype:social-engineering; sid:6002111; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reactivar365msnouttk1z.fwh.is/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"reactivar365msnouttk1z.fwh.is"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002112; classtype:social-engineering; sid:6002112; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wepulf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wepulf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002113; classtype:social-engineering; sid:6002113; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (h204812.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"h204812.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002114; classtype:social-engineering; sid:6002114; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qgczvx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qgczvx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002115; classtype:social-engineering; sid:6002115; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.yqcnms.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.yqcnms.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002116; classtype:social-engineering; sid:6002116; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hqdawf.top/pay?Dfy=S7FnH?MsY=RDooD)"; flow:established,to_server; http.uri; content:"/pay?Dfy=S7FnH?MsY=RDooD"; startswith; fast_pattern; http.host; content:"t-mobile.hqdawf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002117; classtype:social-engineering; sid:6002117; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreignj3o5ufkhqhanljsdg3pgcood6v4ot6jw7dwjcezaj6qyxxbl3m.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreignj3o5ufkhqhanljsdg3pgcood6v4ot6jw7dwjcezaj6qyxxbl3m.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002118; classtype:social-engineering; sid:6002118; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.oizubh.top/pay?kDi=ufQEN?ykl=26Z5R)"; flow:established,to_server; http.uri; content:"/pay?kDi=ufQEN?ykl=26Z5R"; startswith; fast_pattern; http.host; content:"t-mobile.oizubh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002119; classtype:social-engineering; sid:6002119; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id90008.agency-manager-support.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id90008.agency-manager-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002120; classtype:social-engineering; sid:6002120; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ylsevk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ylsevk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002121; classtype:social-engineering; sid:6002121; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vihaanrawat2007vr-star.github.io/netflix-ui-clone/)"; flow:established,to_server; http.uri; content:"/netflix-ui-clone/"; startswith; fast_pattern; http.host; content:"vihaanrawat2007vr-star.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002122; classtype:social-engineering; sid:6002122; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (novaoportunidade.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"novaoportunidade.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002123; classtype:social-engineering; sid:6002123; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qxfvph.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qxfvph.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002124; classtype:social-engineering; sid:6002124; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (raadislam.com/tcgm/)"; flow:established,to_server; http.uri; content:"/tcgm/"; startswith; fast_pattern; http.host; content:"raadislam.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002125; classtype:social-engineering; sid:6002125; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (service-portal.partner-programhub.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"service-portal.partner-programhub.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002126; classtype:social-engineering; sid:6002126; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fglfgn.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fglfgn.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002127; classtype:social-engineering; sid:6002127; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.suetyh.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.suetyh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002128; classtype:social-engineering; sid:6002128; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lvbcxs.top/pay?Ldd=KogBh?lvd=eKUJs)"; flow:established,to_server; http.uri; content:"/pay?Ldd=KogBh?lvd=eKUJs"; startswith; fast_pattern; http.host; content:"t-mobile.lvbcxs.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002129; classtype:social-engineering; sid:6002129; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tjvkga.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tjvkga.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002130; classtype:social-engineering; sid:6002130; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (57-128-161-130.cprapid.com/eu/track.php?414bvknhyj54xmup2lyl)"; flow:established,to_server; http.uri; content:"/eu/track.php?414bvknhyj54xmup2lyl"; startswith; fast_pattern; http.host; content:"57-128-161-130.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002131; classtype:social-engineering; sid:6002131; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hqkdnc.top/pay?cYX=Qx92i?omn=Q1Nog)"; flow:established,to_server; http.uri; content:"/pay?cYX=Qx92i?omn=Q1Nog"; startswith; fast_pattern; http.host; content:"t-mobile.hqkdnc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002132; classtype:social-engineering; sid:6002132; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ndqehg.top/pay?pxn=0kcgy?FsS=rFdH3)"; flow:established,to_server; http.uri; content:"/pay?pxn=0kcgy?FsS=rFdH3"; startswith; fast_pattern; http.host; content:"t-mobile.ndqehg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002133; classtype:social-engineering; sid:6002133; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qrstlu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qrstlu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002134; classtype:social-engineering; sid:6002134; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netlixrenouvellement.my/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netlixrenouvellement.my"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002135; classtype:social-engineering; sid:6002135; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id90006.agency-manager-support.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id90006.agency-manager-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002136; classtype:social-engineering; sid:6002136; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gwosnv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gwosnv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002137; classtype:social-engineering; sid:6002137; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id99997.agency-manager-support.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id99997.agency-manager-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002138; classtype:social-engineering; sid:6002138; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bancolombia-credito-online-co.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bancolombia-credito-online-co.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002139; classtype:social-engineering; sid:6002139; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lxwcsf.top/pay?Qud=Khir4?kWQ=xS4jp)"; flow:established,to_server; http.uri; content:"/pay?Qud=Khir4?kWQ=xS4jp"; startswith; fast_pattern; http.host; content:"t-mobile.lxwcsf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002140; classtype:social-engineering; sid:6002140; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lfhzad.top/pay?cQk=Y56ir?qtY=DiYnp)"; flow:established,to_server; http.uri; content:"/pay?cQk=Y56ir?qtY=DiYnp"; startswith; fast_pattern; http.host; content:"t-mobile.lfhzad.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002141; classtype:social-engineering; sid:6002141; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kwbztg.top/pay?twu=7bGax?KCZ=9VJp3)"; flow:established,to_server; http.uri; content:"/pay?twu=7bGax?KCZ=9VJp3"; startswith; fast_pattern; http.host; content:"t-mobile.kwbztg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002142; classtype:social-engineering; sid:6002142; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (revolutionary-magenta-wzucs9d1sm-h6a3ez2c6c.edgeone.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"revolutionary-magenta-wzucs9d1sm-h6a3ez2c6c.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002143; classtype:social-engineering; sid:6002143; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mcyvvt.top/pay?BMN=GRUi6?KzU=wsEso)"; flow:established,to_server; http.uri; content:"/pay?BMN=GRUi6?KzU=wsEso"; startswith; fast_pattern; http.host; content:"t-mobile.mcyvvt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002144; classtype:social-engineering; sid:6002144; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hygrvi.top/pay?rjF=jCKuD?iXt=0P94g)"; flow:established,to_server; http.uri; content:"/pay?rjF=jCKuD?iXt=0P94g"; startswith; fast_pattern; http.host; content:"t-mobile.hygrvi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002145; classtype:social-engineering; sid:6002145; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.verication-casefb535022.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.verication-casefb535022.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002146; classtype:social-engineering; sid:6002146; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (135-125-245-221.cprapid.com/eu/track.php?9er20n20z5vb9w3brtuo)"; flow:established,to_server; http.uri; content:"/eu/track.php?9er20n20z5vb9w3brtuo"; startswith; fast_pattern; http.host; content:"135-125-245-221.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002147; classtype:social-engineering; sid:6002147; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (customer-sp-alexk.pages.dev/help/contact/644044422532087)"; flow:established,to_server; http.uri; content:"/help/contact/644044422532087"; startswith; fast_pattern; http.host; content:"customer-sp-alexk.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002148; classtype:social-engineering; sid:6002148; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (customer-sp-bayerjohnathan.pages.dev/help/contact/1)"; flow:established,to_server; http.uri; content:"/help/contact/1"; startswith; fast_pattern; http.host; content:"customer-sp-bayerjohnathan.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002149; classtype:social-engineering; sid:6002149; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.yahoo302.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.yahoo302.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002150; classtype:social-engineering; sid:6002150; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kojcfu.top/pay?ZOQ=t1TQJ?HeF=9UFh5)"; flow:established,to_server; http.uri; content:"/pay?ZOQ=t1TQJ?HeF=9UFh5"; startswith; fast_pattern; http.host; content:"t-mobile.kojcfu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002151; classtype:social-engineering; sid:6002151; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id90009.agency-manager-support.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id90009.agency-manager-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002152; classtype:social-engineering; sid:6002152; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acc.partner-credit-submission.com/__\;!!Bt8RZUm9aw!5t7lF5Li5nfeDHSbbwOxmQgLod6rtyIw990OXsxMVhUNjfwSu0puc68ssPi7_9CT2vDnylpFFqAcOXaj$)"; flow:established,to_server; http.uri; content:"/__|3b|!!Bt8RZUm9aw!5t7lF5Li5nfeDHSbbwOxmQgLod6rtyIw990OXsxMVhUNjfwSu0puc68ssPi7_9CT2vDnylpFFqAcOXaj$"; startswith; fast_pattern; http.host; content:"acc.partner-credit-submission.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002153; classtype:social-engineering; sid:6002153; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17694.invoice-ads-manager.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17694.invoice-ads-manager.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002154; classtype:social-engineering; sid:6002154; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (authentication.ms/E.iSWEgaqsk6fDu1VC)"; flow:established,to_server; http.uri; content:"/E.iSWEgaqsk6fDu1VC"; startswith; fast_pattern; http.host; content:"authentication.ms"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002155; classtype:social-engineering; sid:6002155; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b35aaa.com/fish/255)"; flow:established,to_server; http.uri; content:"/fish/255"; startswith; fast_pattern; http.host; content:"b35aaa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002156; classtype:social-engineering; sid:6002156; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.myeapj.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.myeapj.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002157; classtype:social-engineering; sid:6002157; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id19239213.invoice-ads-setting.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id19239213.invoice-ads-setting.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002158; classtype:social-engineering; sid:6002158; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bigsaleapple.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bigsaleapple.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002159; classtype:social-engineering; sid:6002159; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.trieym.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.trieym.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002160; classtype:social-engineering; sid:6002160; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lbvxus.top/pay?hDw=79Zf6?ldh=Dhj3j)"; flow:established,to_server; http.uri; content:"/pay?hDw=79Zf6?ldh=Dhj3j"; startswith; fast_pattern; http.host; content:"t-mobile.lbvxus.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002161; classtype:social-engineering; sid:6002161; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17691.invoice-ads-manager.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17691.invoice-ads-manager.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002162; classtype:social-engineering; sid:6002162; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.preuvk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.preuvk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002163; classtype:social-engineering; sid:6002163; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.seguridad-incritada-pichi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.seguridad-incritada-pichi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002164; classtype:social-engineering; sid:6002164; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.iyiwgo.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.iyiwgo.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002165; classtype:social-engineering; sid:6002165; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a2.nextgenmedia.site/page/Garenaffteam/x-3page/)"; flow:established,to_server; http.uri; content:"/page/Garenaffteam/x-3page/"; startswith; fast_pattern; http.host; content:"a2.nextgenmedia.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002166; classtype:social-engineering; sid:6002166; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qzfvjw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qzfvjw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002167; classtype:social-engineering; sid:6002167; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rtlvxz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rtlvxz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002168; classtype:social-engineering; sid:6002168; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id90003.agency-manager-support.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id90003.agency-manager-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002169; classtype:social-engineering; sid:6002169; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (franzfinanz.de/authorization)"; flow:established,to_server; http.uri; content:"/authorization"; startswith; fast_pattern; http.host; content:"franzfinanz.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002170; classtype:social-engineering; sid:6002170; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nikhilrangale.github.io/Netflix-Clone-UI/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone-UI/"; startswith; fast_pattern; http.host; content:"nikhilrangale.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002171; classtype:social-engineering; sid:6002171; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocowh.info/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.dpdlocowh.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002172; classtype:social-engineering; sid:6002172; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netcoinzlogin.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netcoinzlogin.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002173; classtype:social-engineering; sid:6002173; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.padisahbt.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.padisahbt.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002174; classtype:social-engineering; sid:6002174; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wzgmiq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wzgmiq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002175; classtype:social-engineering; sid:6002175; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hjllnq.top/pay?WPq=J1PXT?RGs=LqLIW)"; flow:established,to_server; http.uri; content:"/pay?WPq=J1PXT?RGs=LqLIW"; startswith; fast_pattern; http.host; content:"t-mobile.hjllnq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002176; classtype:social-engineering; sid:6002176; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id19239211.invoice-ads-setting.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id19239211.invoice-ads-setting.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002177; classtype:social-engineering; sid:6002177; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.uzpdji.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.uzpdji.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002178; classtype:social-engineering; sid:6002178; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id19239212.invoice-ads-setting.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id19239212.invoice-ads-setting.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002179; classtype:social-engineering; sid:6002179; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (natiekirsh.co.za/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"natiekirsh.co.za"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002180; classtype:social-engineering; sid:6002180; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xnjgve.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xnjgve.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002181; classtype:social-engineering; sid:6002181; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vlmjcv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vlmjcv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002182; classtype:social-engineering; sid:6002182; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secureserviceweb.sviluppo.host/s/?LOG=243b26524bb3db67f62d16e4661493801c38cbd23621d6bc93d16be8f7d1eeca)"; flow:established,to_server; http.uri; content:"/s/?LOG=243b26524bb3db67f62d16e4661493801c38cbd23621d6bc93d16be8f7d1eeca"; startswith; fast_pattern; http.host; content:"secureserviceweb.sviluppo.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002183; classtype:social-engineering; sid:6002183; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.oymnpj.top/pay?fbg=db2by?wgB=GnX7m)"; flow:established,to_server; http.uri; content:"/pay?fbg=db2by?wgB=GnX7m"; startswith; fast_pattern; http.host; content:"t-mobile.oymnpj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002184; classtype:social-engineering; sid:6002184; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (novoalvomaisacima.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"novoalvomaisacima.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002185; classtype:social-engineering; sid:6002185; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hxtqvo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hxtqvo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002186; classtype:social-engineering; sid:6002186; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.igeprx.top/pay?ZXL=xZVXS?LeJ=MJrlS)"; flow:established,to_server; http.uri; content:"/pay?ZXL=xZVXS?LeJ=MJrlS"; startswith; fast_pattern; http.host; content:"t-mobile.igeprx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002187; classtype:social-engineering; sid:6002187; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocots.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.dpdlocots.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002188; classtype:social-engineering; sid:6002188; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qghdxv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qghdxv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002189; classtype:social-engineering; sid:6002189; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoemergencial.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoemergencial.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002190; classtype:social-engineering; sid:6002190; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazingreinvite.de/hope/other.html)"; flow:established,to_server; http.uri; content:"/hope/other.html"; startswith; fast_pattern; http.host; content:"amazingreinvite.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002191; classtype:social-engineering; sid:6002191; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qsuwly.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qsuwly.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002192; classtype:social-engineering; sid:6002192; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mailoservice.flazio.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mailoservice.flazio.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002193; classtype:social-engineering; sid:6002193; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.sijfzv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.sijfzv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002194; classtype:social-engineering; sid:6002194; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xqgiwu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xqgiwu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002195; classtype:social-engineering; sid:6002195; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b35aaa.com/fish/202)"; flow:established,to_server; http.uri; content:"/fish/202"; startswith; fast_pattern; http.host; content:"b35aaa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002196; classtype:social-engineering; sid:6002196; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xnojev.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xnojev.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002197; classtype:social-engineering; sid:6002197; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ijkwlm.top/pay?DsS=AVwID?ave=ey32P)"; flow:established,to_server; http.uri; content:"/pay?DsS=AVwID?ave=ey32P"; startswith; fast_pattern; http.host; content:"t-mobile.ijkwlm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002198; classtype:social-engineering; sid:6002198; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member459.center-meta-agency.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member459.center-meta-agency.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002199; classtype:social-engineering; sid:6002199; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (egmtransportes.cl/metalworkservice/index.php)"; flow:established,to_server; http.uri; content:"/metalworkservice/index.php"; startswith; fast_pattern; http.host; content:"egmtransportes.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002200; classtype:social-engineering; sid:6002200; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zfwajd.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zfwajd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002201; classtype:social-engineering; sid:6002201; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id90005.agency-manager-support.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id90005.agency-manager-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002202; classtype:social-engineering; sid:6002202; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (steamcommunuty.com/ld/799378496518724)"; flow:established,to_server; http.uri; content:"/ld/799378496518724"; startswith; fast_pattern; http.host; content:"steamcommunuty.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002203; classtype:social-engineering; sid:6002203; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.prywit.top/pay?hXF=1QKn4?ihE=C4upt)"; flow:established,to_server; http.uri; content:"/pay?hXF=1QKn4?ihE=C4upt"; startswith; fast_pattern; http.host; content:"t-mobile.prywit.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002204; classtype:social-engineering; sid:6002204; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.prtlvx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.prtlvx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002205; classtype:social-engineering; sid:6002205; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (victors357.github.io/javascript-amazon-project/checkout.html)"; flow:established,to_server; http.uri; content:"/javascript-amazon-project/checkout.html"; startswith; fast_pattern; http.host; content:"victors357.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002206; classtype:social-engineering; sid:6002206; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.padisahbet-2026gir.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.padisahbet-2026gir.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002207; classtype:social-engineering; sid:6002207; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.cszb-fi.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.cszb-fi.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002208; classtype:social-engineering; sid:6002208; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zyexx.com/cef8c85d76d83d432dp9b1ef647dffe97e13.html)"; flow:established,to_server; http.uri; content:"/cef8c85d76d83d432dp9b1ef647dffe97e13.html"; startswith; fast_pattern; http.host; content:"zyexx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002209; classtype:social-engineering; sid:6002209; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nitfyh.top/pay?OEa=60291?rqh=sDQWP)"; flow:established,to_server; http.uri; content:"/pay?OEa=60291?rqh=sDQWP"; startswith; fast_pattern; http.host; content:"t-mobile.nitfyh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002210; classtype:social-engineering; sid:6002210; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (round-shape-00bc.julianek71vwherring892.workers.dev/meta-support-center/)"; flow:established,to_server; http.uri; content:"/meta-support-center/"; startswith; fast_pattern; http.host; content:"round-shape-00bc.julianek71vwherring892.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002211; classtype:social-engineering; sid:6002211; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netlixrenouvellement.my/pages/index.php)"; flow:established,to_server; http.uri; content:"/pages/index.php"; startswith; fast_pattern; http.host; content:"netlixrenouvellement.my"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002212; classtype:social-engineering; sid:6002212; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kxjzdc.top/pay?hku=o7I9E?EWI=788Q9)"; flow:established,to_server; http.uri; content:"/pay?hku=o7I9E?EWI=788Q9"; startswith; fast_pattern; http.host; content:"t-mobile.kxjzdc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002213; classtype:social-engineering; sid:6002213; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee-588.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopee-588.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002214; classtype:social-engineering; sid:6002214; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mekgla.top/pay?dcv=GM0eG?wSk=Ra72F)"; flow:established,to_server; http.uri; content:"/pay?dcv=GM0eG?wSk=Ra72F"; startswith; fast_pattern; http.host; content:"t-mobile.mekgla.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002215; classtype:social-engineering; sid:6002215; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth-secure.me/E.DVnuvwqz2OxO)"; flow:established,to_server; http.uri; content:"/E.DVnuvwqz2OxO"; startswith; fast_pattern; http.host; content:"auth-secure.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002216; classtype:social-engineering; sid:6002216; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kosmikophobia.tul-proposal.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kosmikophobia.tul-proposal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002217; classtype:social-engineering; sid:6002217; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dh-dhl-tracking.is-certified.com/dh/dhl/tracking/fV5EjH/msg.php?id=51456326)"; flow:established,to_server; http.uri; content:"/dh/dhl/tracking/fV5EjH/msg.php?id=51456326"; startswith; fast_pattern; http.host; content:"dh-dhl-tracking.is-certified.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002218; classtype:social-engineering; sid:6002218; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflixy-bixy.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflixy-bixy.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002219; classtype:social-engineering; sid:6002219; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id90002.agency-manager-support.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id90002.agency-manager-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002220; classtype:social-engineering; sid:6002220; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (135-125-245-221.cprapid.com/eu/)"; flow:established,to_server; http.uri; content:"/eu/"; startswith; fast_pattern; http.host; content:"135-125-245-221.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002221; classtype:social-engineering; sid:6002221; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.platxe.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.platxe.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002222; classtype:social-engineering; sid:6002222; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1405qzrwml.adcampaign-identitycontrolgrid.me/public/index?ref=business-support-center-DASDFDSYUYEE43FJDSHFSDFsetting%25popup%3fclient_id=889943718806-ual26tplnot2ea8b7n5t4p77keo8eb)"; flow:established,to_server; http.uri; content:"/public/index?ref=business-support-center-DASDFDSYUYEE43FJDSHFSDFsetting%25popup%3fclient_id=889943718806-ual26tplnot2ea8b7n5t4p77keo8eb"; startswith; fast_pattern; http.host; content:"www.1405qzrwml.adcampaign-identitycontrolgrid.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002223; classtype:social-engineering; sid:6002223; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee-588.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.shopee-588.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002224; classtype:social-engineering; sid:6002224; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.aqrvmh.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.aqrvmh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002225; classtype:social-engineering; sid:6002225; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rhviey.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rhviey.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002226; classtype:social-engineering; sid:6002226; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreidqteie7g35xw7rlopugwxrg2qe4mcgku2j2h6ryj4gj6rkoa2yoe.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreidqteie7g35xw7rlopugwxrg2qe4mcgku2j2h6ryj4gj6rkoa2yoe.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002227; classtype:social-engineering; sid:6002227; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.188connexion.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.188connexion.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002228; classtype:social-engineering; sid:6002228; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kaswvr.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kaswvr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002229; classtype:social-engineering; sid:6002229; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kabusclubb.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kabusclubb.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002230; classtype:social-engineering; sid:6002230; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eklavya98.github.io/netflix-landing-page)"; flow:established,to_server; http.uri; content:"/netflix-landing-page"; startswith; fast_pattern; http.host; content:"eklavya98.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002231; classtype:social-engineering; sid:6002231; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trrezobridge.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trrezobridge.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002232; classtype:social-engineering; sid:6002232; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wvmifd.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wvmifd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002233; classtype:social-engineering; sid:6002233; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.sodubi.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.sodubi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002234; classtype:social-engineering; sid:6002234; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nikita-2005desai.github.io/Amazon-clone--Frontend/)"; flow:established,to_server; http.uri; content:"/Amazon-clone--Frontend/"; startswith; fast_pattern; http.host; content:"nikita-2005desai.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002235; classtype:social-engineering; sid:6002235; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qriyfp.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qriyfp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002236; classtype:social-engineering; sid:6002236; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xfomrc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xfomrc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002237; classtype:social-engineering; sid:6002237; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kabvwr.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kabvwr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002238; classtype:social-engineering; sid:6002238; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (slussentrafikskola.se/Downloadinvoice.html)"; flow:established,to_server; http.uri; content:"/Downloadinvoice.html"; startswith; fast_pattern; http.host; content:"slussentrafikskola.se"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002239; classtype:social-engineering; sid:6002239; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id90001.agency-manager-support.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id90001.agency-manager-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002240; classtype:social-engineering; sid:6002240; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.iwzspe.top/pay?ysA=JaTsV?XhT=uPrLt)"; flow:established,to_server; http.uri; content:"/pay?ysA=JaTsV?XhT=uPrLt"; startswith; fast_pattern; http.host; content:"t-mobile.iwzspe.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002241; classtype:social-engineering; sid:6002241; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.vdhsab.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.vdhsab.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002242; classtype:social-engineering; sid:6002242; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktifkaaann-danaa-paylateerr.acdgx.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktifkaaann-danaa-paylateerr.acdgx.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002243; classtype:social-engineering; sid:6002243; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yahoo302.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yahoo302.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002244; classtype:social-engineering; sid:6002244; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (goldreels.space/ifhk/fnplzen.php)"; flow:established,to_server; http.uri; content:"/ifhk/fnplzen.php"; startswith; fast_pattern; http.host; content:"goldreels.space"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002245; classtype:social-engineering; sid:6002245; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.yovpkf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.yovpkf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002246; classtype:social-engineering; sid:6002246; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id19239210.invoice-ads-setting.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id19239210.invoice-ads-setting.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002247; classtype:social-engineering; sid:6002247; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ucjbsy.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ucjbsy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002248; classtype:social-engineering; sid:6002248; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.veksow.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.veksow.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002249; classtype:social-engineering; sid:6002249; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (applynow-free-bluetick.surge.sh/?brid=YWdncwFLptvE4mPmODtVdnDQbPHc)"; flow:established,to_server; http.uri; content:"/?brid=YWdncwFLptvE4mPmODtVdnDQbPHc"; startswith; fast_pattern; http.host; content:"applynow-free-bluetick.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002250; classtype:social-engineering; sid:6002250; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ndezvu.top/pay?RJO=s1ukD?NEB=FD6qu)"; flow:established,to_server; http.uri; content:"/pay?RJO=s1ukD?NEB=FD6qu"; startswith; fast_pattern; http.host; content:"t-mobile.ndezvu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002251; classtype:social-engineering; sid:6002251; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.oihgfr.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.oihgfr.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002252; classtype:social-engineering; sid:6002252; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lzcsbo.top/pay?fcu=rtyvg?uyO=T5Lhg)"; flow:established,to_server; http.uri; content:"/pay?fcu=rtyvg?uyO=T5Lhg"; startswith; fast_pattern; http.host; content:"t-mobile.lzcsbo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002253; classtype:social-engineering; sid:6002253; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (to.lk/GNScWD)"; flow:established,to_server; http.uri; content:"/GNScWD"; startswith; fast_pattern; http.host; content:"to.lk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002254; classtype:social-engineering; sid:6002254; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocowc.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.dpdlocowc.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002255; classtype:social-engineering; sid:6002255; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mcvdyt.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.mcvdyt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002256; classtype:social-engineering; sid:6002256; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (govauinboxsecurealert.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"govauinboxsecurealert.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002257; classtype:social-engineering; sid:6002257; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.applynow-free-bluetick.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.applynow-free-bluetick.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002258; classtype:social-engineering; sid:6002258; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.yoixqh.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.yoixqh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002259; classtype:social-engineering; sid:6002259; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.potwxd.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.potwxd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002260; classtype:social-engineering; sid:6002260; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lxwcsf.top/pay?XOV=anojx?gbp=94Gbv)"; flow:established,to_server; http.uri; content:"/pay?XOV=anojx?gbp=94Gbv"; startswith; fast_pattern; http.host; content:"t-mobile.lxwcsf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002261; classtype:social-engineering; sid:6002261; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.oybepr.top/pay?NDW=XplPv?NIj=aLkns)"; flow:established,to_server; http.uri; content:"/pay?NDW=XplPv?NIj=aLkns"; startswith; fast_pattern; http.host; content:"t-mobile.oybepr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002262; classtype:social-engineering; sid:6002262; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (w.kqnklg.com/SHope13/)"; flow:established,to_server; http.uri; content:"/SHope13/"; startswith; fast_pattern; http.host; content:"w.kqnklg.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002263; classtype:social-engineering; sid:6002263; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tvjfca.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tvjfca.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002264; classtype:social-engineering; sid:6002264; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jzrvvq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jzrvvq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002265; classtype:social-engineering; sid:6002265; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coleman-stamp-cordless-blue.trycloudflare.com/mobile.html.php)"; flow:established,to_server; http.uri; content:"/mobile.html.php"; startswith; fast_pattern; http.host; content:"coleman-stamp-cordless-blue.trycloudflare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002266; classtype:social-engineering; sid:6002266; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dtpvmk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dtpvmk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002267; classtype:social-engineering; sid:6002267; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ndzwvu.top/pay?SPG=Bcejb?bAr=wWULs)"; flow:established,to_server; http.uri; content:"/pay?SPG=Bcejb?bAr=wWULs"; startswith; fast_pattern; http.host; content:"t-mobile.ndzwvu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002268; classtype:social-engineering; sid:6002268; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verication-casefb535022.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"verication-casefb535022.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002269; classtype:social-engineering; sid:6002269; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.zx2517.com/home)"; flow:established,to_server; http.uri; content:"/home"; startswith; fast_pattern; http.host; content:"login.zx2517.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002270; classtype:social-engineering; sid:6002270; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ttaittcyyqdh.com/contactless/)"; flow:established,to_server; http.uri; content:"/contactless/"; startswith; fast_pattern; http.host; content:"www.ttaittcyyqdh.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002271; classtype:social-engineering; sid:6002271; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cwzxpx.com/?type=verify&\;key=ywewccmdmm)"; flow:established,to_server; http.uri; content:"/?type=verify&|3b|key=ywewccmdmm"; startswith; fast_pattern; http.host; content:"cwzxpx.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002272; classtype:social-engineering; sid:6002272; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paypay-card.gkaymio.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paypay-card.gkaymio.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002273; classtype:social-engineering; sid:6002273; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure.my-optus-bills.com/my-account-login/)"; flow:established,to_server; http.uri; content:"/my-account-login/"; startswith; fast_pattern; http.host; content:"secure.my-optus-bills.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002274; classtype:social-engineering; sid:6002274; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oamskyejdek.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"oamskyejdek.blogspot.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002275; classtype:social-engineering; sid:6002275; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezio-appstarted.wixstudio.com/suite-app)"; flow:established,to_server; http.uri; content:"/suite-app"; startswith; fast_pattern; http.host; content:"trezio-appstarted.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002276; classtype:social-engineering; sid:6002276; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.prywan5238729h-45.lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.prywan5238729h-45.lat"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002277; classtype:social-engineering; sid:6002277; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocouk.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocouk.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002278; classtype:social-engineering; sid:6002278; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoia.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoia.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002279; classtype:social-engineering; sid:6002279; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreib5a2pevnxcwy6nv2q4ysjyppjehbxjpoms6fwaoqtdetxrdccswa.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreib5a2pevnxcwy6nv2q4ysjyppjehbxjpoms6fwaoqtdetxrdccswa.ipfs.dweb.link"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002280; classtype:social-engineering; sid:6002280; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bridge-learnpage.wixstudio.com/bridge)"; flow:established,to_server; http.uri; content:"/bridge"; startswith; fast_pattern; http.host; content:"bridge-learnpage.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002281; classtype:social-engineering; sid:6002281; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocanu.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocanu.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002282; classtype:social-engineering; sid:6002282; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocois.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.dpdlocois.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002283; classtype:social-engineering; sid:6002283; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocabv.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocabv.cyou"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002284; classtype:social-engineering; sid:6002284; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie.po12801-f12.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.po12801-f12.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002285; classtype:social-engineering; sid:6002285; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocacm.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocacm.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002286; classtype:social-engineering; sid:6002286; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allianceswisspass.live.itonicsit.de/de/type_umsetzungsprojekt/32/details)"; flow:established,to_server; http.uri; content:"/de/type_umsetzungsprojekt/32/details"; startswith; fast_pattern; http.host; content:"allianceswisspass.live.itonicsit.de"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002287; classtype:social-engineering; sid:6002287; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (begin-logorlive.wixstudio.com/us-en-start)"; flow:established,to_server; http.uri; content:"/us-en-start"; startswith; fast_pattern; http.host; content:"begin-logorlive.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002288; classtype:social-engineering; sid:6002288; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ws0utlouk365servic.iceiy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ws0utlouk365servic.iceiy.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002289; classtype:social-engineering; sid:6002289; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vos-remboursement-soin.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vos-remboursement-soin.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002290; classtype:social-engineering; sid:6002290; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apple-photos.sa.com/app/webroot/script/navigation_compass_find_devices_login_b4_passcode4/2026/)"; flow:established,to_server; http.uri; content:"/app/webroot/script/navigation_compass_find_devices_login_b4_passcode4/2026/"; startswith; fast_pattern; http.host; content:"apple-photos.sa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002291; classtype:social-engineering; sid:6002291; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocotl.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocotl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002292; classtype:social-engineering; sid:6002292; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocaxc.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocaxc.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002293; classtype:social-engineering; sid:6002293; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocots.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocots.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002294; classtype:social-engineering; sid:6002294; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-clone-green-nine.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-clone-green-nine.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002295; classtype:social-engineering; sid:6002295; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ithelptoday.net/d5ca0d8a-16df-415b-ab28-06203f45739b/a/b605427b-b078-4dbe-9533-b003eeeb2032/ccp?lid=c7847fdc-9af1-4e9e-9190-b58574c0f31c)"; flow:established,to_server; http.uri; content:"/d5ca0d8a-16df-415b-ab28-06203f45739b/a/b605427b-b078-4dbe-9533-b003eeeb2032/ccp?lid=c7847fdc-9af1-4e9e-9190-b58574c0f31c"; startswith; fast_pattern; http.host; content:"ithelptoday.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002296; classtype:social-engineering; sid:6002296; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ayesharz.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"ayesharz.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002297; classtype:social-engineering; sid:6002297; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.roblox.com.ml/users/262127185216/profile)"; flow:established,to_server; http.uri; content:"/users/262127185216/profile"; startswith; fast_pattern; http.host; content:"www.roblox.com.ml"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002298; classtype:social-engineering; sid:6002298; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.roblox.com.ml/games/16732694052/Fisch-HUMPBACK?privateServerLinkCode=879419823283425228157216249356)"; flow:established,to_server; http.uri; content:"/games/16732694052/Fisch-HUMPBACK?privateServerLinkCode=879419823283425228157216249356"; startswith; fast_pattern; http.host; content:"www.roblox.com.ml"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002299; classtype:social-engineering; sid:6002299; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocott.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocott.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002300; classtype:social-engineering; sid:6002300; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoye.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoye.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002301; classtype:social-engineering; sid:6002301; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoqa.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoqa.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002302; classtype:social-engineering; sid:6002302; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoiy.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoiy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002303; classtype:social-engineering; sid:6002303; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoew.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoew.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002304; classtype:social-engineering; sid:6002304; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocorh.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocorh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002305; classtype:social-engineering; sid:6002305; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocaxh.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocaxh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002306; classtype:social-engineering; sid:6002306; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (v3r1fikasi-b4dge.site/otp.php)"; flow:established,to_server; http.uri; content:"/otp.php"; startswith; fast_pattern; http.host; content:"v3r1fikasi-b4dge.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002307; classtype:social-engineering; sid:6002307; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoiu.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoiu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002308; classtype:social-engineering; sid:6002308; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (actualizar365email.iceiy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"actualizar365email.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002309; classtype:social-engineering; sid:6002309; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (buscar-es.info/app/webroot/script/navigation_compass_find_devices_login_b4_passcode4/2026/)"; flow:established,to_server; http.uri; content:"/app/webroot/script/navigation_compass_find_devices_login_b4_passcode4/2026/"; startswith; fast_pattern; http.host; content:"buscar-es.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002310; classtype:social-engineering; sid:6002310; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-clone-green-nine.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-clone-green-nine.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002311; classtype:social-engineering; sid:6002311; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoyl.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoyl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002312; classtype:social-engineering; sid:6002312; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nbvhex.top/pay?zGB=w9uSV?tIx=SeZUk)"; flow:established,to_server; http.uri; content:"/pay?zGB=w9uSV?tIx=SeZUk"; startswith; fast_pattern; http.host; content:"t-mobile.nbvhex.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002313; classtype:social-engineering; sid:6002313; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j58m.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j58m.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002314; classtype:social-engineering; sid:6002314; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocavm.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocavm.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002315; classtype:social-engineering; sid:6002315; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocouo.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocouo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002316; classtype:social-engineering; sid:6002316; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoua.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoua.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002317; classtype:social-engineering; sid:6002317; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (face.boook.com.vn/de-02-chien-dich-mien-phi?a)"; flow:established,to_server; http.uri; content:"/de-02-chien-dich-mien-phi?a"; startswith; fast_pattern; http.host; content:"face.boook.com.vn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002318; classtype:social-engineering; sid:6002318; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocouw.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocouw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002319; classtype:social-engineering; sid:6002319; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoie.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoie.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002320; classtype:social-engineering; sid:6002320; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (milogin2026ecuad0r.zya.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"milogin2026ecuad0r.zya.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002321; classtype:social-engineering; sid:6002321; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p.dongbeilaobo.com/wap)"; flow:established,to_server; http.uri; content:"/wap"; startswith; fast_pattern; http.host; content:"p.dongbeilaobo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002322; classtype:social-engineering; sid:6002322; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.roblox.com.ml/users/324671703348/profile)"; flow:established,to_server; http.uri; content:"/users/324671703348/profile"; startswith; fast_pattern; http.host; content:"www.roblox.com.ml"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002323; classtype:social-engineering; sid:6002323; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoes.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoes.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002324; classtype:social-engineering; sid:6002324; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd-ie-bxn.link/track)"; flow:established,to_server; http.uri; content:"/track"; startswith; fast_pattern; http.host; content:"dpd-ie-bxn.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002325; classtype:social-engineering; sid:6002325; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gimeeniloginx.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gimeeniloginx.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002326; classtype:social-engineering; sid:6002326; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (localizar-find.my/app/webroot/script/navigation_compass_find_devices_login_b4_passcode4/2026/)"; flow:established,to_server; http.uri; content:"/app/webroot/script/navigation_compass_find_devices_login_b4_passcode4/2026/"; startswith; fast_pattern; http.host; content:"localizar-find.my"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002327; classtype:social-engineering; sid:6002327; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chixt-rizx.wasmer.app/pages)"; flow:established,to_server; http.uri; content:"/pages"; startswith; fast_pattern; http.host; content:"chixt-rizx.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002328; classtype:social-engineering; sid:6002328; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fndmy-support.com/script/navigation_compass_find_devices_login_b4_passcode4/2026)"; flow:established,to_server; http.uri; content:"/script/navigation_compass_find_devices_login_b4_passcode4/2026"; startswith; fast_pattern; http.host; content:"fndmy-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002329; classtype:social-engineering; sid:6002329; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.p25j.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.p25j.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002330; classtype:social-engineering; sid:6002330; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-techic.accounts-admin-agency.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-techic.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002331; classtype:social-engineering; sid:6002331; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocore.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocore.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002332; classtype:social-engineering; sid:6002332; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ygacvk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ygacvk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002333; classtype:social-engineering; sid:6002333; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.j58s.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.j58s.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002334; classtype:social-engineering; sid:6002334; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (navyacces.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"navyacces.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002335; classtype:social-engineering; sid:6002335; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (intl-coinbase-inv.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"intl-coinbase-inv.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002336; classtype:social-engineering; sid:6002336; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoqs.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoqs.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002337; classtype:social-engineering; sid:6002337; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member248.business-support-partner.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member248.business-support-partner.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002338; classtype:social-engineering; sid:6002338; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoyn.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoyn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002339; classtype:social-engineering; sid:6002339; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (x16c.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"x16c.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002340; classtype:social-engineering; sid:6002340; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocabq.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocabq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002341; classtype:social-engineering; sid:6002341; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocotr.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocotr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002342; classtype:social-engineering; sid:6002342; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.07365tt.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.07365tt.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002343; classtype:social-engineering; sid:6002343; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (communitysessionmint2.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"communitysessionmint2.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002344; classtype:social-engineering; sid:6002344; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoui.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoui.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002345; classtype:social-engineering; sid:6002345; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocorz.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocorz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002346; classtype:social-engineering; sid:6002346; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (realonepranshu.github.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"realonepranshu.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002347; classtype:social-engineering; sid:6002347; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smbc-os.worksmonkey.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"smbc-os.worksmonkey.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002348; classtype:social-engineering; sid:6002348; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spoo.me/hardego)"; flow:established,to_server; http.uri; content:"/hardego"; startswith; fast_pattern; http.host; content:"spoo.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002349; classtype:social-engineering; sid:6002349; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoqq.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoqq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002350; classtype:social-engineering; sid:6002350; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoer.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoer.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002351; classtype:social-engineering; sid:6002351; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (q0ntv3l5uvynzje.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"q0ntv3l5uvynzje.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002352; classtype:social-engineering; sid:6002352; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoqc.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoqc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002353; classtype:social-engineering; sid:6002353; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocotu.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocotu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002354; classtype:social-engineering; sid:6002354; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocowr.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocowr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002355; classtype:social-engineering; sid:6002355; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocouu.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocouu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002356; classtype:social-engineering; sid:6002356; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shaikhrrida.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"shaikhrrida.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002357; classtype:social-engineering; sid:6002357; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sd-rizx.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sd-rizx.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002358; classtype:social-engineering; sid:6002358; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ayushi1007.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"ayushi1007.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002359; classtype:social-engineering; sid:6002359; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocorl.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocorl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002360; classtype:social-engineering; sid:6002360; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoyu.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoyu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002361; classtype:social-engineering; sid:6002361; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (waddyworks.com/-/eb-kn/)"; flow:established,to_server; http.uri; content:"/-/eb-kn/"; startswith; fast_pattern; http.host; content:"waddyworks.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002362; classtype:social-engineering; sid:6002362; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocotd.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocotd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002363; classtype:social-engineering; sid:6002363; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoig.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoig.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002364; classtype:social-engineering; sid:6002364; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocaxx.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocaxx.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002365; classtype:social-engineering; sid:6002365; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoeu.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoeu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002366; classtype:social-engineering; sid:6002366; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocaxv.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocaxv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002367; classtype:social-engineering; sid:6002367; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocaxz.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocaxz.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002368; classtype:social-engineering; sid:6002368; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.p25i.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.p25i.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002369; classtype:social-engineering; sid:6002369; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (psce.pw/944570942721profile)"; flow:established,to_server; http.uri; content:"/944570942721profile"; startswith; fast_pattern; http.host; content:"psce.pw"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002370; classtype:social-engineering; sid:6002370; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocavu.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocavu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002371; classtype:social-engineering; sid:6002371; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (v3r1fikasi-b4dge.site/done.php)"; flow:established,to_server; http.uri; content:"/done.php"; startswith; fast_pattern; http.host; content:"v3r1fikasi-b4dge.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002372; classtype:social-engineering; sid:6002372; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoyk.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoyk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002373; classtype:social-engineering; sid:6002373; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoth.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoth.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002374; classtype:social-engineering; sid:6002374; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoup.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoup.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002375; classtype:social-engineering; sid:6002375; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (evixkeys.com/?_task=mail)"; flow:established,to_server; http.uri; content:"/?_task=mail"; startswith; fast_pattern; http.host; content:"evixkeys.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002376; classtype:social-engineering; sid:6002376; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-xi-opal.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-xi-opal.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002377; classtype:social-engineering; sid:6002377; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (avanteshipping.com/wp-content/aktualisierung-de/easybk/)"; flow:established,to_server; http.uri; content:"/wp-content/aktualisierung-de/easybk/"; startswith; fast_pattern; http.host; content:"avanteshipping.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002378; classtype:social-engineering; sid:6002378; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoyw.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoyw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002379; classtype:social-engineering; sid:6002379; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.virpyo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.virpyo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002380; classtype:social-engineering; sid:6002380; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.axodhp.top/pay?wEd=dqWyL?cup=dcfWO)"; flow:established,to_server; http.uri; content:"/pay?wEd=dqWyL?cup=dcfWO"; startswith; fast_pattern; http.host; content:"t-mobile.axodhp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002381; classtype:social-engineering; sid:6002381; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (avanteshipping.com/wp-content/aktualisierung-de/easybk/nc/8KJ6JR09RD/Select/login.php?cgi=GiELKO3wYgb73SkZHcabpx57rVT8RQgiiAohZwh067Pf9jqiAMA3n55UAdzdQBRNvcgI3qsG3aGiDzWnC3O4FPRkDXr6VwYkuCzMy4yEiLJh9)"; flow:established,to_server; http.uri; content:"/wp-content/aktualisierung-de/easybk/nc/8KJ6JR09RD/Select/login.php?cgi=GiELKO3wYgb73SkZHcabpx57rVT8RQgiiAohZwh067Pf9jqiAMA3n55UAdzdQBRNvcgI3qsG3aGiDzWnC3O4FPRkDXr6VwYkuCzMy4yEiLJh9"; startswith; fast_pattern; http.host; content:"avanteshipping.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002382; classtype:social-engineering; sid:6002382; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (modelmgmtgroup.com/taylor/index2.php)"; flow:established,to_server; http.uri; content:"/taylor/index2.php"; startswith; fast_pattern; http.host; content:"modelmgmtgroup.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002383; classtype:social-engineering; sid:6002383; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoug.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoug.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002384; classtype:social-engineering; sid:6002384; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.midassbuy.officiall-rewards.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mail.midassbuy.officiall-rewards.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002385; classtype:social-engineering; sid:6002385; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoyf.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoyf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002386; classtype:social-engineering; sid:6002386; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocour.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocour.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002387; classtype:social-engineering; sid:6002387; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocota.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocota.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002388; classtype:social-engineering; sid:6002388; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocaxy.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocaxy.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002389; classtype:social-engineering; sid:6002389; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (localizar-find.my/script/navigation_compass_find_devices_login_b4_passcode4/2026)"; flow:established,to_server; http.uri; content:"/script/navigation_compass_find_devices_login_b4_passcode4/2026"; startswith; fast_pattern; http.host; content:"localizar-find.my"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002390; classtype:social-engineering; sid:6002390; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoip.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoip.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002391; classtype:social-engineering; sid:6002391; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocaxu.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocaxu.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002392; classtype:social-engineering; sid:6002392; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocowp.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocowp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002393; classtype:social-engineering; sid:6002393; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocaxh.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocaxh.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002394; classtype:social-engineering; sid:6002394; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocowt.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocowt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002395; classtype:social-engineering; sid:6002395; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (u.to/gift-steam/mPaTIg)"; flow:established,to_server; http.uri; content:"/gift-steam/mPaTIg"; startswith; fast_pattern; http.host; content:"u.to"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002396; classtype:social-engineering; sid:6002396; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoeo.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoeo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002397; classtype:social-engineering; sid:6002397; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocorv.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocorv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002398; classtype:social-engineering; sid:6002398; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocavi.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocavi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002399; classtype:social-engineering; sid:6002399; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoyp.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoyp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002400; classtype:social-engineering; sid:6002400; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocork.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocork.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002401; classtype:social-engineering; sid:6002401; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metabnasklogem.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metabnasklogem.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002402; classtype:social-engineering; sid:6002402; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vnshort.com/MJo5)"; flow:established,to_server; http.uri; content:"/MJo5"; startswith; fast_pattern; http.host; content:"vnshort.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002403; classtype:social-engineering; sid:6002403; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.godecm.top/pay?kAk=Bm79i?vHg=5efgN%5Cr)"; flow:established,to_server; http.uri; content:"/pay?kAk=Bm79i?vHg=5efgN%5Cr"; startswith; fast_pattern; http.host; content:"t-mobile.godecm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002404; classtype:social-engineering; sid:6002404; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoyj.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoyj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002405; classtype:social-engineering; sid:6002405; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocotn.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocotn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002406; classtype:social-engineering; sid:6002406; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chixt-rizx.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"chixt-rizx.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002407; classtype:social-engineering; sid:6002407; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.loggs-mu.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.loggs-mu.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002408; classtype:social-engineering; sid:6002408; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.join-whatsapp-group-khaki.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.join-whatsapp-group-khaki.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002409; classtype:social-engineering; sid:6002409; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bpeqxi.top/pay?qwr=dHFBQ?uIZ=l9wxM)"; flow:established,to_server; http.uri; content:"/pay?qwr=dHFBQ?uIZ=l9wxM"; startswith; fast_pattern; http.host; content:"t-mobile.bpeqxi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002410; classtype:social-engineering; sid:6002410; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alessandrodevbp.github.io/Front-End-Project/)"; flow:established,to_server; http.uri; content:"/Front-End-Project/"; startswith; fast_pattern; http.host; content:"alessandrodevbp.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002411; classtype:social-engineering; sid:6002411; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocany.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocany.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002412; classtype:social-engineering; sid:6002412; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoyb.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoyb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002413; classtype:social-engineering; sid:6002413; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocorm.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocorm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002414; classtype:social-engineering; sid:6002414; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoum.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoum.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002415; classtype:social-engineering; sid:6002415; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoir.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoir.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002416; classtype:social-engineering; sid:6002416; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (modelmgmtgroup.com/taylor/index4.php)"; flow:established,to_server; http.uri; content:"/taylor/index4.php"; startswith; fast_pattern; http.host; content:"modelmgmtgroup.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002417; classtype:social-engineering; sid:6002417; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m16e.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m16e.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002418; classtype:social-engineering; sid:6002418; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (istockrf.com/Documetshared)"; flow:established,to_server; http.uri; content:"/Documetshared"; startswith; fast_pattern; http.host; content:"istockrf.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002419; classtype:social-engineering; sid:6002419; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoej.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoej.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002420; classtype:social-engineering; sid:6002420; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (360degreesgoldenhub-com.us.stackstaging.com/vendor/bin/carbone/my)"; flow:established,to_server; http.uri; content:"/vendor/bin/carbone/my"; startswith; fast_pattern; http.host; content:"360degreesgoldenhub-com.us.stackstaging.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002421; classtype:social-engineering; sid:6002421; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoei.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoei.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002422; classtype:social-engineering; sid:6002422; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocane.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocane.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002423; classtype:social-engineering; sid:6002423; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chixt-rizx.wasmer.app/en-us/)"; flow:established,to_server; http.uri; content:"/en-us/"; startswith; fast_pattern; http.host; content:"chixt-rizx.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002424; classtype:social-engineering; sid:6002424; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoun.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoun.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002425; classtype:social-engineering; sid:6002425; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dyaaka-meyhdi.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dyaaka-meyhdi.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002426; classtype:social-engineering; sid:6002426; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsaqq-qq.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsaqq-qq.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002427; classtype:social-engineering; sid:6002427; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocavi.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocavi.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002428; classtype:social-engineering; sid:6002428; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocorb.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocorb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002429; classtype:social-engineering; sid:6002429; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.roblox.com.ml/games/77747658251236/Sea-2-Update-Sailor-Piece?privateServerLinkCode=123173420535715543277593962283)"; flow:established,to_server; http.uri; content:"/games/77747658251236/Sea-2-Update-Sailor-Piece?privateServerLinkCode=123173420535715543277593962283"; startswith; fast_pattern; http.host; content:"www.roblox.com.ml"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002430; classtype:social-engineering; sid:6002430; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.roblox.com.ml/users/453070775256/profile)"; flow:established,to_server; http.uri; content:"/users/453070775256/profile"; startswith; fast_pattern; http.host; content:"www.roblox.com.ml"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002431; classtype:social-engineering; sid:6002431; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocouv.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocouv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002432; classtype:social-engineering; sid:6002432; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocang.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocang.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002433; classtype:social-engineering; sid:6002433; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dark-coder-2008.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"dark-coder-2008.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002434; classtype:social-engineering; sid:6002434; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.j58v.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.j58v.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002435; classtype:social-engineering; sid:6002435; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoih.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoih.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002436; classtype:social-engineering; sid:6002436; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocanr.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocanr.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002437; classtype:social-engineering; sid:6002437; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocaxw.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocaxw.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002438; classtype:social-engineering; sid:6002438; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (modelmgmtgroup.com/taylor/index3.php)"; flow:established,to_server; http.uri; content:"/taylor/index3.php"; startswith; fast_pattern; http.host; content:"modelmgmtgroup.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002439; classtype:social-engineering; sid:6002439; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoyt.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoyt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002440; classtype:social-engineering; sid:6002440; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocaxg.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocaxg.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002441; classtype:social-engineering; sid:6002441; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pubgmobile.maxstoday.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pubgmobile.maxstoday.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002442; classtype:social-engineering; sid:6002442; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocorc.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocorc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002443; classtype:social-engineering; sid:6002443; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocotj.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocotj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002444; classtype:social-engineering; sid:6002444; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ocrjvx.top/pay?Yop=weZoj?Xci=faPrT)"; flow:established,to_server; http.uri; content:"/pay?Yop=weZoj?Xci=faPrT"; startswith; fast_pattern; http.host; content:"t-mobile.ocrjvx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002445; classtype:social-engineering; sid:6002445; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (v3r1fikasi-b4dge.site/lanjut2.php)"; flow:established,to_server; http.uri; content:"/lanjut2.php"; startswith; fast_pattern; http.host; content:"v3r1fikasi-b4dge.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002446; classtype:social-engineering; sid:6002446; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocote.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocote.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002447; classtype:social-engineering; sid:6002447; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoyd.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoyd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002448; classtype:social-engineering; sid:6002448; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vexora.alwaysdata.net/home)"; flow:established,to_server; http.uri; content:"/home"; startswith; fast_pattern; http.host; content:"vexora.alwaysdata.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002449; classtype:social-engineering; sid:6002449; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.usbankproject2.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.usbankproject2.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002450; classtype:social-engineering; sid:6002450; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoii.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoii.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002451; classtype:social-engineering; sid:6002451; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoym.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoym.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002452; classtype:social-engineering; sid:6002452; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoef.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoef.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002453; classtype:social-engineering; sid:6002453; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoyz.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoyz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002454; classtype:social-engineering; sid:6002454; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoiq.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoiq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002455; classtype:social-engineering; sid:6002455; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ytr-hfds.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ytr-hfds.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002456; classtype:social-engineering; sid:6002456; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocanu.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocanu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002457; classtype:social-engineering; sid:6002457; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoen.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoen.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002458; classtype:social-engineering; sid:6002458; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (salesincreaseaccount.club/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"salesincreaseaccount.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002459; classtype:social-engineering; sid:6002459; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocouz.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocouz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002460; classtype:social-engineering; sid:6002460; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocaxu.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocaxu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002461; classtype:social-engineering; sid:6002461; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ibq7l54sl.myclickfunnels.com/ok)"; flow:established,to_server; http.uri; content:"/ok"; startswith; fast_pattern; http.host; content:"ibq7l54sl.myclickfunnels.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002462; classtype:social-engineering; sid:6002462; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocouh.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocouh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002463; classtype:social-engineering; sid:6002463; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoux.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoux.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002464; classtype:social-engineering; sid:6002464; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (umar302397.github.io/instagram-login/)"; flow:established,to_server; http.uri; content:"/instagram-login/"; startswith; fast_pattern; http.host; content:"umar302397.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002465; classtype:social-engineering; sid:6002465; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.j58t.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.j58t.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002466; classtype:social-engineering; sid:6002466; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoio.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoio.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002467; classtype:social-engineering; sid:6002467; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (elevage-des-bles.com/bniyycir/dfsj)"; flow:established,to_server; http.uri; content:"/bniyycir/dfsj"; startswith; fast_pattern; http.host; content:"elevage-des-bles.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002468; classtype:social-engineering; sid:6002468; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocotk.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocotk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002469; classtype:social-engineering; sid:6002469; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fndmy-support.com/app/webroot/script/navigation_compass_find_devices_login_b4_passcode4/2026/)"; flow:established,to_server; http.uri; content:"/app/webroot/script/navigation_compass_find_devices_login_b4_passcode4/2026/"; startswith; fast_pattern; http.host; content:"fndmy-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002470; classtype:social-engineering; sid:6002470; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoww.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoww.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002471; classtype:social-engineering; sid:6002471; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocotm.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocotm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002472; classtype:social-engineering; sid:6002472; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocabv.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocabv.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002473; classtype:social-engineering; sid:6002473; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (antai-amende-clients.justns.ru/amende-278764/Demos/)"; flow:established,to_server; http.uri; content:"/amende-278764/Demos/"; startswith; fast_pattern; http.host; content:"antai-amende-clients.justns.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002474; classtype:social-engineering; sid:6002474; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (13822.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"13822.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002475; classtype:social-engineering; sid:6002475; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kohwrb.top/pay?Bqd=rDsB6?NIT=aVcao%5Cr)"; flow:established,to_server; http.uri; content:"/pay?Bqd=rDsB6?NIT=aVcao%5Cr"; startswith; fast_pattern; http.host; content:"t-mobile.kohwrb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002476; classtype:social-engineering; sid:6002476; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoyc.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoyc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002477; classtype:social-engineering; sid:6002477; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (u16c.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"u16c.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002478; classtype:social-engineering; sid:6002478; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoul.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoul.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002479; classtype:social-engineering; sid:6002479; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocaxu.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocaxu.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002480; classtype:social-engineering; sid:6002480; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j58p.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j58p.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002481; classtype:social-engineering; sid:6002481; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoya.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoya.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002482; classtype:social-engineering; sid:6002482; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gemini-lugin.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gemini-lugin.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002483; classtype:social-engineering; sid:6002483; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (k66u.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"k66u.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002484; classtype:social-engineering; sid:6002484; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member245.business-support-partner.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member245.business-support-partner.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002485; classtype:social-engineering; sid:6002485; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nbqiux.top/pay?LFX=S6WQ4?Gwj=goCHb)"; flow:established,to_server; http.uri; content:"/pay?LFX=S6WQ4?Gwj=goCHb"; startswith; fast_pattern; http.host; content:"t-mobile.nbqiux.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002486; classtype:social-engineering; sid:6002486; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoys.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoys.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002487; classtype:social-engineering; sid:6002487; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoet.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoet.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002488; classtype:social-engineering; sid:6002488; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cristians-12.github.io/Netflix)"; flow:established,to_server; http.uri; content:"/Netflix"; startswith; fast_pattern; http.host; content:"cristians-12.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002489; classtype:social-engineering; sid:6002489; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qrco.de/bgoA6d)"; flow:established,to_server; http.uri; content:"/bgoA6d"; startswith; fast_pattern; http.host; content:"qrco.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002490; classtype:social-engineering; sid:6002490; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocorn.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocorn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002491; classtype:social-engineering; sid:6002491; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocout.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocout.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002492; classtype:social-engineering; sid:6002492; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoqp.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoqp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002493; classtype:social-engineering; sid:6002493; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (g11y.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"g11y.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002494; classtype:social-engineering; sid:6002494; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocouq.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocouq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002495; classtype:social-engineering; sid:6002495; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocouk.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocouk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002496; classtype:social-engineering; sid:6002496; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.roblox.com.ml/games/78896868574590/Untitled-Cons-Experience-New?privateServerLinkCode=425861301861783283899380535682)"; flow:established,to_server; http.uri; content:"/games/78896868574590/Untitled-Cons-Experience-New?privateServerLinkCode=425861301861783283899380535682"; startswith; fast_pattern; http.host; content:"www.roblox.com.ml"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002497; classtype:social-engineering; sid:6002497; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (modelmgmtgroup.com/taylor/folder.php?code=confirmfolder)"; flow:established,to_server; http.uri; content:"/taylor/folder.php?code=confirmfolder"; startswith; fast_pattern; http.host; content:"modelmgmtgroup.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002498; classtype:social-engineering; sid:6002498; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocort.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocort.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002499; classtype:social-engineering; sid:6002499; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.roblox.com.ml/users/477113844589/profile)"; flow:established,to_server; http.uri; content:"/users/477113844589/profile"; startswith; fast_pattern; http.host; content:"www.roblox.com.ml"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002500; classtype:social-engineering; sid:6002500; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoia.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoia.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002501; classtype:social-engineering; sid:6002501; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.html-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.html-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002502; classtype:social-engineering; sid:6002502; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (v3r1fikasi-b4dge.site/lanjut1.php)"; flow:established,to_server; http.uri; content:"/lanjut1.php"; startswith; fast_pattern; http.host; content:"v3r1fikasi-b4dge.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002503; classtype:social-engineering; sid:6002503; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocabq.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocabq.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002504; classtype:social-engineering; sid:6002504; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocanu.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocanu.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002505; classtype:social-engineering; sid:6002505; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoub.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoub.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002506; classtype:social-engineering; sid:6002506; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoqd.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoqd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002507; classtype:social-engineering; sid:6002507; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocanl.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocanl.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002508; classtype:social-engineering; sid:6002508; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (121jio.senes.at/stakings/?b=YTo0OntzOjU6ImxhYmVsIjtzOjE6IjkiO3M6MzoidXNyIjtpOjE1NjtzOjQ6Im5vcGQiO3M6MTU6InJzczMucmVhZGxlcy5hdCI7czoxOiJvIjtpOjExMzY7fQ==)"; flow:established,to_server; http.uri; content:"/stakings/?b=YTo0OntzOjU6ImxhYmVsIjtzOjE6IjkiO3M6MzoidXNyIjtpOjE1NjtzOjQ6Im5vcGQiO3M6MTU6InJzczMucmVhZGxlcy5hdCI7czoxOiJvIjtpOjExMzY7fQ=="; startswith; fast_pattern; http.host; content:"121jio.senes.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002509; classtype:social-engineering; sid:6002509; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bxpewi.top/pay?uhL=quTsp?HtH=sstT6)"; flow:established,to_server; http.uri; content:"/pay?uhL=quTsp?HtH=sstT6"; startswith; fast_pattern; http.host; content:"t-mobile.bxpewi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002510; classtype:social-engineering; sid:6002510; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vexora.alwaysdata.net/account/signupredir)"; flow:established,to_server; http.uri; content:"/account/signupredir"; startswith; fast_pattern; http.host; content:"vexora.alwaysdata.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002511; classtype:social-engineering; sid:6002511; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocouj.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocouj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002512; classtype:social-engineering; sid:6002512; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j60b.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j60b.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002513; classtype:social-engineering; sid:6002513; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoit.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoit.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002514; classtype:social-engineering; sid:6002514; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.j58o.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.j58o.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002515; classtype:social-engineering; sid:6002515; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocanb.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocanb.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002516; classtype:social-engineering; sid:6002516; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bbzuche.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bbzuche.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002517; classtype:social-engineering; sid:6002517; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoij.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoij.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002518; classtype:social-engineering; sid:6002518; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoiw.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoiw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002519; classtype:social-engineering; sid:6002519; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.roblox.com.ml/games/102208116895989/Untitled-Experience?privateServerLinkCode=247772518604175568104568742480)"; flow:established,to_server; http.uri; content:"/games/102208116895989/Untitled-Experience?privateServerLinkCode=247772518604175568104568742480"; startswith; fast_pattern; http.host; content:"www.roblox.com.ml"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002520; classtype:social-engineering; sid:6002520; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hkrbsu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hkrbsu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002521; classtype:social-engineering; sid:6002521; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sharath24-prog.github.io/Amazone-clone/)"; flow:established,to_server; http.uri; content:"/Amazone-clone/"; startswith; fast_pattern; http.host; content:"sharath24-prog.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002522; classtype:social-engineering; sid:6002522; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocotw.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocotw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002523; classtype:social-engineering; sid:6002523; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.aoxdvh.top/pay?HCE=q7pHq?nRn=53ZE3)"; flow:established,to_server; http.uri; content:"/pay?HCE=q7pHq?nRn=53ZE3"; startswith; fast_pattern; http.host; content:"t-mobile.aoxdvh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002524; classtype:social-engineering; sid:6002524; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocans.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocans.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002525; classtype:social-engineering; sid:6002525; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (buscar-es.info/script/navigation_compass_find_devices_login_b4_passcode4/2026)"; flow:established,to_server; http.uri; content:"/script/navigation_compass_find_devices_login_b4_passcode4/2026"; startswith; fast_pattern; http.host; content:"buscar-es.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002526; classtype:social-engineering; sid:6002526; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nbqyux.top/pay?JHi=xpECn?naa=j0Ntr)"; flow:established,to_server; http.uri; content:"/pay?JHi=xpECn?naa=j0Ntr"; startswith; fast_pattern; http.host; content:"t-mobile.nbqyux.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002527; classtype:social-engineering; sid:6002527; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoyi.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoyi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002528; classtype:social-engineering; sid:6002528; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocotf.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocotf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002529; classtype:social-engineering; sid:6002529; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (join-whatsapp-group-khaki.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"join-whatsapp-group-khaki.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002530; classtype:social-engineering; sid:6002530; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoyr.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoyr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002531; classtype:social-engineering; sid:6002531; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoyx.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoyx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002532; classtype:social-engineering; sid:6002532; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my-site-106282-103757.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"my-site-106282-103757.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002533; classtype:social-engineering; sid:6002533; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocany.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocany.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002534; classtype:social-engineering; sid:6002534; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocotb.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocotb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002535; classtype:social-engineering; sid:6002535; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocacs.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocacs.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002536; classtype:social-engineering; sid:6002536; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-xi-opal.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-xi-opal.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002537; classtype:social-engineering; sid:6002537; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocotp.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocotp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002538; classtype:social-engineering; sid:6002538; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (y225f.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"y225f.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002539; classtype:social-engineering; sid:6002539; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hysgwx.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hysgwx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002540; classtype:social-engineering; sid:6002540; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoud.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoud.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002541; classtype:social-engineering; sid:6002541; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loggs-mu.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"loggs-mu.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002542; classtype:social-engineering; sid:6002542; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoyv.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoyv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002543; classtype:social-engineering; sid:6002543; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocouy.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocouy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002544; classtype:social-engineering; sid:6002544; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoti.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoti.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002545; classtype:social-engineering; sid:6002545; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoyo.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoyo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002546; classtype:social-engineering; sid:6002546; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocacm.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocacm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002547; classtype:social-engineering; sid:6002547; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aponcht.info/?app_vl=ZoFwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj)"; flow:established,to_server; http.uri; content:"/?app_vl=ZoFwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj"; startswith; fast_pattern; http.host; content:"aponcht.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002548; classtype:social-engineering; sid:6002548; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jellyfish-app-jsmsz.ondigitalocean.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jellyfish-app-jsmsz.ondigitalocean.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002549; classtype:social-engineering; sid:6002549; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.roblox.com.ml/users/132558458859/profile)"; flow:established,to_server; http.uri; content:"/users/132558458859/profile"; startswith; fast_pattern; http.host; content:"www.roblox.com.ml"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002550; classtype:social-engineering; sid:6002550; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocouf.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocouf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002551; classtype:social-engineering; sid:6002551; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocani.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocani.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002552; classtype:social-engineering; sid:6002552; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocous.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocous.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002553; classtype:social-engineering; sid:6002553; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoid.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoid.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002554; classtype:social-engineering; sid:6002554; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocotg.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocotg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002555; classtype:social-engineering; sid:6002555; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoyq.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoyq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002556; classtype:social-engineering; sid:6002556; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoro.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoro.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002557; classtype:social-engineering; sid:6002557; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocamz.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocamz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002558; classtype:social-engineering; sid:6002558; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support-user.accounts-admin-agency.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"support-user.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002559; classtype:social-engineering; sid:6002559; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocois.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocois.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002560; classtype:social-engineering; sid:6002560; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocowf.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocowf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002561; classtype:social-engineering; sid:6002561; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (desjokiy9855.zya.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"desjokiy9855.zya.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002562; classtype:social-engineering; sid:6002562; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moon-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moon-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002563; classtype:social-engineering; sid:6002563; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acessogerenciapj.digital/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"acessogerenciapj.digital"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002564; classtype:social-engineering; sid:6002564; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gioerdsxctvbnm.z9.web.core.windows.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gioerdsxctvbnm.z9.web.core.windows.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002565; classtype:social-engineering; sid:6002565; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (php-web-server--juarezmichelsui.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"php-web-server--juarezmichelsui.replit.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002566; classtype:social-engineering; sid:6002566; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e-stat.b8no2fhz.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e-stat.b8no2fhz.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002567; classtype:social-engineering; sid:6002567; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vsemiralbom.cyou/id=5129515)"; flow:established,to_server; http.uri; content:"/id=5129515"; startswith; fast_pattern; http.host; content:"vsemiralbom.cyou"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002568; classtype:social-engineering; sid:6002568; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (liderbci.today/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"liderbci.today"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002569; classtype:social-engineering; sid:6002569; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocanl.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocanl.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002570; classtype:social-engineering; sid:6002570; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp720021.sitebeat.crazydomains.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp720021.sitebeat.crazydomains.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002571; classtype:social-engineering; sid:6002571; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (msbdjdhdjd.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"msbdjdhdjd.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002572; classtype:social-engineering; sid:6002572; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paypay-card.hpvtwnt.cn/fingerprint.php)"; flow:established,to_server; http.uri; content:"/fingerprint.php"; startswith; fast_pattern; http.host; content:"paypay-card.hpvtwnt.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002573; classtype:social-engineering; sid:6002573; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.8301273483231.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalnie.8301273483231.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002574; classtype:social-engineering; sid:6002574; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dals-consulting.ru/view.html)"; flow:established,to_server; http.uri; content:"/view.html"; startswith; fast_pattern; http.host; content:"dals-consulting.ru"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002575; classtype:social-engineering; sid:6002575; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paypay-card.vrsbska.cn/fingerprint.php)"; flow:established,to_server; http.uri; content:"/fingerprint.php"; startswith; fast_pattern; http.host; content:"paypay-card.vrsbska.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002576; classtype:social-engineering; sid:6002576; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-b1ef8f17aee4422ea6e540d52aa305f0.r2.dev/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-b1ef8f17aee4422ea6e540d52aa305f0.r2.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002577; classtype:social-engineering; sid:6002577; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (startioenledgr.wixstudio.com/us--en)"; flow:established,to_server; http.uri; content:"/us--en"; startswith; fast_pattern; http.host; content:"startioenledgr.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002578; classtype:social-engineering; sid:6002578; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie.prywan5238729h-45.lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.prywan5238729h-45.lat"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002579; classtype:social-engineering; sid:6002579; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (liveglive-eng.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"liveglive-eng.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002580; classtype:social-engineering; sid:6002580; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.conviviumcucine.it/softaculous/backup/primera/digitoken/auth/login.php)"; flow:established,to_server; http.uri; content:"/softaculous/backup/primera/digitoken/auth/login.php"; startswith; fast_pattern; http.host; content:"www.conviviumcucine.it"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002581; classtype:social-engineering; sid:6002581; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie.849102g90o.cyou/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.849102g90o.cyou"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002582; classtype:social-engineering; sid:6002582; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.925389h451.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.925389h451.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002583; classtype:social-engineering; sid:6002583; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paypay-card.aqvgnzr.cn/fingerprint.php)"; flow:established,to_server; http.uri; content:"/fingerprint.php"; startswith; fast_pattern; http.host; content:"paypay-card.aqvgnzr.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002584; classtype:social-engineering; sid:6002584; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ogk-kunden-id-874532.dudaone.com/ogk)"; flow:established,to_server; http.uri; content:"/ogk"; startswith; fast_pattern; http.host; content:"ogk-kunden-id-874532.dudaone.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002585; classtype:social-engineering; sid:6002585; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paypay-card.hdgfzkr.cn/fingerprint.php)"; flow:established,to_server; http.uri; content:"/fingerprint.php"; startswith; fast_pattern; http.host; content:"paypay-card.hdgfzkr.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002586; classtype:social-engineering; sid:6002586; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocowz.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocowz.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002587; classtype:social-engineering; sid:6002587; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.aukcj82180-43h4.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalnie.aukcj82180-43h4.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002588; classtype:social-engineering; sid:6002588; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (udhdhshyy68.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"udhdhshyy68.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002589; classtype:social-engineering; sid:6002589; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metasecurityuser.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metasecurityuser.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002590; classtype:social-engineering; sid:6002590; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokainie.925389h451.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokainie.925389h451.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002591; classtype:social-engineering; sid:6002591; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faqs-lognlive.wixstudio.com/live-en)"; flow:established,to_server; http.uri; content:"/live-en"; startswith; fast_pattern; http.host; content:"faqs-lognlive.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002592; classtype:social-engineering; sid:6002592; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.contact.botticelliri.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.contact.botticelliri.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002593; classtype:social-engineering; sid:6002593; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paypay-card.xnlscku.cn/fingerprint.php)"; flow:established,to_server; http.uri; content:"/fingerprint.php"; startswith; fast_pattern; http.host; content:"paypay-card.xnlscku.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002594; classtype:social-engineering; sid:6002594; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ceaserespomain.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ceaserespomain.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002595; classtype:social-engineering; sid:6002595; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trdestekmerkezi.com.tr/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trdestekmerkezi.com.tr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002596; classtype:social-engineering; sid:6002596; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (signin.broker/E.YARKk_Vd9G7HyQ)"; flow:established,to_server; http.uri; content:"/E.YARKk_Vd9G7HyQ"; startswith; fast_pattern; http.host; content:"signin.broker"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002597; classtype:social-engineering; sid:6002597; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tyusd-rizx.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tyusd-rizx.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002598; classtype:social-engineering; sid:6002598; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reimagined-funicular-jmjb.vercel.app/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"reimagined-funicular-jmjb.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002599; classtype:social-engineering; sid:6002599; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id90013.agency-manager-support.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id90013.agency-manager-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002600; classtype:social-engineering; sid:6002600; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (balanoca.github.io/PrototipeUXUI)"; flow:established,to_server; http.uri; content:"/PrototipeUXUI"; startswith; fast_pattern; http.host; content:"balanoca.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002601; classtype:social-engineering; sid:6002601; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (danaa-iindonesiaa.xbb.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"danaa-iindonesiaa.xbb.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002602; classtype:social-engineering; sid:6002602; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instaclone-ecru.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instaclone-ecru.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002603; classtype:social-engineering; sid:6002603; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2565select-fthcapital-plans6898.pages.dev/help/contact/577042977161189)"; flow:established,to_server; http.uri; content:"/help/contact/577042977161189"; startswith; fast_pattern; http.host; content:"2565select-fthcapital-plans6898.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002604; classtype:social-engineering; sid:6002604; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (emesshtenmain.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"emesshtenmain.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002605; classtype:social-engineering; sid:6002605; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (datamod-syncpath.pages.dev/two_step_verification/authentication/?ts=1)"; flow:established,to_server; http.uri; content:"/two_step_verification/authentication/?ts=1"; startswith; fast_pattern; http.host; content:"datamod-syncpath.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002606; classtype:social-engineering; sid:6002606; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta.badge-blue.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta.badge-blue.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002607; classtype:social-engineering; sid:6002607; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (radioazul.pt/Config/net/login.php)"; flow:established,to_server; http.uri; content:"/Config/net/login.php"; startswith; fast_pattern; http.host; content:"radioazul.pt"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002608; classtype:social-engineering; sid:6002608; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ramadabywyndhamdubaibarshaheights.spahotel.guru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ramadabywyndhamdubaibarshaheights.spahotel.guru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002609; classtype:social-engineering; sid:6002609; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uploaded-rizx.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uploaded-rizx.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002610; classtype:social-engineering; sid:6002610; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (microphones.live/script/navigation_compass_find_devices_login_b4_passcode4/2026)"; flow:established,to_server; http.uri; content:"/script/navigation_compass_find_devices_login_b4_passcode4/2026"; startswith; fast_pattern; http.host; content:"microphones.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002611; classtype:social-engineering; sid:6002611; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trongdatlaptrinh.github.io/clonefacebooktest/)"; flow:established,to_server; http.uri; content:"/clonefacebooktest/"; startswith; fast_pattern; http.host; content:"trongdatlaptrinh.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002612; classtype:social-engineering; sid:6002612; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my-site-106543-104668.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"my-site-106543-104668.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002613; classtype:social-engineering; sid:6002613; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (x61l.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"x61l.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002614; classtype:social-engineering; sid:6002614; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prahallad447.github.io/Amazon-Clone)"; flow:established,to_server; http.uri; content:"/Amazon-Clone"; startswith; fast_pattern; http.host; content:"prahallad447.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002615; classtype:social-engineering; sid:6002615; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ty691.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ty691.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002616; classtype:social-engineering; sid:6002616; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inquestmainrespo.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"inquestmainrespo.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002617; classtype:social-engineering; sid:6002617; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticra.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-noticra.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002618; classtype:social-engineering; sid:6002618; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (main012responfd.wasmer.app/vick-medicamentos)"; flow:established,to_server; http.uri; content:"/vick-medicamentos"; startswith; fast_pattern; http.host; content:"main012responfd.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002619; classtype:social-engineering; sid:6002619; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (materillos142542.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"materillos142542.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002620; classtype:social-engineering; sid:6002620; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mobile-circumstances-687068.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mobile-circumstances-687068.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002621; classtype:social-engineering; sid:6002621; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lo-sd.pro/app/webroot/script/navigation_compass_find_devices_login_b4_passcode4/2026/)"; flow:established,to_server; http.uri; content:"/app/webroot/script/navigation_compass_find_devices_login_b4_passcode4/2026/"; startswith; fast_pattern; http.host; content:"lo-sd.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002622; classtype:social-engineering; sid:6002622; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mx2026mail.iceiy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mx2026mail.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002623; classtype:social-engineering; sid:6002623; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (userr-access-supporrt.vercel.app/privacy-center/)"; flow:established,to_server; http.uri; content:"/privacy-center/"; startswith; fast_pattern; http.host; content:"userr-access-supporrt.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002624; classtype:social-engineering; sid:6002624; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (many-tables-304491.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"many-tables-304491.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002625; classtype:social-engineering; sid:6002625; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (served.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"served.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002626; classtype:social-engineering; sid:6002626; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (liyanmubarak.github.io/Apple-Homepage)"; flow:established,to_server; http.uri; content:"/Apple-Homepage"; startswith; fast_pattern; http.host; content:"liyanmubarak.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002627; classtype:social-engineering; sid:6002627; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id90012.agency-manager-support.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id90012.agency-manager-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002628; classtype:social-engineering; sid:6002628; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreifyh6tqbcm3w3hza5yhlmnkxtcoar2f3jnmr5jqflsirpdcsilsja.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreifyh6tqbcm3w3hza5yhlmnkxtcoar2f3jnmr5jqflsirpdcsilsja.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002629; classtype:social-engineering; sid:6002629; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (modspoti.com/about-us/)"; flow:established,to_server; http.uri; content:"/about-us/"; startswith; fast_pattern; http.host; content:"modspoti.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002630; classtype:social-engineering; sid:6002630; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (claim-danaa-pending.naa.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"claim-danaa-pending.naa.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002631; classtype:social-engineering; sid:6002631; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ts-stavby.cz/wp-content/plugins/pwnd/ffffffff/rr.html)"; flow:established,to_server; http.uri; content:"/wp-content/plugins/pwnd/ffffffff/rr.html"; startswith; fast_pattern; http.host; content:"ts-stavby.cz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002632; classtype:social-engineering; sid:6002632; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth.properties/E.iGQtgI6tfy3P3xA)"; flow:established,to_server; http.uri; content:"/E.iGQtgI6tfy3P3xA"; startswith; fast_pattern; http.host; content:"auth.properties"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002633; classtype:social-engineering; sid:6002633; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sulcet-vegonia-7f917b.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sulcet-vegonia-7f917b.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002634; classtype:social-engineering; sid:6002634; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17621.invoice-partner.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17621.invoice-partner.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002635; classtype:social-engineering; sid:6002635; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.sharesdashboards.info/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639146735482145274.ZGEyNDMzZjktNzk3Mi00MzE5LTliNWEtY2JmZjY5NTU2ZDNiOTQ4M2YzOTUtYzFlNS00Mzc1LWJjMGYtMmI3MzIyZjI1YjM0&ui_locales=en-US&mkt=en-US&client-request-id=e73901af-cf73-4bc8-a1cf-75414cac0f85&state=QmJCmUQidVFG6rVZdq62gKWzjFA6uqU3kaWsJe775M-ZOJ1g35a59WFzNhZXGqOsYV667IPNDOjZ3wJwC6ntCqyprYhLbx-bpW9Gc5e6wRoS4bwGVJFqdVI4OgRK5vNf0P5SYP5J4BTXYKHE7LVqRGayY9hg0NBLLREy4zXFPkQ-BIq1zznwMOF25GtmnAQu6zDPat_t9OSKVFaAH4ycZTyiDYhB20vYWjAFyZ76l-8AtOwyt8CADT6J9Bvfar-viKVLrm01vNseUiC1nOmybK5lCN_ECPWKDi9NZZ8R-ntWMUtk5cQ5m1yftBSURgnoUVOR2vNAEU14ykIPxVXthisD76WYM89gvfER72-UQugVqwTvQ5uvc5tHGIgR9XExv3G-JsNJf0PiE25x-fpBliVPz9HP8Kb3uJ9APrJ80_o&x-client-SKU=ID_NET8_0&x-client-ver=8.14.0.0)"; flow:established,to_server; http.uri; content:"/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639146735482145274.ZGEyNDMzZjktNzk3Mi00MzE5LTliNWEtY2JmZjY5NTU2ZDNiOTQ4M2YzOTUtYzFlNS00Mzc1LWJjMGYtMmI3MzIyZjI1YjM0&ui_locales=en-US&mkt=en-US&client-request-id=e73901af-cf73-4bc8-a1cf-75414cac0f85&state=QmJCmUQidVFG6rVZdq62gKWzjFA6uqU3kaWsJe775M-ZOJ1g35a59WFzNhZXGqOsYV667IPNDOjZ3wJwC6ntCqyprYhLbx-bpW9Gc5e6wRoS4bwGVJFqdVI4OgRK5vNf0P5SYP5J4BTXYKHE7LVqRGayY9hg0NBLLREy4zXFPkQ-BIq1zznwMOF25GtmnAQu6zDPat_t9OSKVFaAH4ycZTyiDYhB20vYWjAFyZ76l-8AtOwyt8CADT6J9Bvfar-viKVLrm01vNseUiC1nOmybK5lCN_ECPWKDi9NZZ8R-ntWMUtk5cQ5m1yftBSURgnoUVOR2vNAEU14ykIPxVXthisD76WYM89gvfER72-UQugVqwTvQ5uvc5tHGIgR9XExv3G-JsNJf0PiE25x-fpBliVPz9HP8Kb3uJ9APrJ80_o&x-client-SKU=ID_NET8_0&x-client-ver=8.14.0.0"; startswith; fast_pattern; http.host; content:"login.sharesdashboards.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002636; classtype:social-engineering; sid:6002636; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.totalitarianassignmentcpos.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.totalitarianassignmentcpos.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002637; classtype:social-engineering; sid:6002637; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wordpress-211666-0.cloudclusters.net/CH/swisspass-V10993/wcp/)"; flow:established,to_server; http.uri; content:"/CH/swisspass-V10993/wcp/"; startswith; fast_pattern; http.host; content:"wordpress-211666-0.cloudclusters.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002638; classtype:social-engineering; sid:6002638; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (radioazul.pt/Config)"; flow:established,to_server; http.uri; content:"/Config"; startswith; fast_pattern; http.host; content:"radioazul.pt"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002639; classtype:social-engineering; sid:6002639; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-ftfn88kgl-sebin-leeee.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-ftfn88kgl-sebin-leeee.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002640; classtype:social-engineering; sid:6002640; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth.properties/E.TUGMHUIloek)"; flow:established,to_server; http.uri; content:"/E.TUGMHUIloek"; startswith; fast_pattern; http.host; content:"auth.properties"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002641; classtype:social-engineering; sid:6002641; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (microphones.live/app/webroot/script/navigation_compass_find_devices_login_b4_passcode4/2026/)"; flow:established,to_server; http.uri; content:"/app/webroot/script/navigation_compass_find_devices_login_b4_passcode4/2026/"; startswith; fast_pattern; http.host; content:"microphones.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002642; classtype:social-engineering; sid:6002642; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amp.padiisahbet.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amp.padiisahbet.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002643; classtype:social-engineering; sid:6002643; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (70000ylg.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"70000ylg.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002644; classtype:social-engineering; sid:6002644; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17622.invoice-partner.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17622.invoice-partner.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002645; classtype:social-engineering; sid:6002645; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth.properties/E.FRA_-O42-a5d)"; flow:established,to_server; http.uri; content:"/E.FRA_-O42-a5d"; startswith; fast_pattern; http.host; content:"auth.properties"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002646; classtype:social-engineering; sid:6002646; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lo-sd.pro/script/navigation_compass_find_devices_login_b4_passcode4/2026)"; flow:established,to_server; http.uri; content:"/script/navigation_compass_find_devices_login_b4_passcode4/2026"; startswith; fast_pattern; http.host; content:"lo-sd.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002647; classtype:social-engineering; sid:6002647; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-datalink.org/landing/form/5e42684b-bad0-49ae-9d0c-b2e349deea7c)"; flow:established,to_server; http.uri; content:"/landing/form/5e42684b-bad0-49ae-9d0c-b2e349deea7c"; startswith; fast_pattern; http.host; content:"secure-datalink.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002648; classtype:social-engineering; sid:6002648; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (materillos052.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"materillos052.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002649; classtype:social-engineering; sid:6002649; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myassitance-eu.com/app/webroot/script/navigation_compass_find_devices_login_b4_passcode4/2026)"; flow:established,to_server; http.uri; content:"/app/webroot/script/navigation_compass_find_devices_login_b4_passcode4/2026"; startswith; fast_pattern; http.host; content:"myassitance-eu.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002650; classtype:social-engineering; sid:6002650; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fconline-coupon-vn.com/34c9ce58925980b917abbd4b3e91e904FB)"; flow:established,to_server; http.uri; content:"/34c9ce58925980b917abbd4b3e91e904FB"; startswith; fast_pattern; http.host; content:"fconline-coupon-vn.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002651; classtype:social-engineering; sid:6002651; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faccebook.com.vn/yddzzhjz04r)"; flow:established,to_server; http.uri; content:"/yddzzhjz04r"; startswith; fast_pattern; http.host; content:"faccebook.com.vn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002652; classtype:social-engineering; sid:6002652; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreicofbocxwfkm37oeouqsf32un233brcpryiqrih4dync526oahg24.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreicofbocxwfkm37oeouqsf32un233brcpryiqrih4dync526oahg24.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002653; classtype:social-engineering; sid:6002653; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee1579.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopee1579.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002654; classtype:social-engineering; sid:6002654; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (emzor500-del.github.io/Login-gain-)"; flow:established,to_server; http.uri; content:"/Login-gain-"; startswith; fast_pattern; http.host; content:"emzor500-del.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002655; classtype:social-engineering; sid:6002655; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spectaculart.fr/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spectaculart.fr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002656; classtype:social-engineering; sid:6002656; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (554yabo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"554yabo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002657; classtype:social-engineering; sid:6002657; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (domian-turnstile-52498.pages.dev/help/contact/509299373941883/)"; flow:established,to_server; http.uri; content:"/help/contact/509299373941883/"; startswith; fast_pattern; http.host; content:"domian-turnstile-52498.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002658; classtype:social-engineering; sid:6002658; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (register11.agency-partner-management.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"register11.agency-partner-management.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002659; classtype:social-engineering; sid:6002659; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (danaaindonesiaax.resmi-bkdd3.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"danaaindonesiaax.resmi-bkdd3.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002660; classtype:social-engineering; sid:6002660; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fedex.com-check.top/I)"; flow:established,to_server; http.uri; content:"/I"; startswith; fast_pattern; http.host; content:"fedex.com-check.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002661; classtype:social-engineering; sid:6002661; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (soupinit.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"soupinit.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002662; classtype:social-engineering; sid:6002662; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nanguang.cyou/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nanguang.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002663; classtype:social-engineering; sid:6002663; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (135461223.site/sv/404/9be5480d-22fd-4f93-9f7f-678f38427770/740075/x)"; flow:established,to_server; http.uri; content:"/sv/404/9be5480d-22fd-4f93-9f7f-678f38427770/740075/x"; startswith; fast_pattern; http.host; content:"135461223.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002664; classtype:social-engineering; sid:6002664; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s115n.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"s115n.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002665; classtype:social-engineering; sid:6002665; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt-it.sbs/IT/)"; flow:established,to_server; http.uri; content:"/IT/"; startswith; fast_pattern; http.host; content:"brt-it.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002666; classtype:social-engineering; sid:6002666; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (courtyardbymarriottworldtradecentredubai.spahotel.guru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"courtyardbymarriottworldtradecentredubai.spahotel.guru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002667; classtype:social-engineering; sid:6002667; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazonshoppingmallorua.com/yddzzhjz04r?a)"; flow:established,to_server; http.uri; content:"/yddzzhjz04r?a"; startswith; fast_pattern; http.host; content:"amazonshoppingmallorua.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002668; classtype:social-engineering; sid:6002668; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (x60m.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"x60m.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002669; classtype:social-engineering; sid:6002669; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (peaceful-croquembouche-e372ce.netlify.app/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"peaceful-croquembouche-e372ce.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002670; classtype:social-engineering; sid:6002670; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pemulihaanakunda.naa.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pemulihaanakunda.naa.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002671; classtype:social-engineering; sid:6002671; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17625.invoice-partner.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17625.invoice-partner.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002672; classtype:social-engineering; sid:6002672; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (isokonsulterna.se/loks/public_html/php/)"; flow:established,to_server; http.uri; content:"/loks/public_html/php/"; startswith; fast_pattern; http.host; content:"isokonsulterna.se"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002673; classtype:social-engineering; sid:6002673; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (111116js.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"111116js.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002674; classtype:social-engineering; sid:6002674; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (materillos57200.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"materillos57200.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002675; classtype:social-engineering; sid:6002675; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (capacity.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"capacity.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002676; classtype:social-engineering; sid:6002676; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (djdjdibrahimaaa.myvnc.com/PETITEZOOSAL/)"; flow:established,to_server; http.uri; content:"/PETITEZOOSAL/"; startswith; fast_pattern; http.host; content:"djdjdibrahimaaa.myvnc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002677; classtype:social-engineering; sid:6002677; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17626.invoice-partner.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17626.invoice-partner.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002678; classtype:social-engineering; sid:6002678; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (domian-turnstile-52498.pages.dev/help/contact/622213844993870/)"; flow:established,to_server; http.uri; content:"/help/contact/622213844993870/"; startswith; fast_pattern; http.host; content:"domian-turnstile-52498.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002679; classtype:social-engineering; sid:6002679; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fdafda.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fdafda.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002680; classtype:social-engineering; sid:6002680; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suite1.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"suite1.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002681; classtype:social-engineering; sid:6002681; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (majekmassmain.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"majekmassmain.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002682; classtype:social-engineering; sid:6002682; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6a0a6cffd3770e27f7d0cb2f--stunning-kulfi-2ae33b.netlify.app/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"6a0a6cffd3770e27f7d0cb2f--stunning-kulfi-2ae33b.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002683; classtype:social-engineering; sid:6002683; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (signin.broker/E.wp4V3qWrQ-0)"; flow:established,to_server; http.uri; content:"/E.wp4V3qWrQ-0"; startswith; fast_pattern; http.host; content:"signin.broker"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002684; classtype:social-engineering; sid:6002684; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee1579.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.shopee1579.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002685; classtype:social-engineering; sid:6002685; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (domian-turnstile-52498.pages.dev/help/contact/380440364752052/)"; flow:established,to_server; http.uri; content:"/help/contact/380440364752052/"; startswith; fast_pattern; http.host; content:"domian-turnstile-52498.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002686; classtype:social-engineering; sid:6002686; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dhlservicepoint.rs/en/express-easy/)"; flow:established,to_server; http.uri; content:"/en/express-easy/"; startswith; fast_pattern; http.host; content:"dhlservicepoint.rs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002687; classtype:social-engineering; sid:6002687; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth.properties/E.oOPch4m2F4EkyCM)"; flow:established,to_server; http.uri; content:"/E.oOPch4m2F4EkyCM"; startswith; fast_pattern; http.host; content:"auth.properties"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002688; classtype:social-engineering; sid:6002688; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.padiisahbet.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.padiisahbet.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002689; classtype:social-engineering; sid:6002689; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1mycloud-drive-getnotificatiobdocument.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1mycloud-drive-getnotificatiobdocument.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002690; classtype:social-engineering; sid:6002690; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wvvv-lcloud.us/app/webroot/script/navigation_compass_find_devices_login_b4_passcode4/2026)"; flow:established,to_server; http.uri; content:"/app/webroot/script/navigation_compass_find_devices_login_b4_passcode4/2026"; startswith; fast_pattern; http.host; content:"wvvv-lcloud.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002691; classtype:social-engineering; sid:6002691; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (att-bonus.com.mx/historialrecargas)"; flow:established,to_server; http.uri; content:"/historialrecargas"; startswith; fast_pattern; http.host; content:"att-bonus.com.mx"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002692; classtype:social-engineering; sid:6002692; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedagiodigital-flow.com/vias/home.php)"; flow:established,to_server; http.uri; content:"/vias/home.php"; startswith; fast_pattern; http.host; content:"pedagiodigital-flow.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002693; classtype:social-engineering; sid:6002693; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (danaa-iindonesiaa.ybb.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"danaa-iindonesiaa.ybb.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002694; classtype:social-engineering; sid:6002694; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (36476-dashcloud.pages.dev/838669997977623/)"; flow:established,to_server; http.uri; content:"/838669997977623/"; startswith; fast_pattern; http.host; content:"36476-dashcloud.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002695; classtype:social-engineering; sid:6002695; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1289js.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1289js.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002696; classtype:social-engineering; sid:6002696; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acccount-centers-password-and-security-vbnad.pages.dev/changepassmoblie)"; flow:established,to_server; http.uri; content:"/changepassmoblie"; startswith; fast_pattern; http.host; content:"acccount-centers-password-and-security-vbnad.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002697; classtype:social-engineering; sid:6002697; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tqw-rizx.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tqw-rizx.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002698; classtype:social-engineering; sid:6002698; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wfomega.com/sond/modr1/konda1.html)"; flow:established,to_server; http.uri; content:"/sond/modr1/konda1.html"; startswith; fast_pattern; http.host; content:"wfomega.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002699; classtype:social-engineering; sid:6002699; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocotk.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocotk.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002700; classtype:social-engineering; sid:6002700; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-clone-login.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-clone-login.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002701; classtype:social-engineering; sid:6002701; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (materillos02245.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"materillos02245.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002702; classtype:social-engineering; sid:6002702; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (insects.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"insects.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002703; classtype:social-engineering; sid:6002703; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-git-03-30-fixwebrefactorscrollhandlingforpor-de5ef4-uniswap.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-git-03-30-fixwebrefactorscrollhandlingforpor-de5ef4-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002704; classtype:social-engineering; sid:6002704; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apple.app-maps.co/app/webroot/script/navigation_compass_find_devices_login_b4_passcode4/2026)"; flow:established,to_server; http.uri; content:"/app/webroot/script/navigation_compass_find_devices_login_b4_passcode4/2026"; startswith; fast_pattern; http.host; content:"apple.app-maps.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002705; classtype:social-engineering; sid:6002705; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login-sand-two.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"login-sand-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002706; classtype:social-engineering; sid:6002706; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s20j.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"s20j.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002707; classtype:social-engineering; sid:6002707; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17619.invoice-partner.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17619.invoice-partner.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002708; classtype:social-engineering; sid:6002708; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.vdhedheb.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.vdhedheb.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002709; classtype:social-engineering; sid:6002709; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lost-apple.com/app/webroot/script/navigation_compass_find_devices_login_b4_passcode4/2026)"; flow:established,to_server; http.uri; content:"/app/webroot/script/navigation_compass_find_devices_login_b4_passcode4/2026"; startswith; fast_pattern; http.host; content:"lost-apple.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002710; classtype:social-engineering; sid:6002710; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticea.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-noticea.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002711; classtype:social-engineering; sid:6002711; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id90015.agency-manager-support.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id90015.agency-manager-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002712; classtype:social-engineering; sid:6002712; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.waddyworks.com/-/EB-app/)"; flow:established,to_server; http.uri; content:"/-/EB-app/"; startswith; fast_pattern; http.host; content:"www.waddyworks.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002713; classtype:social-engineering; sid:6002713; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.x112d.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.x112d.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002714; classtype:social-engineering; sid:6002714; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appleid.login-alertid.info/app/webroot/script/navigation_compass_find_devices_login_b4_passcode4/2026)"; flow:established,to_server; http.uri; content:"/app/webroot/script/navigation_compass_find_devices_login_b4_passcode4/2026"; startswith; fast_pattern; http.host; content:"appleid.login-alertid.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002715; classtype:social-engineering; sid:6002715; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6a0a694755042e46fb19a7a3--thriving-belekoy-aae7c3.netlify.app/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"6a0a694755042e46fb19a7a3--thriving-belekoy-aae7c3.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002716; classtype:social-engineering; sid:6002716; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-react-blue.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-react-blue.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002717; classtype:social-engineering; sid:6002717; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (id-applevn.com/static/pass_map2024/script/code4.php?auth=e5002&ID=&mode=iPhone+14+Pro+Max+128GB)"; flow:established,to_server; http.uri; content:"/static/pass_map2024/script/code4.php?auth=e5002&ID=&mode=iPhone+14+Pro+Max+128GB"; startswith; fast_pattern; http.host; content:"id-applevn.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002718; classtype:social-engineering; sid:6002718; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stunning-kulfi-2ae33b.netlify.app/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"stunning-kulfi-2ae33b.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002719; classtype:social-engineering; sid:6002719; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (36476-dashcloud.pages.dev/help/contact/171078362791838)"; flow:established,to_server; http.uri; content:"/help/contact/171078362791838"; startswith; fast_pattern; http.host; content:"36476-dashcloud.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002720; classtype:social-engineering; sid:6002720; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pdfajdobe.pages.dev/?e=belik@8116178d138d28635a4c1d38027e7aad7f42.net)"; flow:established,to_server; http.uri; content:"/?e=belik@8116178d138d28635a4c1d38027e7aad7f42.net"; startswith; fast_pattern; http.host; content:"pdfajdobe.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002721; classtype:social-engineering; sid:6002721; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vibing.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vibing.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002722; classtype:social-engineering; sid:6002722; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (att-bonus.com.mx/mispremios)"; flow:established,to_server; http.uri; content:"/mispremios"; startswith; fast_pattern; http.host; content:"att-bonus.com.mx"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002723; classtype:social-engineering; sid:6002723; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-clone-gamma-one.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-clone-gamma-one.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002724; classtype:social-engineering; sid:6002724; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (giris.wwwpadisahbet-mobil.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"giris.wwwpadisahbet-mobil.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002725; classtype:social-engineering; sid:6002725; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth.re/E.z5haA-afx7at)"; flow:established,to_server; http.uri; content:"/E.z5haA-afx7at"; startswith; fast_pattern; http.host; content:"auth.re"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002726; classtype:social-engineering; sid:6002726; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure.security-service.cloud/companywelfare?rid=altgNwG)"; flow:established,to_server; http.uri; content:"/companywelfare?rid=altgNwG"; startswith; fast_pattern; http.host; content:"secure.security-service.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002727; classtype:social-engineering; sid:6002727; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galabet1987.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galabet1987.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002728; classtype:social-engineering; sid:6002728; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (domian-turnstile-52498.pages.dev/help/contact/599558141205100/)"; flow:established,to_server; http.uri; content:"/help/contact/599558141205100/"; startswith; fast_pattern; http.host; content:"domian-turnstile-52498.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002729; classtype:social-engineering; sid:6002729; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sporting-apricot-xuiuvslnhr.edgeone.app/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"sporting-apricot-xuiuvslnhr.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002730; classtype:social-engineering; sid:6002730; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.waddyworks.com/-/easy-ps2/)"; flow:established,to_server; http.uri; content:"/-/easy-ps2/"; startswith; fast_pattern; http.host; content:"www.waddyworks.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002731; classtype:social-engineering; sid:6002731; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.waddyworks.com/-/easy-ps2)"; flow:established,to_server; http.uri; content:"/-/easy-ps2"; startswith; fast_pattern; http.host; content:"www.waddyworks.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002732; classtype:social-engineering; sid:6002732; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (makeup1003.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"makeup1003.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002733; classtype:social-engineering; sid:6002733; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (datamod-syncpath.pages.dev/appeal_form)"; flow:established,to_server; http.uri; content:"/appeal_form"; startswith; fast_pattern; http.host; content:"datamod-syncpath.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002734; classtype:social-engineering; sid:6002734; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s4a1ucgs.authlnk.com/login/ryNAfk2CY4FCTGQheCqn0ssAICGyBCh2LL41)"; flow:established,to_server; http.uri; content:"/login/ryNAfk2CY4FCTGQheCqn0ssAICGyBCh2LL41"; startswith; fast_pattern; http.host; content:"s4a1ucgs.authlnk.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002735; classtype:social-engineering; sid:6002735; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (post.homeawaiting.de/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"post.homeawaiting.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002736; classtype:social-engineering; sid:6002736; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pullmubaicreekcitycentre.spahotel.guru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pullmubaicreekcitycentre.spahotel.guru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002737; classtype:social-engineering; sid:6002737; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (u60559p57805.web0105.zxcs-klant.nl/goat/alibaba)"; flow:established,to_server; http.uri; content:"/goat/alibaba"; startswith; fast_pattern; http.host; content:"u60559p57805.web0105.zxcs-klant.nl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002738; classtype:social-engineering; sid:6002738; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-task-one.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-task-one.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002739; classtype:social-engineering; sid:6002739; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6a0a7305b332df1f4dba8a72--peaceful-croquembouche-e372ce.netlify.app/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"6a0a7305b332df1f4dba8a72--peaceful-croquembouche-e372ce.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002740; classtype:social-engineering; sid:6002740; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.login-sand-two.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.login-sand-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002741; classtype:social-engineering; sid:6002741; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.13937.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.13937.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002742; classtype:social-engineering; sid:6002742; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ht-bybit.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ht-bybit.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002743; classtype:social-engineering; sid:6002743; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tiktokvc-1330623827.pichk.myqcloud.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"tiktokvc-1330623827.pichk.myqcloud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002744; classtype:social-engineering; sid:6002744; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t1-ec.com/app/webroot/script/navigation_compass_find_devices_login_b4_passcode4/2026)"; flow:established,to_server; http.uri; content:"/app/webroot/script/navigation_compass_find_devices_login_b4_passcode4/2026"; startswith; fast_pattern; http.host; content:"t1-ec.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002745; classtype:social-engineering; sid:6002745; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ios26mail.support/app/webroot/script/navigation_compass_find_devices_login_b4_passcode4/2026/)"; flow:established,to_server; http.uri; content:"/app/webroot/script/navigation_compass_find_devices_login_b4_passcode4/2026/"; startswith; fast_pattern; http.host; content:"ios26mail.support"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002746; classtype:social-engineering; sid:6002746; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (insta-react-clone.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"insta-react-clone.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002747; classtype:social-engineering; sid:6002747; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1102.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1102.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002748; classtype:social-engineering; sid:6002748; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (udhdhshyy68.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"udhdhshyy68.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002749; classtype:social-engineering; sid:6002749; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thursrespomain.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"thursrespomain.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002750; classtype:social-engineering; sid:6002750; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (danaax-costmer-from.ramones.web.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"danaax-costmer-from.ramones.web.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002751; classtype:social-engineering; sid:6002751; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (x1nafn66.authlnk.com/login/do5mGaygq1IzfhjaW2svA9hl9QnzXdr7CEHl)"; flow:established,to_server; http.uri; content:"/login/do5mGaygq1IzfhjaW2svA9hl9QnzXdr7CEHl"; startswith; fast_pattern; http.host; content:"x1nafn66.authlnk.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002752; classtype:social-engineering; sid:6002752; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-clone-pi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-clone-pi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002753; classtype:social-engineering; sid:6002753; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ematenoticemain.wasmer.app/tdindustries)"; flow:established,to_server; http.uri; content:"/tdindustries"; startswith; fast_pattern; http.host; content:"ematenoticemain.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002754; classtype:social-engineering; sid:6002754; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (njj.standard.us-east-1.oortstorages.com/al.bob)"; flow:established,to_server; http.uri; content:"/al.bob"; startswith; fast_pattern; http.host; content:"njj.standard.us-east-1.oortstorages.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002755; classtype:social-engineering; sid:6002755; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (danaa-iindonesiaa.zbb.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"danaa-iindonesiaa.zbb.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002756; classtype:social-engineering; sid:6002756; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreid5sas3arj6immqt3bbzw4xraucz4y7p5mkfri67z2ioxlcqypyd4.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreid5sas3arj6immqt3bbzw4xraucz4y7p5mkfri67z2ioxlcqypyd4.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002757; classtype:social-engineering; sid:6002757; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (domian-turnstile-52498.pages.dev/help/contact/439907692511516/)"; flow:established,to_server; http.uri; content:"/help/contact/439907692511516/"; startswith; fast_pattern; http.host; content:"domian-turnstile-52498.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002758; classtype:social-engineering; sid:6002758; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9000-firebase-new-1778478492228.cluster-l2bgochoazbomqgfmlhuvdvgiy.cloudworkstations.dev/?monospaceUid=767347)"; flow:established,to_server; http.uri; content:"/?monospaceUid=767347"; startswith; fast_pattern; http.host; content:"9000-firebase-new-1778478492228.cluster-l2bgochoazbomqgfmlhuvdvgiy.cloudworkstations.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002759; classtype:social-engineering; sid:6002759; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17623.invoice-partner.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17623.invoice-partner.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002760; classtype:social-engineering; sid:6002760; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wordpress-211666-0.cloudclusters.net/CH/swisspass-V10993/wcp/pass.php)"; flow:established,to_server; http.uri; content:"/CH/swisspass-V10993/wcp/pass.php"; startswith; fast_pattern; http.host; content:"wordpress-211666-0.cloudclusters.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002761; classtype:social-engineering; sid:6002761; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reclauch.pages.dev/connect/)"; flow:established,to_server; http.uri; content:"/connect/"; startswith; fast_pattern; http.host; content:"reclauch.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002762; classtype:social-engineering; sid:6002762; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appleid.location-id.help/app/webroot/script/navigation_compass_find_devices_login_b4_passcode4/2026/)"; flow:established,to_server; http.uri; content:"/app/webroot/script/navigation_compass_find_devices_login_b4_passcode4/2026/"; startswith; fast_pattern; http.host; content:"appleid.location-id.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002763; classtype:social-engineering; sid:6002763; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (135461223.site/sv/404/9be5480d-22fd-4f93-9f7f-678f38427770/740075)"; flow:established,to_server; http.uri; content:"/sv/404/9be5480d-22fd-4f93-9f7f-678f38427770/740075"; startswith; fast_pattern; http.host; content:"135461223.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002764; classtype:social-engineering; sid:6002764; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.urls.fr/T6hyQb/)"; flow:established,to_server; http.uri; content:"/T6hyQb/"; startswith; fast_pattern; http.host; content:"www.urls.fr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002765; classtype:social-engineering; sid:6002765; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2565select-fthcapital-plans6898.pages.dev/cdn-cgi)"; flow:established,to_server; http.uri; content:"/cdn-cgi"; startswith; fast_pattern; http.host; content:"2565select-fthcapital-plans6898.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002766; classtype:social-engineering; sid:6002766; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.loginservice.cloud/E.BMPMH_GD_PA)"; flow:established,to_server; http.uri; content:"/E.BMPMH_GD_PA"; startswith; fast_pattern; http.host; content:"www.loginservice.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002767; classtype:social-engineering; sid:6002767; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17624.invoice-partner.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17624.invoice-partner.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002768; classtype:social-engineering; sid:6002768; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (costumern-paylteridns.pololuxs.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"costumern-paylteridns.pololuxs.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002769; classtype:social-engineering; sid:6002769; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (domian-turnstile-52498.pages.dev/help/contact/250753179199320/)"; flow:established,to_server; http.uri; content:"/help/contact/250753179199320/"; startswith; fast_pattern; http.host; content:"domian-turnstile-52498.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002770; classtype:social-engineering; sid:6002770; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nainstrmruzmain.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nainstrmruzmain.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002771; classtype:social-engineering; sid:6002771; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (materillos045254.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"materillos045254.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002772; classtype:social-engineering; sid:6002772; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (materillos720404.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"materillos720404.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002773; classtype:social-engineering; sid:6002773; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gl-rizx.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gl-rizx.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002774; classtype:social-engineering; sid:6002774; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (signin.broker/E.39i9-pMqi0IIXQ)"; flow:established,to_server; http.uri; content:"/E.39i9-pMqi0IIXQ"; startswith; fast_pattern; http.host; content:"signin.broker"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002775; classtype:social-engineering; sid:6002775; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (binh-chon.vn/yddzzhjz04r?a)"; flow:established,to_server; http.uri; content:"/yddzzhjz04r?a"; startswith; fast_pattern; http.host; content:"binh-chon.vn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002776; classtype:social-engineering; sid:6002776; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (healing.drssunitaattray.com/images/css/)"; flow:established,to_server; http.uri; content:"/images/css/"; startswith; fast_pattern; http.host; content:"healing.drssunitaattray.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002777; classtype:social-engineering; sid:6002777; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (unusual-stick-336546.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"unusual-stick-336546.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002778; classtype:social-engineering; sid:6002778; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreid3uouz2fusodya4tm76zkxwkwtaydao3gzy63glingrnntt72mhq.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreid3uouz2fusodya4tm76zkxwkwtaydao3gzy63glingrnntt72mhq.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002779; classtype:social-engineering; sid:6002779; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (msncodereceiver.webcindario.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"msncodereceiver.webcindario.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002780; classtype:social-engineering; sid:6002780; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17620.invoice-partner.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17620.invoice-partner.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002781; classtype:social-engineering; sid:6002781; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.wwv-roblox.co/users/179575348/profile/)"; flow:established,to_server; http.uri; content:"/users/179575348/profile/"; startswith; fast_pattern; http.host; content:"www.wwv-roblox.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002782; classtype:social-engineering; sid:6002782; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-clone-pi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-clone-pi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002783; classtype:social-engineering; sid:6002783; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.sharesdashboards.info/onedrlve)"; flow:established,to_server; http.uri; content:"/onedrlve"; startswith; fast_pattern; http.host; content:"login.sharesdashboards.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002784; classtype:social-engineering; sid:6002784; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pictures.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pictures.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002785; classtype:social-engineering; sid:6002785; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galabet10711.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galabet10711.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002786; classtype:social-engineering; sid:6002786; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (destinysalamu.b-cdn.net/all2.html?eta=zenumsys@c5580a9b9a75f0f3bd608cfbffa322b73669.net)"; flow:established,to_server; http.uri; content:"/all2.html?eta=zenumsys@c5580a9b9a75f0f3bd608cfbffa322b73669.net"; startswith; fast_pattern; http.host; content:"destinysalamu.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002787; classtype:social-engineering; sid:6002787; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netzerowebmaild.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netzerowebmaild.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002788; classtype:social-engineering; sid:6002788; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id90010.agency-manager-support.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id90010.agency-manager-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002789; classtype:social-engineering; sid:6002789; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bt-105620-102743.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bt-105620-102743.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002790; classtype:social-engineering; sid:6002790; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thriving-belekoy-aae7c3.netlify.app/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"thriving-belekoy-aae7c3.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002791; classtype:social-engineering; sid:6002791; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (record.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"record.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002792; classtype:social-engineering; sid:6002792; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (40000ylg.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"40000ylg.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002793; classtype:social-engineering; sid:6002793; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocanz.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocanz.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002794; classtype:social-engineering; sid:6002794; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (touralmarocco.it/blog/wp-admin/ar2gordib2o/)"; flow:established,to_server; http.uri; content:"/blog/wp-admin/ar2gordib2o/"; startswith; fast_pattern; http.host; content:"touralmarocco.it"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002795; classtype:social-engineering; sid:6002795; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-domainrenew.com/fat-ar/?captcha)"; flow:established,to_server; http.uri; content:"/fat-ar/?captcha"; startswith; fast_pattern; http.host; content:"secure-domainrenew.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002796; classtype:social-engineering; sid:6002796; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.8810h-54.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.8810h-54.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002797; classtype:social-engineering; sid:6002797; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (renouveilement-sante.com/captcha.php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"renouveilement-sante.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002798; classtype:social-engineering; sid:6002798; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aruba.ostower.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aruba.ostower.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002799; classtype:social-engineering; sid:6002799; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.renouveilement-sante.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.renouveilement-sante.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002800; classtype:social-engineering; sid:6002800; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (santes-panel.com/explain)"; flow:established,to_server; http.uri; content:"/explain"; startswith; fast_pattern; http.host; content:"santes-panel.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002801; classtype:social-engineering; sid:6002801; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (solflare-pages.zapier.app/org)"; flow:established,to_server; http.uri; content:"/org"; startswith; fast_pattern; http.host; content:"solflare-pages.zapier.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002802; classtype:social-engineering; sid:6002802; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocabx.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocabx.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002803; classtype:social-engineering; sid:6002803; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cliente.gruppobper.cfd/it/auth/index1.php)"; flow:established,to_server; http.uri; content:"/it/auth/index1.php"; startswith; fast_pattern; http.host; content:"cliente.gruppobper.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002804; classtype:social-engineering; sid:6002804; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalinie.pl-384572.shop/oferta/nowy-glosnik-jbl-boombox-3-8804b0ae)"; flow:established,to_server; http.uri; content:"/oferta/nowy-glosnik-jbl-boombox-3-8804b0ae"; startswith; fast_pattern; http.host; content:"allegrolokalinie.pl-384572.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002805; classtype:social-engineering; sid:6002805; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalinie.pl-452389.sbs/oferta/nowy-glosnik-jbl-boombox-3-8804b0ae)"; flow:established,to_server; http.uri; content:"/oferta/nowy-glosnik-jbl-boombox-3-8804b0ae"; startswith; fast_pattern; http.host; content:"allegrolokalinie.pl-452389.sbs"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002806; classtype:social-engineering; sid:6002806; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (renewmyplannow.com/captcha.php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"renewmyplannow.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002807; classtype:social-engineering; sid:6002807; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ldgr-comstarts.wixstudio.com/enus)"; flow:established,to_server; http.uri; content:"/enus"; startswith; fast_pattern; http.host; content:"ldgr-comstarts.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002808; classtype:social-engineering; sid:6002808; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (team-4067.twil.io/Arubateamitalie26.html)"; flow:established,to_server; http.uri; content:"/Arubateamitalie26.html"; startswith; fast_pattern; http.host; content:"team-4067.twil.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002809; classtype:social-engineering; sid:6002809; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokainie.iaukcj8321920-h345.lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokainie.iaukcj8321920-h345.lat"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002810; classtype:social-engineering; sid:6002810; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (live-ledgr-en.zapier.app/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"live-ledgr-en.zapier.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002811; classtype:social-engineering; sid:6002811; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.helsan.com/vendor/phpunit/phpunit/src/Util/PHP/wp-css/processbondjp.php)"; flow:established,to_server; http.uri; content:"/vendor/phpunit/phpunit/src/Util/PHP/wp-css/processbondjp.php"; startswith; fast_pattern; http.host; content:"www.helsan.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002812; classtype:social-engineering; sid:6002812; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-mercadopromo.myshopify.com/products/geladeira-electrolux-frost-free-inverter-410l-efficient-com-autosense-inox-look-if46s?utm_source=organic&\;amp%3Butm_campaign=&\;amp%3Butm_medium=&\;amp%3Butm_content=&\;amp%3Butm_term=)"; flow:established,to_server; http.uri; content:"/products/geladeira-electrolux-frost-free-inverter-410l-efficient-com-autosense-inox-look-if46s?utm_source=organic&|3b|amp%3Butm_campaign=&|3b|amp%3Butm_medium=&|3b|amp%3Butm_content=&|3b|amp%3Butm_term="; startswith; fast_pattern; http.host; content:"app-mercadopromo.myshopify.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002813; classtype:social-engineering; sid:6002813; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (customerarea-aruba.superrein-hamburg.de/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"customerarea-aruba.superrein-hamburg.de"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002814; classtype:social-engineering; sid:6002814; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gruppobper.one/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.gruppobper.one"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002815; classtype:social-engineering; sid:6002815; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.worldchefacademy.it/en/italian-culinary-academy-chefs-italy-rome-top-professional-culinary-academy-italy.html)"; flow:established,to_server; http.uri; content:"/en/italian-culinary-academy-chefs-italy-rome-top-professional-culinary-academy-italy.html"; startswith; fast_pattern; http.host; content:"www.worldchefacademy.it"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002816; classtype:social-engineering; sid:6002816; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www-bper-it-service.pyrt.pt/it/auth/index1.php)"; flow:established,to_server; http.uri; content:"/it/auth/index1.php"; startswith; fast_pattern; http.host; content:"www-bper-it-service.pyrt.pt"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002817; classtype:social-engineering; sid:6002817; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aptos-names-mainnet-temp.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aptos-names-mainnet-temp.netlify.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002818; classtype:social-engineering; sid:6002818; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jasakirimbarang.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jasakirimbarang.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002819; classtype:social-engineering; sid:6002819; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (startapps-trezrcdn.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"startapps-trezrcdn.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002820; classtype:social-engineering; sid:6002820; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6iqeju.revueanalysefinanciere.eu/qr6xdo/?456TY289HYU=45VGI90K2ED&\;x=pop)"; flow:established,to_server; http.uri; content:"/qr6xdo/?456TY289HYU=45VGI90K2ED&|3b|x=pop"; startswith; fast_pattern; http.host; content:"6iqeju.revueanalysefinanciere.eu"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002821; classtype:social-engineering; sid:6002821; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yascyafejbqe.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yascyafejbqe.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002822; classtype:social-engineering; sid:6002822; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.pl-534234394.icu/hulajnoga-kukirin-g4-2025/39616)"; flow:established,to_server; http.uri; content:"/hulajnoga-kukirin-g4-2025/39616"; startswith; fast_pattern; http.host; content:"allegrolokalnie.pl-534234394.icu"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002823; classtype:social-engineering; sid:6002823; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ghft.info842287.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ghft.info842287.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002824; classtype:social-engineering; sid:6002824; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s1167342.ha021.t.mydomain.zone/aruba-it/)"; flow:established,to_server; http.uri; content:"/aruba-it/"; startswith; fast_pattern; http.host; content:"s1167342.ha021.t.mydomain.zone"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002825; classtype:social-engineering; sid:6002825; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wildfaune.com/wp-re/)"; flow:established,to_server; http.uri; content:"/wp-re/"; startswith; fast_pattern; http.host; content:"wildfaune.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002826; classtype:social-engineering; sid:6002826; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (christophe.grv826151.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"christophe.grv826151.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002827; classtype:social-engineering; sid:6002827; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (annikabillingerorebrose.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"annikabillingerorebrose.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002828; classtype:social-engineering; sid:6002828; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (servercomcseqww.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"servercomcseqww.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002829; classtype:social-engineering; sid:6002829; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login-coillnbase.view-transaction.history-payment.setting.coillnbase.tudjaposla.hr/?10kcok)"; flow:established,to_server; http.uri; content:"/?10kcok"; startswith; fast_pattern; http.host; content:"login-coillnbase.view-transaction.history-payment.setting.coillnbase.tudjaposla.hr"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002830; classtype:social-engineering; sid:6002830; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myupdatdenowi.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"myupdatdenowi.framer.website"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002831; classtype:social-engineering; sid:6002831; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.europrojectunisrl.com/wed/der/index.html)"; flow:established,to_server; http.uri; content:"/wed/der/index.html"; startswith; fast_pattern; http.host; content:"www.europrojectunisrl.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002832; classtype:social-engineering; sid:6002832; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (superfluous-party-506083.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"superfluous-party-506083.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002833; classtype:social-engineering; sid:6002833; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.obnova-predplatneho.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.obnova-predplatneho.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002834; classtype:social-engineering; sid:6002834; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (commonweallthcui0rg.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"commonweallthcui0rg.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002835; classtype:social-engineering; sid:6002835; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lovely-line-300084.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lovely-line-300084.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002836; classtype:social-engineering; sid:6002836; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (michelle.grv826151.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"michelle.grv826151.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002837; classtype:social-engineering; sid:6002837; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gdfu.info842287.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gdfu.info842287.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002838; classtype:social-engineering; sid:6002838; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myexcellinvspreadsheet.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"myexcellinvspreadsheet.framer.website"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002839; classtype:social-engineering; sid:6002839; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.renewmyplannow.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.renewmyplannow.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002840; classtype:social-engineering; sid:6002840; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (experienced-apartment-812927.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"experienced-apartment-812927.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002841; classtype:social-engineering; sid:6002841; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apparent-pitch-598275.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"apparent-pitch-598275.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002842; classtype:social-engineering; sid:6002842; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (beloved-process-594842.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"beloved-process-594842.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002843; classtype:social-engineering; sid:6002843; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fueguitosdelmoquehue.com/wp-content/plugins/mailpoet/vendor/woocommerce/email-editor/src/Integrations/Core/Renderer/Blocks/icons/audio/authorize.php?r=bD1odHRwczovL3Nob3J0dXJsLmF0L1Z6Zlpr)"; flow:established,to_server; http.uri; content:"/wp-content/plugins/mailpoet/vendor/woocommerce/email-editor/src/Integrations/Core/Renderer/Blocks/icons/audio/authorize.php?r=bD1odHRwczovL3Nob3J0dXJsLmF0L1Z6Zlpr"; startswith; fast_pattern; http.host; content:"fueguitosdelmoquehue.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002844; classtype:social-engineering; sid:6002844; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (londonfribasecoi.s3.us-east-1.amazonaws.com/dezdzedezdzed.html)"; flow:established,to_server; http.uri; content:"/dezdzedezdzed.html"; startswith; fast_pattern; http.host; content:"londonfribasecoi.s3.us-east-1.amazonaws.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002845; classtype:social-engineering; sid:6002845; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info842287.pro/captcha.php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"www.info842287.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002846; classtype:social-engineering; sid:6002846; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (admin-0001-de.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"admin-0001-de.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002847; classtype:social-engineering; sid:6002847; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cadeau-evenement.com/cgi-sys/suspendedpage.cgi)"; flow:established,to_server; http.uri; content:"/cgi-sys/suspendedpage.cgi"; startswith; fast_pattern; http.host; content:"cadeau-evenement.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002848; classtype:social-engineering; sid:6002848; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uni-osnabrueck--de.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uni-osnabrueck--de.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002849; classtype:social-engineering; sid:6002849; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (random.emailsview.app/KYC_MPS/?em=random@random.com)"; flow:established,to_server; http.uri; content:"/KYC_MPS/?em=random@random.com"; startswith; fast_pattern; http.host; content:"random.emailsview.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002850; classtype:social-engineering; sid:6002850; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (id.managehosting-aruba.info/?456TY289HYU=45VGI90K2ED)"; flow:established,to_server; http.uri; content:"/?456TY289HYU=45VGI90K2ED"; startswith; fast_pattern; http.host; content:"id.managehosting-aruba.info"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002851; classtype:social-engineering; sid:6002851; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alain.grv826151.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"alain.grv826151.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002852; classtype:social-engineering; sid:6002852; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.032eass.hyperphp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.032eass.hyperphp.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002853; classtype:social-engineering; sid:6002853; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ct221618.tw1.ru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ct221618.tw1.ru"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002854; classtype:social-engineering; sid:6002854; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gq36h6nz916j8hyp3v5n.s3.eu-west-3.amazonaws.com/A2iR3OCNc.html)"; flow:established,to_server; http.uri; content:"/A2iR3OCNc.html"; startswith; fast_pattern; http.host; content:"gq36h6nz916j8hyp3v5n.s3.eu-west-3.amazonaws.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002855; classtype:social-engineering; sid:6002855; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-60a5daec61ba40f394c95d86e5b814d0.r2.dev/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-60a5daec61ba40f394c95d86e5b814d0.r2.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002856; classtype:social-engineering; sid:6002856; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2026premiumupdate.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2026premiumupdate.weeblysite.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002857; classtype:social-engineering; sid:6002857; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ffmajortbnk.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ffmajortbnk.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002858; classtype:social-engineering; sid:6002858; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (livepage.ghost.io/live-en)"; flow:established,to_server; http.uri; content:"/live-en"; startswith; fast_pattern; http.host; content:"livepage.ghost.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002859; classtype:social-engineering; sid:6002859; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chilly-dragon-116674.framer.wiki/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"chilly-dragon-116674.framer.wiki"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002860; classtype:social-engineering; sid:6002860; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myfeirpoint.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"myfeirpoint.framer.website"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002861; classtype:social-engineering; sid:6002861; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (daring-directions-230506.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"daring-directions-230506.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002862; classtype:social-engineering; sid:6002862; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wafia.grv826151.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wafia.grv826151.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002863; classtype:social-engineering; sid:6002863; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meinelogin-dkb-kreditdeutshe.redirecte-mah.icu/intel/)"; flow:established,to_server; http.uri; content:"/intel/"; startswith; fast_pattern; http.host; content:"meinelogin-dkb-kreditdeutshe.redirecte-mah.icu"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002864; classtype:social-engineering; sid:6002864; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (points-shop.quest/ms)"; flow:established,to_server; http.uri; content:"/ms"; startswith; fast_pattern; http.host; content:"points-shop.quest"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002865; classtype:social-engineering; sid:6002865; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inquisitive-music-649280.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"inquisitive-music-649280.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002866; classtype:social-engineering; sid:6002866; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ten-trolink.zapier.app/support)"; flow:established,to_server; http.uri; content:"/support"; startswith; fast_pattern; http.host; content:"ten-trolink.zapier.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002867; classtype:social-engineering; sid:6002867; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (obnova-predplatneho.com/captcha)"; flow:established,to_server; http.uri; content:"/captcha"; startswith; fast_pattern; http.host; content:"obnova-predplatneho.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002868; classtype:social-engineering; sid:6002868; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gsbd.info842287.pro/captcha.php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"gsbd.info842287.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002869; classtype:social-engineering; sid:6002869; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oiics.metbahimfix.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"oiics.metbahimfix.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002870; classtype:social-engineering; sid:6002870; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reliable-vision-802483.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"reliable-vision-802483.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002871; classtype:social-engineering; sid:6002871; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enlightened-gecko-690565.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"enlightened-gecko-690565.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002872; classtype:social-engineering; sid:6002872; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.ido487579.top/depilator-ipl-philips-lumea-99/91554)"; flow:established,to_server; http.uri; content:"/depilator-ipl-philips-lumea-99/91554"; startswith; fast_pattern; http.host; content:"allegrolokalnie.ido487579.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002873; classtype:social-engineering; sid:6002873; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (admin-xf.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"admin-xf.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002874; classtype:social-engineering; sid:6002874; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.settlementdomain.com/5DLFML8/S5T8TN8/?__rpt=0&__po=17304&__ptid=d396a06733c3406f899ff00d14b7af3e&__rpa=1&__rc=1&sub1=&sub2=&sub3=&sub4=&sub5=&source_id=&__pcd=9)"; flow:established,to_server; http.uri; content:"/5DLFML8/S5T8TN8/?__rpt=0&__po=17304&__ptid=d396a06733c3406f899ff00d14b7af3e&__rpa=1&__rc=1&sub1=&sub2=&sub3=&sub4=&sub5=&source_id=&__pcd=9"; startswith; fast_pattern; http.host; content:"www.settlementdomain.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002875; classtype:social-engineering; sid:6002875; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-domainrenew26.com/at-ar10/)"; flow:established,to_server; http.uri; content:"/at-ar10/"; startswith; fast_pattern; http.host; content:"secure-domainrenew26.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002876; classtype:social-engineering; sid:6002876; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (obnova-predplatneho.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"obnova-predplatneho.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002877; classtype:social-engineering; sid:6002877; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (santesupport.com/explain)"; flow:established,to_server; http.uri; content:"/explain"; startswith; fast_pattern; http.host; content:"santesupport.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002878; classtype:social-engineering; sid:6002878; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (storage.googleapis.com/mvmnexthu/index.html)"; flow:established,to_server; http.uri; content:"/mvmnexthu/index.html"; startswith; fast_pattern; http.host; content:"storage.googleapis.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002879; classtype:social-engineering; sid:6002879; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.01384921634.shop/lokalnie/?id=7l1t2J0R1l0m9a5k6Z9G1D6l3z9z3b4x)"; flow:established,to_server; http.uri; content:"/lokalnie/?id=7l1t2J0R1l0m9a5k6Z9G1D6l3z9z3b4x"; startswith; fast_pattern; http.host; content:"allegro.01384921634.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002880; classtype:social-engineering; sid:6002880; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dzmuepbe.web.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dzmuepbe.web.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002881; classtype:social-engineering; sid:6002881; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (storage.googleapis.com/mvm-villanyszamlaja/index.html)"; flow:established,to_server; http.uri; content:"/mvm-villanyszamlaja/index.html"; startswith; fast_pattern; http.host; content:"storage.googleapis.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002882; classtype:social-engineering; sid:6002882; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokainie.oaikcj823012-340.lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokainie.oaikcj823012-340.lat"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002883; classtype:social-engineering; sid:6002883; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (redjezelfps.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"redjezelfps.info"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002884; classtype:social-engineering; sid:6002884; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mondialrelay-suivicolis.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mondialrelay-suivicolis.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002885; classtype:social-engineering; sid:6002885; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (online-express-53.web.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"online-express-53.web.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002886; classtype:social-engineering; sid:6002886; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (customer-iam-297e8.firebaseapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"customer-iam-297e8.firebaseapp.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002887; classtype:social-engineering; sid:6002887; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ads-manager.accounts-admin-agency.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ads-manager.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002888; classtype:social-engineering; sid:6002888; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robiox.com.ps/communities/2034191086/BloxFan)"; flow:established,to_server; http.uri; content:"/communities/2034191086/BloxFan"; startswith; fast_pattern; http.host; content:"robiox.com.ps"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002889; classtype:social-engineering; sid:6002889; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dc05a2fecaklwi392ygti.pages.dev/help/contact/3964/)"; flow:established,to_server; http.uri; content:"/help/contact/3964/"; startswith; fast_pattern; http.host; content:"dc05a2fecaklwi392ygti.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002890; classtype:social-engineering; sid:6002890; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galabet388.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galabet388.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002891; classtype:social-engineering; sid:6002891; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17629.program-ads-agency.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17629.program-ads-agency.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002892; classtype:social-engineering; sid:6002892; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b-t-104140.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b-t-104140.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002893; classtype:social-engineering; sid:6002893; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.mbx72.net/account/reg?code=20860)"; flow:established,to_server; http.uri; content:"/account/reg?code=20860"; startswith; fast_pattern; http.host; content:"m.mbx72.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002894; classtype:social-engineering; sid:6002894; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enzzodasul.github.io/pagina_netflix_recriada/)"; flow:established,to_server; http.uri; content:"/pagina_netflix_recriada/"; startswith; fast_pattern; http.host; content:"enzzodasul.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002895; classtype:social-engineering; sid:6002895; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iperplano.pt/l/mysavings-php//card.php)"; flow:established,to_server; http.uri; content:"/l/mysavings-php//card.php"; startswith; fast_pattern; http.host; content:"iperplano.pt"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002896; classtype:social-engineering; sid:6002896; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oginnigideon18-tech.github.io/yahoo.gid/)"; flow:established,to_server; http.uri; content:"/yahoo.gid/"; startswith; fast_pattern; http.host; content:"oginnigideon18-tech.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002897; classtype:social-engineering; sid:6002897; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.r.oblox.com.et/games/118821269826806/Wizard-AlchemyReleased?privateServerLinkCode=10583140035655823790507343018195)"; flow:established,to_server; http.uri; content:"/games/118821269826806/Wizard-AlchemyReleased?privateServerLinkCode=10583140035655823790507343018195"; startswith; fast_pattern; http.host; content:"www.r.oblox.com.et"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002898; classtype:social-engineering; sid:6002898; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-notictt.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-notictt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002899; classtype:social-engineering; sid:6002899; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (61564.my/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"61564.my"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002900; classtype:social-engineering; sid:6002900; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.clone-instagram-by-enju.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.clone-instagram-by-enju.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002901; classtype:social-engineering; sid:6002901; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (r.robloxt.cv/users/559211103/profile)"; flow:established,to_server; http.uri; content:"/users/559211103/profile"; startswith; fast_pattern; http.host; content:"r.robloxt.cv"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002902; classtype:social-engineering; sid:6002902; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2np6nh6sgb.lastingbranding.de/l/w36FDSpZHD0)"; flow:established,to_server; http.uri; content:"/l/w36FDSpZHD0"; startswith; fast_pattern; http.host; content:"2np6nh6sgb.lastingbranding.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002903; classtype:social-engineering; sid:6002903; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17638.program-ads-agency.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17638.program-ads-agency.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002904; classtype:social-engineering; sid:6002904; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ads-expert.accounts-admin-agency.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ads-expert.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002905; classtype:social-engineering; sid:6002905; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id90017.agency-manager-support.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id90017.agency-manager-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002906; classtype:social-engineering; sid:6002906; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.ezhj2znh069c.com:9229/account/reg?code=44783)"; flow:established,to_server; http.uri; content:"/account/reg?code=44783"; startswith; fast_pattern; http.host; content:"m.ezhj2znh069c.com:9229"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002907; classtype:social-engineering; sid:6002907; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (att92w8928.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"att92w8928.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002908; classtype:social-engineering; sid:6002908; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rimee-web.github.io/Movie-Ui)"; flow:established,to_server; http.uri; content:"/Movie-Ui"; startswith; fast_pattern; http.host; content:"rimee-web.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002909; classtype:social-engineering; sid:6002909; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-notictw.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-notictw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002910; classtype:social-engineering; sid:6002910; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ads-agency.accounts-admin-agency.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ads-agency.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002911; classtype:social-engineering; sid:6002911; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ads-network.accounts-admin-agency.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ads-network.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002912; classtype:social-engineering; sid:6002912; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17640.program-ads-agency.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17640.program-ads-agency.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002913; classtype:social-engineering; sid:6002913; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticrm.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-noticrm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002914; classtype:social-engineering; sid:6002914; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clone-instagram-by-enju.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"clone-instagram-by-enju.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002915; classtype:social-engineering; sid:6002915; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (satisfied-project-666760.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"satisfied-project-666760.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002916; classtype:social-engineering; sid:6002916; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.nelsonngdriving.com/pssupplies/llc.html.php)"; flow:established,to_server; http.uri; content:"/pssupplies/llc.html.php"; startswith; fast_pattern; http.host; content:"www.nelsonngdriving.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002917; classtype:social-engineering; sid:6002917; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bantuan-dana.layanan-help-care.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bantuan-dana.layanan-help-care.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002918; classtype:social-engineering; sid:6002918; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ads-service.accounts-admin-agency.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ads-service.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002919; classtype:social-engineering; sid:6002919; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ghana-post.sbs/gh)"; flow:established,to_server; http.uri; content:"/gh"; startswith; fast_pattern; http.host; content:"ghana-post.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002920; classtype:social-engineering; sid:6002920; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (voicemail-receivedon365portal.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"voicemail-receivedon365portal.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002921; classtype:social-engineering; sid:6002921; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (talentsync.co.uk/id.handel.mobile.de/login)"; flow:established,to_server; http.uri; content:"/id.handel.mobile.de/login"; startswith; fast_pattern; http.host; content:"talentsync.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002922; classtype:social-engineering; sid:6002922; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (contacts.wasmer.app/imperial-oil)"; flow:established,to_server; http.uri; content:"/imperial-oil"; startswith; fast_pattern; http.host; content:"contacts.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002923; classtype:social-engineering; sid:6002923; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (review.amrogn.com/appleton/)"; flow:established,to_server; http.uri; content:"/appleton/"; startswith; fast_pattern; http.host; content:"review.amrogn.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002924; classtype:social-engineering; sid:6002924; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cutt.ly/https-www-roblox-com-user-1126943092-profile/)"; flow:established,to_server; http.uri; content:"/https-www-roblox-com-user-1126943092-profile/"; startswith; fast_pattern; http.host; content:"www.cutt.ly"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002925; classtype:social-engineering; sid:6002925; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shipbob.management-portal.com//pages/?d=shipbob&p=index)"; flow:established,to_server; http.uri; content:"//pages/?d=shipbob&p=index"; startswith; fast_pattern; http.host; content:"shipbob.management-portal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002926; classtype:social-engineering; sid:6002926; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (refer-help21344.pages.dev/help/contact/690990508579502/)"; flow:established,to_server; http.uri; content:"/help/contact/690990508579502/"; startswith; fast_pattern; http.host; content:"refer-help21344.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002927; classtype:social-engineering; sid:6002927; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usertrek.github.io/Apple.Support)"; flow:established,to_server; http.uri; content:"/Apple.Support"; startswith; fast_pattern; http.host; content:"usertrek.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002928; classtype:social-engineering; sid:6002928; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocowm.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocowm.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002929; classtype:social-engineering; sid:6002929; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.materillos052.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.materillos052.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002930; classtype:social-engineering; sid:6002930; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galabetenvivo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galabetenvivo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002931; classtype:social-engineering; sid:6002931; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hean823.github.io/Atttech-Docement/My%20Purchase%20Order)"; flow:established,to_server; http.uri; content:"/Atttech-Docement/My%20Purchase%20Order"; startswith; fast_pattern; http.host; content:"hean823.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002932; classtype:social-engineering; sid:6002932; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.admin-0001-de.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.admin-0001-de.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002933; classtype:social-engineering; sid:6002933; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bellsite-d3c796.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bellsite-d3c796.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002934; classtype:social-engineering; sid:6002934; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeejkt-62.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopeejkt-62.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002935; classtype:social-engineering; sid:6002935; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bggfccthhcttch.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bggfccthhcttch.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002936; classtype:social-engineering; sid:6002936; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.securitysuite365.com/AccountSelectionPage/c?c=00000000-0000-0000-0000-000000000000-241acba3-0f63-48cc-bc7f-5bfbf3b7cf32)"; flow:established,to_server; http.uri; content:"/AccountSelectionPage/c?c=00000000-0000-0000-0000-000000000000-241acba3-0f63-48cc-bc7f-5bfbf3b7cf32"; startswith; fast_pattern; http.host; content:"www.securitysuite365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002937; classtype:social-engineering; sid:6002937; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id90014.agency-manager-support.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id90014.agency-manager-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002938; classtype:social-engineering; sid:6002938; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (information-traitement-envois.com/pages/login.php)"; flow:established,to_server; http.uri; content:"/pages/login.php"; startswith; fast_pattern; http.host; content:"information-traitement-envois.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002939; classtype:social-engineering; sid:6002939; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (die-swiss-post.bolt.host/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"die-swiss-post.bolt.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002940; classtype:social-engineering; sid:6002940; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (punchnextgen.s3.eu-west-1.amazonaws.com/iqqfwzvz07l0?utm_sourc)"; flow:established,to_server; http.uri; content:"/iqqfwzvz07l0?utm_sourc"; startswith; fast_pattern; http.host; content:"punchnextgen.s3.eu-west-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002941; classtype:social-engineering; sid:6002941; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.168888365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.168888365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002942; classtype:social-engineering; sid:6002942; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (magazinneluiiza.online/produto&?id=106&Kit-Sab-o-Liqui)"; flow:established,to_server; http.uri; content:"/produto&?id=106&Kit-Sab-o-Liqui"; startswith; fast_pattern; http.host; content:"magazinneluiiza.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002943; classtype:social-engineering; sid:6002943; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (djaloliddinovasaodat345-alt.github.io/instabot)"; flow:established,to_server; http.uri; content:"/instabot"; startswith; fast_pattern; http.host; content:"djaloliddinovasaodat345-alt.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002944; classtype:social-engineering; sid:6002944; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (siginjai99.com/bank0famericasecuritymail/?amrldmluzubwywxtywlyzwdvbgyuy29t=)"; flow:established,to_server; http.uri; content:"/bank0famericasecuritymail/?amrldmluzubwywxtywlyzwdvbgyuy29t="; startswith; fast_pattern; http.host; content:"siginjai99.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002945; classtype:social-engineering; sid:6002945; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usertrek.github.io/Apple.Support/)"; flow:established,to_server; http.uri; content:"/Apple.Support/"; startswith; fast_pattern; http.host; content:"usertrek.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002946; classtype:social-engineering; sid:6002946; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (parvin-akter.github.io/amazon.com/)"; flow:established,to_server; http.uri; content:"/amazon.com/"; startswith; fast_pattern; http.host; content:"parvin-akter.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002947; classtype:social-engineering; sid:6002947; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wvvvbancainternacional.digital/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wvvvbancainternacional.digital"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002948; classtype:social-engineering; sid:6002948; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ario3.arweave.io.vn/wVNYrU_cC_etppnMAoegqOZ3JuRsYckkxwxHw2qjW7M?eta=)"; flow:established,to_server; http.uri; content:"/wVNYrU_cC_etppnMAoegqOZ3JuRsYckkxwxHw2qjW7M?eta="; startswith; fast_pattern; http.host; content:"ario3.arweave.io.vn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002949; classtype:social-engineering; sid:6002949; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (swisspass-account-update-information.dimitribraiki.fr/Swispa/72dfae214266c1f0025b787e8082b2c3/)"; flow:established,to_server; http.uri; content:"/Swispa/72dfae214266c1f0025b787e8082b2c3/"; startswith; fast_pattern; http.host; content:"swisspass-account-update-information.dimitribraiki.fr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002950; classtype:social-engineering; sid:6002950; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.alnoor-schools.com/thomaspest/solutions.html.php)"; flow:established,to_server; http.uri; content:"/thomaspest/solutions.html.php"; startswith; fast_pattern; http.host; content:"www.alnoor-schools.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002951; classtype:social-engineering; sid:6002951; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myselfsouvik.github.io/getawaymynetflix.github.io/)"; flow:established,to_server; http.uri; content:"/getawaymynetflix.github.io/"; startswith; fast_pattern; http.host; content:"myselfsouvik.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002952; classtype:social-engineering; sid:6002952; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shaw-tracker.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shaw-tracker.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002953; classtype:social-engineering; sid:6002953; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galabetgiris-2026.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galabetgiris-2026.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002954; classtype:social-engineering; sid:6002954; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17639.program-ads-agency.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17639.program-ads-agency.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002955; classtype:social-engineering; sid:6002955; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cassmiya387.github.io/starterpack/)"; flow:established,to_server; http.uri; content:"/starterpack/"; startswith; fast_pattern; http.host; content:"cassmiya387.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002956; classtype:social-engineering; sid:6002956; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id90016.agency-manager-support.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id90016.agency-manager-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002957; classtype:social-engineering; sid:6002957; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (x13kkaskckl123x123.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"x13kkaskckl123x123.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002958; classtype:social-engineering; sid:6002958; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j60i.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j60i.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002959; classtype:social-engineering; sid:6002959; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-similer.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-similer.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002960; classtype:social-engineering; sid:6002960; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (artsy-village-979746.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"artsy-village-979746.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002961; classtype:social-engineering; sid:6002961; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.atendeh0nline.site/atendimento)"; flow:established,to_server; http.uri; content:"/atendimento"; startswith; fast_pattern; http.host; content:"www.atendeh0nline.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002962; classtype:social-engineering; sid:6002962; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dadayhappy.com/Ecallan/)"; flow:established,to_server; http.uri; content:"/Ecallan/"; startswith; fast_pattern; http.host; content:"www.dadayhappy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002963; classtype:social-engineering; sid:6002963; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clone-instagram-by-enju.vercel.app/auth)"; flow:established,to_server; http.uri; content:"/auth"; startswith; fast_pattern; http.host; content:"clone-instagram-by-enju.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002964; classtype:social-engineering; sid:6002964; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sahityasarokar.com/wp-noon/pages/login.php)"; flow:established,to_server; http.uri; content:"/wp-noon/pages/login.php"; startswith; fast_pattern; http.host; content:"sahityasarokar.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002965; classtype:social-engineering; sid:6002965; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thewabisabinook.com/wp-content/nf74nd/china/?email=orix7@07728160d9f0df1aceb2c92383c4262e18c0.org)"; flow:established,to_server; http.uri; content:"/wp-content/nf74nd/china/?email=orix7@07728160d9f0df1aceb2c92383c4262e18c0.org"; startswith; fast_pattern; http.host; content:"thewabisabinook.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002966; classtype:social-engineering; sid:6002966; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17636.program-ads-agency.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17636.program-ads-agency.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002967; classtype:social-engineering; sid:6002967; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ads-growth.accounts-admin-agency.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ads-growth.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002968; classtype:social-engineering; sid:6002968; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wanderingad0be-hat-ecad.adfd7788ab030a3e21c4845a.workers.dev/Adobe_Installer)"; flow:established,to_server; http.uri; content:"/Adobe_Installer"; startswith; fast_pattern; http.host; content:"wanderingad0be-hat-ecad.adfd7788ab030a3e21c4845a.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002969; classtype:social-engineering; sid:6002969; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member049.ad-agency-meta.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member049.ad-agency-meta.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002970; classtype:social-engineering; sid:6002970; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mycardsupdates.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mycardsupdates.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002971; classtype:social-engineering; sid:6002971; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-watch.pages.dev/cdn-cgi)"; flow:established,to_server; http.uri; content:"/cdn-cgi"; startswith; fast_pattern; http.host; content:"facebook-watch.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002972; classtype:social-engineering; sid:6002972; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure--suitetrzor.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure--suitetrzor.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002973; classtype:social-engineering; sid:6002973; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jaeaumentune.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"jaeaumentune.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002974; classtype:social-engineering; sid:6002974; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (popularairservice.com/wp-content/themes/twentytwentyfour/style/home/details.php?lang=en)"; flow:established,to_server; http.uri; content:"/wp-content/themes/twentytwentyfour/style/home/details.php?lang=en"; startswith; fast_pattern; http.host; content:"popularairservice.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002975; classtype:social-engineering; sid:6002975; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loginliveoutlk.jimdofree.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"loginliveoutlk.jimdofree.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002976; classtype:social-engineering; sid:6002976; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mk624-git.github.io/nflex/)"; flow:established,to_server; http.uri; content:"/nflex/"; startswith; fast_pattern; http.host; content:"mk624-git.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002977; classtype:social-engineering; sid:6002977; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (misokweb.com/schwab2025)"; flow:established,to_server; http.uri; content:"/schwab2025"; startswith; fast_pattern; http.host; content:"misokweb.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002978; classtype:social-engineering; sid:6002978; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (official-badge-check.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"official-badge-check.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002979; classtype:social-engineering; sid:6002979; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cartermobilmadiun.com/callmss/)"; flow:established,to_server; http.uri; content:"/callmss/"; startswith; fast_pattern; http.host; content:"www.cartermobilmadiun.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002980; classtype:social-engineering; sid:6002980; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.insta-clone-application.vercel.app/auth/)"; flow:established,to_server; http.uri; content:"/auth/"; startswith; fast_pattern; http.host; content:"www.insta-clone-application.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002981; classtype:social-engineering; sid:6002981; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galabet38.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galabet38.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002982; classtype:social-engineering; sid:6002982; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.vickyadin.co.nz/mazzellacompanies/)"; flow:established,to_server; http.uri; content:"/mazzellacompanies/"; startswith; fast_pattern; http.host; content:"www.vickyadin.co.nz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002983; classtype:social-engineering; sid:6002983; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member051.ad-agency-meta.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member051.ad-agency-meta.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002984; classtype:social-engineering; sid:6002984; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (template.wasmer.app/takeuchi-es)"; flow:established,to_server; http.uri; content:"/takeuchi-es"; startswith; fast_pattern; http.host; content:"template.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002985; classtype:social-engineering; sid:6002985; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ldgrsafkh87f.sameera-45.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ldgrsafkh87f.sameera-45.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002986; classtype:social-engineering; sid:6002986; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trackmypackges-ups.fwe.pfz.mybluehost.me/us/en/homepage)"; flow:established,to_server; http.uri; content:"/us/en/homepage"; startswith; fast_pattern; http.host; content:"trackmypackges-ups.fwe.pfz.mybluehost.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002987; classtype:social-engineering; sid:6002987; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kh3a.de/internationalmicro)"; flow:established,to_server; http.uri; content:"/internationalmicro"; startswith; fast_pattern; http.host; content:"kh3a.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002988; classtype:social-engineering; sid:6002988; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shark-app-dr4xc.ondigitalocean.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shark-app-dr4xc.ondigitalocean.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002989; classtype:social-engineering; sid:6002989; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17634.program-ads-agency.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17634.program-ads-agency.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002990; classtype:social-engineering; sid:6002990; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ads-boost.accounts-admin-agency.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ads-boost.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002991; classtype:social-engineering; sid:6002991; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (upholdlxmg.gitbook.io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"upholdlxmg.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002992; classtype:social-engineering; sid:6002992; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.dtwyiqnl9ods.com:9229/account/reg?code=47670)"; flow:established,to_server; http.uri; content:"/account/reg?code=47670"; startswith; fast_pattern; http.host; content:"m.dtwyiqnl9ods.com:9229"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002993; classtype:social-engineering; sid:6002993; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shipbob.management-portal.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shipbob.management-portal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002994; classtype:social-engineering; sid:6002994; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.materillos720404.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.materillos720404.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002995; classtype:social-engineering; sid:6002995; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hausmeister38.de/edwardhopwooddmd)"; flow:established,to_server; http.uri; content:"/edwardhopwooddmd"; startswith; fast_pattern; http.host; content:"hausmeister38.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002996; classtype:social-engineering; sid:6002996; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.zcnpx.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.zcnpx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002997; classtype:social-engineering; sid:6002997; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eagorasonhealtopoisvocemerecemuito.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"eagorasonhealtopoisvocemerecemuito.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002998; classtype:social-engineering; sid:6002998; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store.communityworkapp.shop/workshop/AK47-EternalDecay/)"; flow:established,to_server; http.uri; content:"/workshop/AK47-EternalDecay/"; startswith; fast_pattern; http.host; content:"store.communityworkapp.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002999; classtype:social-engineering; sid:6002999; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robiox.com.ua/communities/519190260/gvwayrbx)"; flow:established,to_server; http.uri; content:"/communities/519190260/gvwayrbx"; startswith; fast_pattern; http.host; content:"robiox.com.ua"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003000; classtype:social-engineering; sid:6003000; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (togodbethegloryamen.pages.dev/Adobe_Installer)"; flow:established,to_server; http.uri; content:"/Adobe_Installer"; startswith; fast_pattern; http.host; content:"togodbethegloryamen.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003001; classtype:social-engineering; sid:6003001; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b35n.com/poker/109)"; flow:established,to_server; http.uri; content:"/poker/109"; startswith; fast_pattern; http.host; content:"b35n.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003002; classtype:social-engineering; sid:6003002; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17630.program-ads-agency.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17630.program-ads-agency.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003003; classtype:social-engineering; sid:6003003; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accounts.marketwebb.me/en/login/)"; flow:established,to_server; http.uri; content:"/en/login/"; startswith; fast_pattern; http.host; content:"accounts.marketwebb.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003004; classtype:social-engineering; sid:6003004; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (afaktv.com/summerwood)"; flow:established,to_server; http.uri; content:"/summerwood"; startswith; fast_pattern; http.host; content:"afaktv.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003005; classtype:social-engineering; sid:6003005; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fs.cpa-advogados.com/vc)"; flow:established,to_server; http.uri; content:"/vc"; startswith; fast_pattern; http.host; content:"fs.cpa-advogados.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003006; classtype:social-engineering; sid:6003006; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ads-business.accounts-admin-agency.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ads-business.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003007; classtype:social-engineering; sid:6003007; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galabetbonus.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galabetbonus.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003008; classtype:social-engineering; sid:6003008; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.joy-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.joy-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003009; classtype:social-engineering; sid:6003009; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uditrsahani-ship-it.github.io/coins/)"; flow:established,to_server; http.uri; content:"/coins/"; startswith; fast_pattern; http.host; content:"uditrsahani-ship-it.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003010; classtype:social-engineering; sid:6003010; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cutt.ly/https-roblox-com-users-154492639-profile/)"; flow:established,to_server; http.uri; content:"/https-roblox-com-users-154492639-profile/"; startswith; fast_pattern; http.host; content:"www.cutt.ly"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003011; classtype:social-engineering; sid:6003011; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17627.program-ads-agency.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17627.program-ads-agency.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003012; classtype:social-engineering; sid:6003012; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17635.program-ads-agency.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17635.program-ads-agency.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003013; classtype:social-engineering; sid:6003013; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hr.agenziaesattoriale.it/?rid=kfu5k8f)"; flow:established,to_server; http.uri; content:"/?rid=kfu5k8f"; startswith; fast_pattern; http.host; content:"hr.agenziaesattoriale.it"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003014; classtype:social-engineering; sid:6003014; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.materillos045254.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.materillos045254.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003015; classtype:social-engineering; sid:6003015; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (unlimitedcss.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"unlimitedcss.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003016; classtype:social-engineering; sid:6003016; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (big-storm-641564.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"big-storm-641564.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003017; classtype:social-engineering; sid:6003017; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dayon.kdense.com/wp-content/llc/home/fonts/jino.html)"; flow:established,to_server; http.uri; content:"/wp-content/llc/home/fonts/jino.html"; startswith; fast_pattern; http.host; content:"dayon.kdense.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003018; classtype:social-engineering; sid:6003018; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17631.program-ads-agency.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17631.program-ads-agency.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003019; classtype:social-engineering; sid:6003019; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j60j.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j60j.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003020; classtype:social-engineering; sid:6003020; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (daniellekrsitina.github.io/spotify-clone-bootstrap)"; flow:established,to_server; http.uri; content:"/spotify-clone-bootstrap"; startswith; fast_pattern; http.host; content:"daniellekrsitina.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003021; classtype:social-engineering; sid:6003021; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vlinbgi.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.vlinbgi.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003022; classtype:social-engineering; sid:6003022; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktifkannx-dnacicil.fascist.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktifkannx-dnacicil.fascist.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003023; classtype:social-engineering; sid:6003023; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.czplmwn.ink/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.czplmwn.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003024; classtype:social-engineering; sid:6003024; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id17641.program-ads-agency.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id17641.program-ads-agency.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003025; classtype:social-engineering; sid:6003025; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (surl.lu/axrnyj)"; flow:established,to_server; http.uri; content:"/axrnyj"; startswith; fast_pattern; http.host; content:"surl.lu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003026; classtype:social-engineering; sid:6003026; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oyster-app-ud5r5.ondigitalocean.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"oyster-app-ud5r5.ondigitalocean.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003027; classtype:social-engineering; sid:6003027; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.materillos02245.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.materillos02245.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003028; classtype:social-engineering; sid:6003028; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.materillos142542.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.materillos142542.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003029; classtype:social-engineering; sid:6003029; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (magazinneluiiza.online/produto&)"; flow:established,to_server; http.uri; content:"/produto&"; startswith; fast_pattern; http.host; content:"magazinneluiiza.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003030; classtype:social-engineering; sid:6003030; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qnb-finansbank-dynamic.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qnb-finansbank-dynamic.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003031; classtype:social-engineering; sid:6003031; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (attscripts.github.io/att-dd-script)"; flow:established,to_server; http.uri; content:"/att-dd-script"; startswith; fast_pattern; http.host; content:"attscripts.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003032; classtype:social-engineering; sid:6003032; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dorightvaliantly.info/PL-1466-160526/?u=81C1466&e=Sylwiawk)"; flow:established,to_server; http.uri; content:"/PL-1466-160526/?u=81C1466&e=Sylwiawk"; startswith; fast_pattern; http.host; content:"dorightvaliantly.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003033; classtype:social-engineering; sid:6003033; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prashantrana1494.github.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"prashantrana1494.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003034; classtype:social-engineering; sid:6003034; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffka4npaylaterll.file-resmii4.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffka4npaylaterll.file-resmii4.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003035; classtype:social-engineering; sid:6003035; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365168888.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.365168888.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003036; classtype:social-engineering; sid:6003036; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ads-pro.accounts-admin-agency.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ads-pro.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003037; classtype:social-engineering; sid:6003037; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.materillos57200.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.materillos57200.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003038; classtype:social-engineering; sid:6003038; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (digitalomnifederalorg.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"digitalomnifederalorg.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003039; classtype:social-engineering; sid:6003039; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ning1-ddere5bmduh3h7gd.z03.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ning1-ddere5bmduh3h7gd.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003040; classtype:social-engineering; sid:6003040; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clone-facebook-one.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"clone-facebook-one.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003041; classtype:social-engineering; sid:6003041; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prapalin.github.io/Amazon-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-clone/"; startswith; fast_pattern; http.host; content:"prapalin.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003042; classtype:social-engineering; sid:6003042; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yfjvrlkp3qf7plngthgafb5avdthojxenrq4sjghbrd4g2vdlozq.ario3.arweave.io.vn/wVNYrU_cC_etppnMAoegqOZ3JuRsYckkxwxHw2qjW7M?eta=)"; flow:established,to_server; http.uri; content:"/wVNYrU_cC_etppnMAoegqOZ3JuRsYckkxwxHw2qjW7M?eta="; startswith; fast_pattern; http.host; content:"yfjvrlkp3qf7plngthgafb5avdthojxenrq4sjghbrd4g2vdlozq.ario3.arweave.io.vn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003043; classtype:social-engineering; sid:6003043; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galabettv1.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galabettv1.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003044; classtype:social-engineering; sid:6003044; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (upholdlxmg.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"upholdlxmg.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003045; classtype:social-engineering; sid:6003045; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticrg.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-noticrg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003046; classtype:social-engineering; sid:6003046; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeejkt-88.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopeejkt-88.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003047; classtype:social-engineering; sid:6003047; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tljhaks.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tljhaks.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003048; classtype:social-engineering; sid:6003048; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ressourceshumains.com/?r=0e4f4175-63b5-47e5-b1fb-381adfb5094b&rg=eu)"; flow:established,to_server; http.uri; content:"/?r=0e4f4175-63b5-47e5-b1fb-381adfb5094b&rg=eu"; startswith; fast_pattern; http.host; content:"ressourceshumains.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003049; classtype:social-engineering; sid:6003049; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatspp-qq.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatspp-qq.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003050; classtype:social-engineering; sid:6003050; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (44433a.com/?dl=2ndv22)"; flow:established,to_server; http.uri; content:"/?dl=2ndv22"; startswith; fast_pattern; http.host; content:"44433a.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003051; classtype:social-engineering; sid:6003051; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sonhaberleri255.shop/auth)"; flow:established,to_server; http.uri; content:"/auth"; startswith; fast_pattern; http.host; content:"sonhaberleri255.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003052; classtype:social-engineering; sid:6003052; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocoyt.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocoyt.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003053; classtype:social-engineering; sid:6003053; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (seconddimension.028426.com/s/63bzgfsvbwsfcdx7y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63bzgfsvbwsfcdx7y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"seconddimension.028426.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003054; classtype:social-engineering; sid:6003054; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (giftmshengu250-pixel.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"giftmshengu250-pixel.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003055; classtype:social-engineering; sid:6003055; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nandhantk11.github.io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"nandhantk11.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003056; classtype:social-engineering; sid:6003056; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-0670180e6ac942308e1a7b5d1496d509.r2.dev/docusign-paydocument.html)"; flow:established,to_server; http.uri; content:"/docusign-paydocument.html"; startswith; fast_pattern; http.host; content:"pub-0670180e6ac942308e1a7b5d1496d509.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003057; classtype:social-engineering; sid:6003057; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cardsupport.online/icici/login/index.html)"; flow:established,to_server; http.uri; content:"/icici/login/index.html"; startswith; fast_pattern; http.host; content:"cardsupport.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003058; classtype:social-engineering; sid:6003058; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lcloud.vn-idapple.com/iframe/signin.php?auth=65677&ID=)"; flow:established,to_server; http.uri; content:"/iframe/signin.php?auth=65677&ID="; startswith; fast_pattern; http.host; content:"lcloud.vn-idapple.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003059; classtype:social-engineering; sid:6003059; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfvhg-pmsm-npe5.p-mv4ac1tf.workers.dev/lp/IUzx14P5zm4)"; flow:established,to_server; http.uri; content:"/lp/IUzx14P5zm4"; startswith; fast_pattern; http.host; content:"xfvhg-pmsm-npe5.p-mv4ac1tf.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003060; classtype:social-engineering; sid:6003060; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (r.roblotx.co/users/14085142931/profile)"; flow:established,to_server; http.uri; content:"/users/14085142931/profile"; startswith; fast_pattern; http.host; content:"r.roblotx.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003061; classtype:social-engineering; sid:6003061; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shrt.lu/a019u)"; flow:established,to_server; http.uri; content:"/a019u"; startswith; fast_pattern; http.host; content:"shrt.lu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003062; classtype:social-engineering; sid:6003062; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (groothuis.be/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"groothuis.be"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003063; classtype:social-engineering; sid:6003063; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robiox.com.ps/communities/3737512164/)"; flow:established,to_server; http.uri; content:"/communities/3737512164/"; startswith; fast_pattern; http.host; content:"robiox.com.ps"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003064; classtype:social-engineering; sid:6003064; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (postfinance.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"postfinance.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003065; classtype:social-engineering; sid:6003065; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.joshidiagnosticcentre.com/Secured28/)"; flow:established,to_server; http.uri; content:"/Secured28/"; startswith; fast_pattern; http.host; content:"www.joshidiagnosticcentre.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003066; classtype:social-engineering; sid:6003066; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.66666365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.66666365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003067; classtype:social-engineering; sid:6003067; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.opnsea0penseamint46.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.opnsea0penseamint46.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003068; classtype:social-engineering; sid:6003068; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (teach-started.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"teach-started.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003069; classtype:social-engineering; sid:6003069; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (himself-vessels-optimize-located.trycloudflare.com/login.html)"; flow:established,to_server; http.uri; content:"/login.html"; startswith; fast_pattern; http.host; content:"himself-vessels-optimize-located.trycloudflare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003070; classtype:social-engineering; sid:6003070; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ngnangong-sport.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ngnangong-sport.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003071; classtype:social-engineering; sid:6003071; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cedhrdc.org/rivieradoc/)"; flow:established,to_server; http.uri; content:"/rivieradoc/"; startswith; fast_pattern; http.host; content:"www.cedhrdc.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003072; classtype:social-engineering; sid:6003072; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (home-bridn.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"home-bridn.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003073; classtype:social-engineering; sid:6003073; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-notictq.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-notictq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003074; classtype:social-engineering; sid:6003074; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tettt.busines-help-center.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tettt.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003075; classtype:social-engineering; sid:6003075; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cutt.ly/https-roblox-com-users-8748561252-profile/)"; flow:established,to_server; http.uri; content:"/https-roblox-com-users-8748561252-profile/"; startswith; fast_pattern; http.host; content:"www.cutt.ly"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003076; classtype:social-engineering; sid:6003076; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.onlinewirelessmall.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.onlinewirelessmall.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003077; classtype:social-engineering; sid:6003077; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dropship.mach95.dev/esgetransfer3baosgeublicfari537.html?eta=loror@d40fb4ee05924b7d16ed8de5b6e1999b6feb.net)"; flow:established,to_server; http.uri; content:"/esgetransfer3baosgeublicfari537.html?eta=loror@d40fb4ee05924b7d16ed8de5b6e1999b6feb.net"; startswith; fast_pattern; http.host; content:"dropship.mach95.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003078; classtype:social-engineering; sid:6003078; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.personalinjurylawyercherokeecounty.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.personalinjurylawyercherokeecounty.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003079; classtype:social-engineering; sid:6003079; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.yes-ukraine.org/projects/riverview-phase2-rfq-docs)"; flow:established,to_server; http.uri; content:"/projects/riverview-phase2-rfq-docs"; startswith; fast_pattern; http.host; content:"app.yes-ukraine.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003080; classtype:social-engineering; sid:6003080; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gjdgdb-comk.jimdofree.com/?preview_sid=329585)"; flow:established,to_server; http.uri; content:"/?preview_sid=329585"; startswith; fast_pattern; http.host; content:"gjdgdb-comk.jimdofree.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003081; classtype:social-engineering; sid:6003081; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oginnigideon18-tech.github.io/yahoo.gid)"; flow:established,to_server; http.uri; content:"/yahoo.gid"; startswith; fast_pattern; http.host; content:"oginnigideon18-tech.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003082; classtype:social-engineering; sid:6003082; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (renewalhub-support.de/?s=v)"; flow:established,to_server; http.uri; content:"/?s=v"; startswith; fast_pattern; http.host; content:"renewalhub-support.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003083; classtype:social-engineering; sid:6003083; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.mbx72.net/account/reg?code=20152)"; flow:established,to_server; http.uri; content:"/account/reg?code=20152"; startswith; fast_pattern; http.host; content:"m.mbx72.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003084; classtype:social-engineering; sid:6003084; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suatelatop.serveirc.com/sicred/Portal.php)"; flow:established,to_server; http.uri; content:"/sicred/Portal.php"; startswith; fast_pattern; http.host; content:"suatelatop.serveirc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003085; classtype:social-engineering; sid:6003085; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (information-traitement-envois.com/pages/ban.php)"; flow:established,to_server; http.uri; content:"/pages/ban.php"; startswith; fast_pattern; http.host; content:"information-traitement-envois.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003086; classtype:social-engineering; sid:6003086; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-id90011.agency-manager-support.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-id90011.agency-manager-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003087; classtype:social-engineering; sid:6003087; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vermillion-pasca-1a78d7.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vermillion-pasca-1a78d7.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003088; classtype:social-engineering; sid:6003088; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (18feb38d-9304-49ed-8a45-4b919bb3ed9f-netflix-clone-fixed.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"18feb38d-9304-49ed-8a45-4b919bb3ed9f-netflix-clone-fixed.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003089; classtype:social-engineering; sid:6003089; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fullaski.com/longman/ourtimepge/v3/)"; flow:established,to_server; http.uri; content:"/longman/ourtimepge/v3/"; startswith; fast_pattern; http.host; content:"www.fullaski.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003090; classtype:social-engineering; sid:6003090; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rimee-web.github.io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"rimee-web.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003091; classtype:social-engineering; sid:6003091; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cdn2.hubspot.net/hubfs/5380234/email-media/4d0528831d16375743f66a17dc479d89/e3a933685615cae7f81b3a36d45610e4/Order%20Inquiry%20.pdf.htm)"; flow:established,to_server; http.uri; content:"/hubfs/5380234/email-media/4d0528831d16375743f66a17dc479d89/e3a933685615cae7f81b3a36d45610e4/Order%20Inquiry%20.pdf.htm"; startswith; fast_pattern; http.host; content:"cdn2.hubspot.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003092; classtype:social-engineering; sid:6003092; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (74-161-162-137.cprapid.com/eu/update.php?njvdpj91er4r6qnx3bd9)"; flow:established,to_server; http.uri; content:"/eu/update.php?njvdpj91er4r6qnx3bd9"; startswith; fast_pattern; http.host; content:"74-161-162-137.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003093; classtype:social-engineering; sid:6003093; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.stilles-oertchen.de/capraasset/)"; flow:established,to_server; http.uri; content:"/capraasset/"; startswith; fast_pattern; http.host; content:"www.stilles-oertchen.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003094; classtype:social-engineering; sid:6003094; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galabet88.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galabet88.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003095; classtype:social-engineering; sid:6003095; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (digi11.ict.ph/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"digi11.ict.ph"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003096; classtype:social-engineering; sid:6003096; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shanekilian.github.io/ShaneKilian-netflix-clone/)"; flow:established,to_server; http.uri; content:"/ShaneKilian-netflix-clone/"; startswith; fast_pattern; http.host; content:"shanekilian.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003097; classtype:social-engineering; sid:6003097; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.smart0298391243.bond/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalnie.smart0298391243.bond"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003098; classtype:social-engineering; sid:6003098; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oboticario-revenda.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"oboticario-revenda.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003099; classtype:social-engineering; sid:6003099; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-fcf55d0d2bfe4ab59f541f08f81dbf23.r2.dev/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-fcf55d0d2bfe4ab59f541f08f81dbf23.r2.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003100; classtype:social-engineering; sid:6003100; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.oopo889d0s87.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.oopo889d0s87.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003101; classtype:social-engineering; sid:6003101; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (supportsante.com/explain)"; flow:established,to_server; http.uri; content:"/explain"; startswith; fast_pattern; http.host; content:"supportsante.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003102; classtype:social-engineering; sid:6003102; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cesnet.adianjing.com/challenge.php?t=MTc3OTE1NDcwN3wxNzc5MTU1MDA3fDBlZmQ1MzZjMjA0MGJhMzJ8NHwyMDNhN2E5YmY1MWY2OTE2NmEyNDAyY2UxYmVhNjhiZXwxNDQzOWY1MWY1ZGVlNTZmNmNlOTY2ZGNmMzQ2OGRjOGMwMjNhNmFjMWY4NjUzYzllZDkwZDJhNDMxNmZmODk4&r=Lw%3D%3D)"; flow:established,to_server; http.uri; content:"/challenge.php?t=MTc3OTE1NDcwN3wxNzc5MTU1MDA3fDBlZmQ1MzZjMjA0MGJhMzJ8NHwyMDNhN2E5YmY1MWY2OTE2NmEyNDAyY2UxYmVhNjhiZXwxNDQzOWY1MWY1ZGVlNTZmNmNlOTY2ZGNmMzQ2OGRjOGMwMjNhNmFjMWY4NjUzYzllZDkwZDJhNDMxNmZmODk4&r=Lw%3D%3D"; startswith; fast_pattern; http.host; content:"cesnet.adianjing.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003103; classtype:social-engineering; sid:6003103; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mnmbk-6c118.web.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mnmbk-6c118.web.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003104; classtype:social-engineering; sid:6003104; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nominaapoyo.com/web3z/index.php?emp=x@x.com)"; flow:established,to_server; http.uri; content:"/web3z/index.php?emp=x@x.com"; startswith; fast_pattern; http.host; content:"nominaapoyo.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003105; classtype:social-engineering; sid:6003105; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dogeurl.com/g51h7b)"; flow:established,to_server; http.uri; content:"/g51h7b"; startswith; fast_pattern; http.host; content:"dogeurl.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003106; classtype:social-engineering; sid:6003106; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smartparcelchain.web.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"smartparcelchain.web.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003107; classtype:social-engineering; sid:6003107; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.aukceuu8125.cfd/lokalnie/?id=8f6h4z0x3y7x9j8g7k3t5s0z1z8x9y8j)"; flow:established,to_server; http.uri; content:"/lokalnie/?id=8f6h4z0x3y7x9j8g7k3t5s0z1z8x9y8j"; startswith; fast_pattern; http.host; content:"allegro.aukceuu8125.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003108; classtype:social-engineering; sid:6003108; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bmrrcjjjjwv.firebaseapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bmrrcjjjjwv.firebaseapp.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003109; classtype:social-engineering; sid:6003109; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bmrrcjjjjwv.web.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bmrrcjjjjwv.web.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003110; classtype:social-engineering; sid:6003110; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie.oaikcj823012-340.lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.oaikcj823012-340.lat"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003111; classtype:social-engineering; sid:6003111; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stationnement-antai-gouv-infractions.fajnebistro.sk/fr/facture-electronique/dossie/fr-fr/redirect)"; flow:established,to_server; http.uri; content:"/fr/facture-electronique/dossie/fr-fr/redirect"; startswith; fast_pattern; http.host; content:"stationnement-antai-gouv-infractions.fajnebistro.sk"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003112; classtype:social-engineering; sid:6003112; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (onlineugyintezes-belepes.com/support/payment/)"; flow:established,to_server; http.uri; content:"/support/payment/"; startswith; fast_pattern; http.host; content:"onlineugyintezes-belepes.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003113; classtype:social-engineering; sid:6003113; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-34ef152cd54645d6bfb59e199b493be6.r2.dev/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-34ef152cd54645d6bfb59e199b493be6.r2.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003114; classtype:social-engineering; sid:6003114; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (connexion-document.firebaseapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"connexion-document.firebaseapp.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003115; classtype:social-engineering; sid:6003115; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.smar9438-65j.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.smar9438-65j.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003116; classtype:social-engineering; sid:6003116; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cadastrobradescopjatt.digital/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cadastrobradescopjatt.digital"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003117; classtype:social-engineering; sid:6003117; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (denzay.com.tr/it/)"; flow:established,to_server; http.uri; content:"/it/"; startswith; fast_pattern; http.host; content:"denzay.com.tr"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003118; classtype:social-engineering; sid:6003118; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (servicioallianzadelvalle.z13.web.core.windows.net/persona.html)"; flow:established,to_server; http.uri; content:"/persona.html"; startswith; fast_pattern; http.host; content:"servicioallianzadelvalle.z13.web.core.windows.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003119; classtype:social-engineering; sid:6003119; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.prywatn83812034.bond/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.prywatn83812034.bond"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003120; classtype:social-engineering; sid:6003120; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.01289523rt.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalnie.01289523rt.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003121; classtype:social-engineering; sid:6003121; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cvcvccvcvcvcvcvcvc.onrender.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cvcvccvcvcvcvcvcvc.onrender.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003122; classtype:social-engineering; sid:6003122; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokainie.smart-23059238.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokainie.smart-23059238.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003123; classtype:social-engineering; sid:6003123; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.smart0298391243.bond/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.smart0298391243.bond"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003124; classtype:social-engineering; sid:6003124; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalne.smart0298391243.bond/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalne.smart0298391243.bond"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003125; classtype:social-engineering; sid:6003125; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dzmuepbe.firebaseapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dzmuepbe.firebaseapp.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003126; classtype:social-engineering; sid:6003126; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokainie.prywatn83812034.bond/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokainie.prywatn83812034.bond"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003127; classtype:social-engineering; sid:6003127; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalne.prywatn83812034.bond/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalne.prywatn83812034.bond"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003128; classtype:social-engineering; sid:6003128; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deposit.quickbooks-intuit.click/deposit/)"; flow:established,to_server; http.uri; content:"/deposit/"; startswith; fast_pattern; http.host; content:"deposit.quickbooks-intuit.click"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003129; classtype:social-engineering; sid:6003129; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (credito-pichincha-seguro-facil.lovable.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"credito-pichincha-seguro-facil.lovable.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003130; classtype:social-engineering; sid:6003130; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sunsuntree.tor1.digitaloceanspaces.com/joyjoy)"; flow:established,to_server; http.uri; content:"/joyjoy"; startswith; fast_pattern; http.host; content:"sunsuntree.tor1.digitaloceanspaces.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003131; classtype:social-engineering; sid:6003131; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.prywatn83812034.bond/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalnie.prywatn83812034.bond"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003132; classtype:social-engineering; sid:6003132; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mnmbk-6c118.firebaseapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mnmbk-6c118.firebaseapp.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003133; classtype:social-engineering; sid:6003133; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zrstqzd.shop/NTA)"; flow:established,to_server; http.uri; content:"/NTA"; startswith; fast_pattern; http.host; content:"zrstqzd.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003134; classtype:social-engineering; sid:6003134; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.2834912oferi180.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalnie.2834912oferi180.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003135; classtype:social-engineering; sid:6003135; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smartparcelchain.firebaseapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"smartparcelchain.firebaseapp.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003136; classtype:social-engineering; sid:6003136; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eng--trezorbri.wixstudio.com/connect)"; flow:established,to_server; http.uri; content:"/connect"; startswith; fast_pattern; http.host; content:"eng--trezorbri.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003137; classtype:social-engineering; sid:6003137; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokainie.smar9438-65j.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokainie.smar9438-65j.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003138; classtype:social-engineering; sid:6003138; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-02597ea3d4214283af553b6356e115ed.r2.dev/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-02597ea3d4214283af553b6356e115ed.r2.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003139; classtype:social-engineering; sid:6003139; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.smar9438-65j.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalnie.smar9438-65j.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003140; classtype:social-engineering; sid:6003140; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jurggfsoye97.hstn.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jurggfsoye97.hstn.me"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003141; classtype:social-engineering; sid:6003141; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bra2-p0tns-202-62.dynv6.net/B8420266/755498457442026/home.php?hash=15576292736a0b87ee83b807.12714265)"; flow:established,to_server; http.uri; content:"/B8420266/755498457442026/home.php?hash=15576292736a0b87ee83b807.12714265"; startswith; fast_pattern; http.host; content:"bra2-p0tns-202-62.dynv6.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003142; classtype:social-engineering; sid:6003142; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie.smart0298391243.bond/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.smart0298391243.bond"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003143; classtype:social-engineering; sid:6003143; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokainie.smart0298391243.bond/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokainie.smart0298391243.bond"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003144; classtype:social-engineering; sid:6003144; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-v4y2ws0vq.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-v4y2ws0vq.godaddysites.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003145; classtype:social-engineering; sid:6003145; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bradesco.corporativoapp.digital/404.php)"; flow:established,to_server; http.uri; content:"/404.php"; startswith; fast_pattern; http.host; content:"bradesco.corporativoapp.digital"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003146; classtype:social-engineering; sid:6003146; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (min.ambulace.fr/win0/)"; flow:established,to_server; http.uri; content:"/win0/"; startswith; fast_pattern; http.host; content:"min.ambulace.fr"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003147; classtype:social-engineering; sid:6003147; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fr.creditmuteul.s-host.net/cgi-sys/suspendedpage.cgi)"; flow:established,to_server; http.uri; content:"/cgi-sys/suspendedpage.cgi"; startswith; fast_pattern; http.host; content:"fr.creditmuteul.s-host.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003148; classtype:social-engineering; sid:6003148; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (customer-iam-test-4a9cc.web.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"customer-iam-test-4a9cc.web.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003149; classtype:social-engineering; sid:6003149; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iuyghujikuyghudj.fwh.is/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"iuyghujikuyghudj.fwh.is"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003150; classtype:social-engineering; sid:6003150; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.oferta3958269.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalnie.oferta3958269.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003151; classtype:social-engineering; sid:6003151; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-c56ac0852cc84b72bd8e7afff5610030.r2.dev/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-c56ac0852cc84b72bd8e7afff5610030.r2.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003152; classtype:social-engineering; sid:6003152; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dbjbattery.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.dbjbattery.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003153; classtype:social-engineering; sid:6003153; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ictkvis.github.io/Lara/)"; flow:established,to_server; http.uri; content:"/Lara/"; startswith; fast_pattern; http.host; content:"ictkvis.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003154; classtype:social-engineering; sid:6003154; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xesmzg.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.xesmzg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003155; classtype:social-engineering; sid:6003155; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflixportal.com/l/eyJzIjoiNDI5YmMwMGQtZjMyNS00ZjUwLTliNmQtYjE0MmNlZmVkY2VkIiwiZSI6ImY4Zjc5MjRlLTliODgtNDljYy1iMjhjLTFmZWRiMTQxMmEyMiIsInNjIjoxMDYsInQiOjIzMn0.3cgTznK6X_O-81tlnwWLdzQKuuPgNxCw5hXJJ3SZsrI)"; flow:established,to_server; http.uri; content:"/l/eyJzIjoiNDI5YmMwMGQtZjMyNS00ZjUwLTliNmQtYjE0MmNlZmVkY2VkIiwiZSI6ImY4Zjc5MjRlLTliODgtNDljYy1iMjhjLTFmZWRiMTQxMmEyMiIsInNjIjoxMDYsInQiOjIzMn0.3cgTznK6X_O-81tlnwWLdzQKuuPgNxCw5hXJJ3SZsrI"; startswith; fast_pattern; http.host; content:"netflixportal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003156; classtype:social-engineering; sid:6003156; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vgolnr.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vgolnr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003157; classtype:social-engineering; sid:6003157; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.uosnwr.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.uosnwr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003158; classtype:social-engineering; sid:6003158; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.yfwldj.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.yfwldj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003159; classtype:social-engineering; sid:6003159; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dasainfra.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dasainfra.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003160; classtype:social-engineering; sid:6003160; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflixportal.com/l/eyJzIjoiNTQxZDUwZjAtMzI2OC00OWVkLWEzZDgtYmM1NzhiNjg4MjVmIiwiZSI6ImNlYTAyODQ5LWM4MjgtNGQwMi1hOGY1LTRlN2Q5MWNmODZhYiIsInNjIjoxMDYsInQiOjIzMn0.B08eDV6usTZgc7MkrRpI4ks0KR3SLn2o56CSPclEhHs)"; flow:established,to_server; http.uri; content:"/l/eyJzIjoiNTQxZDUwZjAtMzI2OC00OWVkLWEzZDgtYmM1NzhiNjg4MjVmIiwiZSI6ImNlYTAyODQ5LWM4MjgtNGQwMi1hOGY1LTRlN2Q5MWNmODZhYiIsInNjIjoxMDYsInQiOjIzMn0.B08eDV6usTZgc7MkrRpI4ks0KR3SLn2o56CSPclEhHs"; startswith; fast_pattern; http.host; content:"netflixportal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003161; classtype:social-engineering; sid:6003161; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.njmgtq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.njmgtq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003162; classtype:social-engineering; sid:6003162; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zexplq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zexplq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003163; classtype:social-engineering; sid:6003163; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nzucdm.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.nzucdm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003164; classtype:social-engineering; sid:6003164; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xnqhas.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.xnqhas.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003165; classtype:social-engineering; sid:6003165; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imrafayy.github.io/Instagram-Login)"; flow:established,to_server; http.uri; content:"/Instagram-Login"; startswith; fast_pattern; http.host; content:"imrafayy.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003166; classtype:social-engineering; sid:6003166; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qwamef.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.qwamef.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003167; classtype:social-engineering; sid:6003167; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amp.padisahbetims.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amp.padisahbetims.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003168; classtype:social-engineering; sid:6003168; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xkmruf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xkmruf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003169; classtype:social-engineering; sid:6003169; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.jurggfsoye97.hstn.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.jurggfsoye97.hstn.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003170; classtype:social-engineering; sid:6003170; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lpasxb.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lpasxb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003171; classtype:social-engineering; sid:6003171; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qnkuwb.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.qnkuwb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003172; classtype:social-engineering; sid:6003172; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bitkubblockchaintechnology.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bitkubblockchaintechnology.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003173; classtype:social-engineering; sid:6003173; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ujhgxf.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.ujhgxf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003174; classtype:social-engineering; sid:6003174; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ztaksl.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.ztaksl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003175; classtype:social-engineering; sid:6003175; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (govauinboxmsg-alert.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"govauinboxmsg-alert.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003176; classtype:social-engineering; sid:6003176; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lwdupz.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.lwdupz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003177; classtype:social-engineering; sid:6003177; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflixportal.com/l/eyJzIjoiOTdlOTcwNmMtMmNhMC00MDE4LTkwOWYtMmEwOWM2ZWUwYmZlIiwiZSI6ImZhYjBiYTBhLTljZjEtNDhkOS04NzVkLTk3YTY4NTBlNGIwZiIsInNjIjoxMDYsInQiOjIzNn0.JISXji0yPrT4YJoruGafz7uDR3OpNzO414zjf05XsT0)"; flow:established,to_server; http.uri; content:"/l/eyJzIjoiOTdlOTcwNmMtMmNhMC00MDE4LTkwOWYtMmEwOWM2ZWUwYmZlIiwiZSI6ImZhYjBiYTBhLTljZjEtNDhkOS04NzVkLTk3YTY4NTBlNGIwZiIsInNjIjoxMDYsInQiOjIzNn0.JISXji0yPrT4YJoruGafz7uDR3OpNzO414zjf05XsT0"; startswith; fast_pattern; http.host; content:"netflixportal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003178; classtype:social-engineering; sid:6003178; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rfiwoa.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rfiwoa.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003179; classtype:social-engineering; sid:6003179; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (advicconsultant.com/newfd/)"; flow:established,to_server; http.uri; content:"/newfd/"; startswith; fast_pattern; http.host; content:"advicconsultant.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003180; classtype:social-engineering; sid:6003180; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wvfpzu.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.wvfpzu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003181; classtype:social-engineering; sid:6003181; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.twxprm.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.twxprm.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003182; classtype:social-engineering; sid:6003182; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (makiru.com/bniyycir/dfsj)"; flow:established,to_server; http.uri; content:"/bniyycir/dfsj"; startswith; fast_pattern; http.host; content:"makiru.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003183; classtype:social-engineering; sid:6003183; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.sgepld.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.sgepld.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003184; classtype:social-engineering; sid:6003184; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tcinub.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.tcinub.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003185; classtype:social-engineering; sid:6003185; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.sdkaqv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.sdkaqv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003186; classtype:social-engineering; sid:6003186; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wzhlkt.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.wzhlkt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003187; classtype:social-engineering; sid:6003187; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.cloud-mahjong.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app.cloud-mahjong.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003188; classtype:social-engineering; sid:6003188; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (santafekllan2026.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"santafekllan2026.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003189; classtype:social-engineering; sid:6003189; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-inky.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-inky.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003190; classtype:social-engineering; sid:6003190; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.uktons.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.uktons.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003191; classtype:social-engineering; sid:6003191; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.gqwmtrx.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.gqwmtrx.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003192; classtype:social-engineering; sid:6003192; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.register-facebook.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.register-facebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003193; classtype:social-engineering; sid:6003193; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (we-tl-t-omj-s1b-qr-ci-sigma.vercel.app/?ci=tanispro@e2a585d5eb743d7e905e53960aa519b0cf4a.net)"; flow:established,to_server; http.uri; content:"/?ci=tanispro@e2a585d5eb743d7e905e53960aa519b0cf4a.net"; startswith; fast_pattern; http.host; content:"we-tl-t-omj-s1b-qr-ci-sigma.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003194; classtype:social-engineering; sid:6003194; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.oebjld.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.oebjld.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003195; classtype:social-engineering; sid:6003195; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jplwnzr.ink/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jplwnzr.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003196; classtype:social-engineering; sid:6003196; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (santafeklansdonarehjytydf.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"santafeklansdonarehjytydf.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003197; classtype:social-engineering; sid:6003197; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xjklba.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xjklba.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003198; classtype:social-engineering; sid:6003198; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vlinbge.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.vlinbge.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003199; classtype:social-engineering; sid:6003199; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qprflu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qprflu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003200; classtype:social-engineering; sid:6003200; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zuhgon.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.zuhgon.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003201; classtype:social-engineering; sid:6003201; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.yjlnef.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.yjlnef.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003202; classtype:social-engineering; sid:6003202; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ujiqdg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ujiqdg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003203; classtype:social-engineering; sid:6003203; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zcljnh.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zcljnh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003204; classtype:social-engineering; sid:6003204; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wraithcodedev.github.io/NetflixClone_23)"; flow:established,to_server; http.uri; content:"/NetflixClone_23"; startswith; fast_pattern; http.host; content:"wraithcodedev.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003205; classtype:social-engineering; sid:6003205; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (les13ter.github.io/Lester/)"; flow:established,to_server; http.uri; content:"/Lester/"; startswith; fast_pattern; http.host; content:"les13ter.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003206; classtype:social-engineering; sid:6003206; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wycgeh.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.wycgeh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003207; classtype:social-engineering; sid:6003207; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.trezrr-start.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.trezrr-start.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003208; classtype:social-engineering; sid:6003208; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member060.ad-agency-meta.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member060.ad-agency-meta.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003209; classtype:social-engineering; sid:6003209; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (seguridadsocialnoticias.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"seguridadsocialnoticias.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003210; classtype:social-engineering; sid:6003210; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflixportal.com/l/eyJzIjoiN2I0NmE0OTQtZGY3ZC00OGUxLTk3MWMtMjg1ZmQzYzE4YWQxIiwiZSI6IjIxZmQ5NzUwLTFmYTgtNGI3MS04N2EzLTUzNThhZmM3NGEyZSIsInNjIjoxMDYsInQiOjIzMn0.ZMY9yeIVyyOY6kjQSg9tvQHjrvlWuVNO7IK4OGrNZF4)"; flow:established,to_server; http.uri; content:"/l/eyJzIjoiN2I0NmE0OTQtZGY3ZC00OGUxLTk3MWMtMjg1ZmQzYzE4YWQxIiwiZSI6IjIxZmQ5NzUwLTFmYTgtNGI3MS04N2EzLTUzNThhZmM3NGEyZSIsInNjIjoxMDYsInQiOjIzMn0.ZMY9yeIVyyOY6kjQSg9tvQHjrvlWuVNO7IK4OGrNZF4"; startswith; fast_pattern; http.host; content:"netflixportal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003211; classtype:social-engineering; sid:6003211; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.baibo-acmilan.games/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.baibo-acmilan.games"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003212; classtype:social-engineering; sid:6003212; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nudcab.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nudcab.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003213; classtype:social-engineering; sid:6003213; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-similer.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-similer.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003214; classtype:social-engineering; sid:6003214; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ypdewc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ypdewc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003215; classtype:social-engineering; sid:6003215; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.soqgix.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.soqgix.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003216; classtype:social-engineering; sid:6003216; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zukvof.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.zukvof.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003217; classtype:social-engineering; sid:6003217; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nbjcsx.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.nbjcsx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003218; classtype:social-engineering; sid:6003218; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.verif.sukxhj.tacorsa.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.verif.sukxhj.tacorsa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003219; classtype:social-engineering; sid:6003219; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-protegido.github.io/tiktok)"; flow:established,to_server; http.uri; content:"/tiktok"; startswith; fast_pattern; http.host; content:"site-protegido.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003220; classtype:social-engineering; sid:6003220; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tqdcnb.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.tqdcnb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003221; classtype:social-engineering; sid:6003221; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.reimagined-funicular-jmjb.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.reimagined-funicular-jmjb.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003222; classtype:social-engineering; sid:6003222; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mnjeqr.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.mnjeqr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003223; classtype:social-engineering; sid:6003223; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.txhidn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.txhidn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003224; classtype:social-engineering; sid:6003224; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (formxncostmernz.guaranted.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"formxncostmernz.guaranted.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003225; classtype:social-engineering; sid:6003225; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.clone-facebook-one.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.clone-facebook-one.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003226; classtype:social-engineering; sid:6003226; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tnbqvs.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.tnbqvs.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003227; classtype:social-engineering; sid:6003227; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp.ho.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp.ho.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003228; classtype:social-engineering; sid:6003228; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.minfogbo-cctv.bet/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.minfogbo-cctv.bet"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003229; classtype:social-engineering; sid:6003229; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ktipyw.top/pay?SYY=7mhqp?vPw=pex0n)"; flow:established,to_server; http.uri; content:"/pay?SYY=7mhqp?vPw=pex0n"; startswith; fast_pattern; http.host; content:"t-mobile.ktipyw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003230; classtype:social-engineering; sid:6003230; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.phtjmr.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.phtjmr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003231; classtype:social-engineering; sid:6003231; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nufyjo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nufyjo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003232; classtype:social-engineering; sid:6003232; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezuriostart.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezuriostart.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003233; classtype:social-engineering; sid:6003233; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flerine.hoslint.fr/redre/redir.php/?email=alor7@e19321315905222902645edd2aa1740a4f97.com)"; flow:established,to_server; http.uri; content:"/redre/redir.php/?email=alor7@e19321315905222902645edd2aa1740a4f97.com"; startswith; fast_pattern; http.host; content:"flerine.hoslint.fr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003234; classtype:social-engineering; sid:6003234; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tikkw.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.tikkw.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003235; classtype:social-engineering; sid:6003235; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qukgdp.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.qukgdp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003236; classtype:social-engineering; sid:6003236; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ruqfcl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ruqfcl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003237; classtype:social-engineering; sid:6003237; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocooc.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocooc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003238; classtype:social-engineering; sid:6003238; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kplxqt.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kplxqt.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003239; classtype:social-engineering; sid:6003239; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.oxwtkb.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.oxwtkb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003240; classtype:social-engineering; sid:6003240; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflixportal.com/l/eyJzIjoiNmVkZTU4ZDItMDgwMS00NmEyLThlNGMtZGNlZDc1OGM3OTNkIiwiZSI6IjU0MTkyNGUwLTZiZTYtNDFmNy1iMGFhLTJkMGFmY2E0MjEyOSIsInNjIjoxMDYsInQiOjIzNn0.Do_K0P8BWaV7ixTZhdBAbzcn5f1-_Z5NxTI00ZgvQp0)"; flow:established,to_server; http.uri; content:"/l/eyJzIjoiNmVkZTU4ZDItMDgwMS00NmEyLThlNGMtZGNlZDc1OGM3OTNkIiwiZSI6IjU0MTkyNGUwLTZiZTYtNDFmNy1iMGFhLTJkMGFmY2E0MjEyOSIsInNjIjoxMDYsInQiOjIzNn0.Do_K0P8BWaV7ixTZhdBAbzcn5f1-_Z5NxTI00ZgvQp0"; startswith; fast_pattern; http.host; content:"netflixportal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003241; classtype:social-engineering; sid:6003241; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pnfgrv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pnfgrv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003242; classtype:social-engineering; sid:6003242; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wnemky.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.wnemky.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003243; classtype:social-engineering; sid:6003243; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.gqwmtr.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.gqwmtr.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003244; classtype:social-engineering; sid:6003244; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (20-215-193-50.cprapid.com/pl/update.php?n5xylbe2jbxm88w4npl5)"; flow:established,to_server; http.uri; content:"/pl/update.php?n5xylbe2jbxm88w4npl5"; startswith; fast_pattern; http.host; content:"20-215-193-50.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003245; classtype:social-engineering; sid:6003245; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.urmnbe.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.urmnbe.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003246; classtype:social-engineering; sid:6003246; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xatmpj.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.xatmpj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003247; classtype:social-engineering; sid:6003247; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.higtmf.top/pay?Gnr=uGlWk?ePF=XxMBn)"; flow:established,to_server; http.uri; content:"/pay?Gnr=uGlWk?ePF=XxMBn"; startswith; fast_pattern; http.host; content:"t-mobile.higtmf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003248; classtype:social-engineering; sid:6003248; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vlinbgp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.vlinbgp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003249; classtype:social-engineering; sid:6003249; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.galabet1987.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.galabet1987.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003250; classtype:social-engineering; sid:6003250; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mycuwn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mycuwn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003251; classtype:social-engineering; sid:6003251; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (konaymyoaung202423mdy-dot.github.io/Hugo/)"; flow:established,to_server; http.uri; content:"/Hugo/"; startswith; fast_pattern; http.host; content:"konaymyoaung202423mdy-dot.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003252; classtype:social-engineering; sid:6003252; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mztsyv.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.mztsyv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003253; classtype:social-engineering; sid:6003253; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.utkple.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.utkple.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003254; classtype:social-engineering; sid:6003254; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vadreauv.site/auth/?email=alor7%40e19321315905222902645edd2aa1740a4f97.com)"; flow:established,to_server; http.uri; content:"/auth/?email=alor7%40e19321315905222902645edd2aa1740a4f97.com"; startswith; fast_pattern; http.host; content:"vadreauv.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003255; classtype:social-engineering; sid:6003255; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wylvpt.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.wylvpt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003256; classtype:social-engineering; sid:6003256; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (umitcappadocia.com/bhfcuonline/spgbuck/files/css/mn/)"; flow:established,to_server; http.uri; content:"/bhfcuonline/spgbuck/files/css/mn/"; startswith; fast_pattern; http.host; content:"umitcappadocia.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003257; classtype:social-engineering; sid:6003257; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rswehd.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rswehd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003258; classtype:social-engineering; sid:6003258; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qdlrxa.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.qdlrxa.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003259; classtype:social-engineering; sid:6003259; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bugunherzamnkndenguzel345306t5.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bugunherzamnkndenguzel345306t5.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003260; classtype:social-engineering; sid:6003260; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kamlase.sartography.info/?app_vl=ZoRwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=https://kamlase.sartography.info%7Bsui%7D&fn=&ln=&p=1&z=PLNONARAW-1805-IND01)"; flow:established,to_server; http.uri; content:"/?app_vl=ZoRwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=https://kamlase.sartography.info%7Bsui%7D&fn=&ln=&p=1&z=PLNONARAW-1805-IND01"; startswith; fast_pattern; http.host; content:"kamlase.sartography.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003261; classtype:social-engineering; sid:6003261; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zfvmcd.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zfvmcd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003262; classtype:social-engineering; sid:6003262; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ufwkpl.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.ufwkpl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003263; classtype:social-engineering; sid:6003263; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vizscw.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.vizscw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003264; classtype:social-engineering; sid:6003264; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qzpagv.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.qzpagv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003265; classtype:social-engineering; sid:6003265; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bt-105274.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bt-105274.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003266; classtype:social-engineering; sid:6003266; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.yrdphz.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.yrdphz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003267; classtype:social-engineering; sid:6003267; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqmvzt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqmvzt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003268; classtype:social-engineering; sid:6003268; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tdioje.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tdioje.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003269; classtype:social-engineering; sid:6003269; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xeyuis.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.xeyuis.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003270; classtype:social-engineering; sid:6003270; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hostperepe.sviluppo.host/ss/?LOG=592e9bbbfd157feb1b703aba3ec7b974816a94b38a2c62f5138787d0b9b4ee87)"; flow:established,to_server; http.uri; content:"/ss/?LOG=592e9bbbfd157feb1b703aba3ec7b974816a94b38a2c62f5138787d0b9b4ee87"; startswith; fast_pattern; http.host; content:"hostperepe.sviluppo.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003271; classtype:social-engineering; sid:6003271; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vpziam.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vpziam.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003272; classtype:social-engineering; sid:6003272; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.9328365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.9328365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003273; classtype:social-engineering; sid:6003273; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fref.offiallyy.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fref.offiallyy.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003274; classtype:social-engineering; sid:6003274; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (manualgcash.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"manualgcash.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003275; classtype:social-engineering; sid:6003275; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ubfjqi.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ubfjqi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003276; classtype:social-engineering; sid:6003276; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xeluht.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xeluht.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003277; classtype:social-engineering; sid:6003277; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rwoayh.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rwoayh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003278; classtype:social-engineering; sid:6003278; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.sgycjn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.sgycjn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003279; classtype:social-engineering; sid:6003279; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zrlqys.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zrlqys.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003280; classtype:social-engineering; sid:6003280; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.uteodn.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.uteodn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003281; classtype:social-engineering; sid:6003281; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nipjfh.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nipjfh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003282; classtype:social-engineering; sid:6003282; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yewomkandawire.me/amazon_clone/)"; flow:established,to_server; http.uri; content:"/amazon_clone/"; startswith; fast_pattern; http.host; content:"yewomkandawire.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003283; classtype:social-engineering; sid:6003283; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.urcxje.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.urcxje.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003284; classtype:social-engineering; sid:6003284; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lnmvwa.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lnmvwa.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003285; classtype:social-engineering; sid:6003285; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.towsmn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.towsmn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003286; classtype:social-engineering; sid:6003286; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tqlkni.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.tqlkni.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003287; classtype:social-engineering; sid:6003287; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflixportal.com/l/eyJzIjoiNjFmMGM3ZjQtZTg1NS00OTIzLWFjNWYtMWVkM2NhNzc2YzU1IiwiZSI6Ijc3MzUyZGRmLWQ1OWQtNDBkNC1iMjU0LWNlNmYzZjM4ZmIxZSIsInNjIjoxMDYsInQiOjIzNn0.cQefPrHCcdmebMA6XqyZPlOhYIz83Y5MSVYo-aBR5HM)"; flow:established,to_server; http.uri; content:"/l/eyJzIjoiNjFmMGM3ZjQtZTg1NS00OTIzLWFjNWYtMWVkM2NhNzc2YzU1IiwiZSI6Ijc3MzUyZGRmLWQ1OWQtNDBkNC1iMjU0LWNlNmYzZjM4ZmIxZSIsInNjIjoxMDYsInQiOjIzNn0.cQefPrHCcdmebMA6XqyZPlOhYIz83Y5MSVYo-aBR5HM"; startswith; fast_pattern; http.host; content:"netflixportal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003288; classtype:social-engineering; sid:6003288; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.www-57365.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.www-57365.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003289; classtype:social-engineering; sid:6003289; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ahmedhelalia.github.io/js-amazon-clone/)"; flow:established,to_server; http.uri; content:"/js-amazon-clone/"; startswith; fast_pattern; http.host; content:"ahmedhelalia.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003290; classtype:social-engineering; sid:6003290; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pvkezn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pvkezn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003291; classtype:social-engineering; sid:6003291; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (team-revie.github.io/work)"; flow:established,to_server; http.uri; content:"/work"; startswith; fast_pattern; http.host; content:"team-revie.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003292; classtype:social-engineering; sid:6003292; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ogylkq.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.ogylkq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003293; classtype:social-engineering; sid:6003293; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qjvkel.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.qjvkel.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003294; classtype:social-engineering; sid:6003294; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tikkw.shop/index/user/login.html)"; flow:established,to_server; http.uri; content:"/index/user/login.html"; startswith; fast_pattern; http.host; content:"www.tikkw.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003295; classtype:social-engineering; sid:6003295; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezrr-start.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezrr-start.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003296; classtype:social-engineering; sid:6003296; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.trezuriostart.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.trezuriostart.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003297; classtype:social-engineering; sid:6003297; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lkzuwt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lkzuwt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003298; classtype:social-engineering; sid:6003298; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflixportal.com/l/eyJzIjoiZjQ4YThkMTQtZTViMS00ZTFlLTlmYzUtYmVmNTk1NThjYTY1IiwiZSI6IjhiODRmZWVlLWJlODItNGMyMi05MjA1LWI2ZmRlYmM2ZmM0MyIsInNjIjoxMDYsInQiOjIzMn0.zruQLOFy-YNOxe-qovQSrF_CwkwaTtSrDnbEcs03GM4)"; flow:established,to_server; http.uri; content:"/l/eyJzIjoiZjQ4YThkMTQtZTViMS00ZTFlLTlmYzUtYmVmNTk1NThjYTY1IiwiZSI6IjhiODRmZWVlLWJlODItNGMyMi05MjA1LWI2ZmRlYmM2ZmM0MyIsInNjIjoxMDYsInQiOjIzMn0.zruQLOFy-YNOxe-qovQSrF_CwkwaTtSrDnbEcs03GM4"; startswith; fast_pattern; http.host; content:"netflixportal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003299; classtype:social-engineering; sid:6003299; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.sekaqo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.sekaqo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003300; classtype:social-engineering; sid:6003300; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vlinbgo.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.vlinbgo.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003301; classtype:social-engineering; sid:6003301; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tvjgco.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.tvjgco.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003302; classtype:social-engineering; sid:6003302; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ovtmkn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ovtmkn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003303; classtype:social-engineering; sid:6003303; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bggfccthhcttch.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bggfccthhcttch.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003304; classtype:social-engineering; sid:6003304; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.uabzyv.top/pay?rWo=BhqFC?mPd=NvvZR)"; flow:established,to_server; http.uri; content:"/pay?rWo=BhqFC?mPd=NvvZR"; startswith; fast_pattern; http.host; content:"t-mobile.uabzyv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003305; classtype:social-engineering; sid:6003305; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ly-yes.games/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ly-yes.games"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003306; classtype:social-engineering; sid:6003306; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (techyguy.co.bw/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"techyguy.co.bw"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003307; classtype:social-engineering; sid:6003307; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fb-login3shrii.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fb-login3shrii.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003308; classtype:social-engineering; sid:6003308; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tax-en-lrs.elreydistribuidor.com/irs/)"; flow:established,to_server; http.uri; content:"/irs/"; startswith; fast_pattern; http.host; content:"tax-en-lrs.elreydistribuidor.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003309; classtype:social-engineering; sid:6003309; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.uovxci.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.uovxci.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003310; classtype:social-engineering; sid:6003310; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflixportal.com/l/eyJzIjoiY2I0ZWE1YzItZDA4Ny00ODFmLWJhY2UtOGVlNjQzODAyNTEzIiwiZSI6Ijk1ZGQxOGM3LTMzYTgtNGQ1Yy05NjE3LWIwNzQzNzcxMGY4OSIsInNjIjoxMDYsInQiOjg3fQ.c1slpgyulTwK7conQBksi9oZ5Z7BfbiW9I2pTvdMdtY)"; flow:established,to_server; http.uri; content:"/l/eyJzIjoiY2I0ZWE1YzItZDA4Ny00ODFmLWJhY2UtOGVlNjQzODAyNTEzIiwiZSI6Ijk1ZGQxOGM3LTMzYTgtNGQ1Yy05NjE3LWIwNzQzNzcxMGY4OSIsInNjIjoxMDYsInQiOjg3fQ.c1slpgyulTwK7conQBksi9oZ5Z7BfbiW9I2pTvdMdtY"; startswith; fast_pattern; http.host; content:"netflixportal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003311; classtype:social-engineering; sid:6003311; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rplahx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rplahx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003312; classtype:social-engineering; sid:6003312; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gemini-login-account.gitbook.io/gemini)"; flow:established,to_server; http.uri; content:"/gemini"; startswith; fast_pattern; http.host; content:"gemini-login-account.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003313; classtype:social-engineering; sid:6003313; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vzxksl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vzxksl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003314; classtype:social-engineering; sid:6003314; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.galabetmobilresmi.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.galabetmobilresmi.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003315; classtype:social-engineering; sid:6003315; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wetyfb.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.wetyfb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003316; classtype:social-engineering; sid:6003316; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflixportal.com/l/eyJzIjoiMmFhNmFlZGItZTQ4Ny00Y2MxLWJjY2ItZWYzNzcwYTE5NGE0IiwiZSI6IjNiODNjOGE4LWY1NTgtNGMzMi04NWMzLWViZGEzNjQxYzYyZSIsInNjIjoxMDYsInQiOjIzNn0.sOhFLrFG6-p3fZOcHt5a5u2JshAuVxoOjpV2sOeTrxM)"; flow:established,to_server; http.uri; content:"/l/eyJzIjoiMmFhNmFlZGItZTQ4Ny00Y2MxLWJjY2ItZWYzNzcwYTE5NGE0IiwiZSI6IjNiODNjOGE4LWY1NTgtNGMzMi04NWMzLWViZGEzNjQxYzYyZSIsInNjIjoxMDYsInQiOjIzNn0.sOhFLrFG6-p3fZOcHt5a5u2JshAuVxoOjpV2sOeTrxM"; startswith; fast_pattern; http.host; content:"netflixportal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003317; classtype:social-engineering; sid:6003317; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nks.otw.mybluehost.me/DM/box/)"; flow:established,to_server; http.uri; content:"/DM/box/"; startswith; fast_pattern; http.host; content:"nks.otw.mybluehost.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003318; classtype:social-engineering; sid:6003318; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gemini-login-account.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gemini-login-account.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003319; classtype:social-engineering; sid:6003319; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pkefjb.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.pkefjb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003320; classtype:social-engineering; sid:6003320; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jczyfm.top/pay?dzq=OS4qR?OkA=yzhSx)"; flow:established,to_server; http.uri; content:"/pay?dzq=OS4qR?OkA=yzhSx"; startswith; fast_pattern; http.host; content:"t-mobile.jczyfm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003321; classtype:social-engineering; sid:6003321; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (manodumo-production.up.railway.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"manodumo-production.up.railway.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003322; classtype:social-engineering; sid:6003322; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (urlz.li/24d987bc)"; flow:established,to_server; http.uri; content:"/24d987bc"; startswith; fast_pattern; http.host; content:"urlz.li"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003323; classtype:social-engineering; sid:6003323; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (official-website.com.in/site/index/ppl1.php)"; flow:established,to_server; http.uri; content:"/site/index/ppl1.php"; startswith; fast_pattern; http.host; content:"official-website.com.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003324; classtype:social-engineering; sid:6003324; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-login-page-theta.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-login-page-theta.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003325; classtype:social-engineering; sid:6003325; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tsmywd.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.tsmywd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003326; classtype:social-engineering; sid:6003326; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nrelxt.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.nrelxt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003327; classtype:social-engineering; sid:6003327; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.saugfe.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.saugfe.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003328; classtype:social-engineering; sid:6003328; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wnvodz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wnvodz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003329; classtype:social-engineering; sid:6003329; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vlinbgw.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.vlinbgw.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003330; classtype:social-engineering; sid:6003330; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.owskip.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.owskip.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003331; classtype:social-engineering; sid:6003331; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.moguhw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.moguhw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003332; classtype:social-engineering; sid:6003332; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.npgvua.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.npgvua.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003333; classtype:social-engineering; sid:6003333; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wrnguq.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.wrnguq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003334; classtype:social-engineering; sid:6003334; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.r0bl0x.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.r0bl0x.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003335; classtype:social-engineering; sid:6003335; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pigluh.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pigluh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003336; classtype:social-engineering; sid:6003336; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.p210z.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.p210z.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003337; classtype:social-engineering; sid:6003337; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.stdycm.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.stdycm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003338; classtype:social-engineering; sid:6003338; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.hvlnpz.ink/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.hvlnpz.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003339; classtype:social-engineering; sid:6003339; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.fxrqtm.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.fxrqtm.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003340; classtype:social-engineering; sid:6003340; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wmpczx.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.wmpczx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003341; classtype:social-engineering; sid:6003341; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ymthcb.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.ymthcb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003342; classtype:social-engineering; sid:6003342; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tyhhgfghjtik.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.tyhhgfghjtik.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003343; classtype:social-engineering; sid:6003343; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.yirnjw.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.yirnjw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003344; classtype:social-engineering; sid:6003344; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.manualgcash.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.manualgcash.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003345; classtype:social-engineering; sid:6003345; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.otfrib.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.otfrib.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003346; classtype:social-engineering; sid:6003346; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nusaot.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nusaot.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003347; classtype:social-engineering; sid:6003347; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.thzgjd.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.thzgjd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003348; classtype:social-engineering; sid:6003348; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mzwfxy.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mzwfxy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003349; classtype:social-engineering; sid:6003349; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ysbjco.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.ysbjco.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003350; classtype:social-engineering; sid:6003350; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tcsgna.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.tcsgna.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003351; classtype:social-engineering; sid:6003351; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vpxsby.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.vpxsby.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003352; classtype:social-engineering; sid:6003352; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (srv-creator.github.io/insta/)"; flow:established,to_server; http.uri; content:"/insta/"; startswith; fast_pattern; http.host; content:"srv-creator.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003353; classtype:social-engineering; sid:6003353; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflixportal.com/l/eyJzIjoiYzdmOGZiYjctNDliZi00ZmE0LWExOTAtZTgxZGNjNTQ2MWVkIiwiZSI6IjFlZWI4MzViLWM1YjItNGIxZS1hYzI1LThiYjMzMmRiZThmZiIsInNjIjoxMDYsInQiOjIzNn0.KyVE8srH-dxHUL7L4Uvp5HQ9WKXfRA_pYcT4WdIUBrQ)"; flow:established,to_server; http.uri; content:"/l/eyJzIjoiYzdmOGZiYjctNDliZi00ZmE0LWExOTAtZTgxZGNjNTQ2MWVkIiwiZSI6IjFlZWI4MzViLWM1YjItNGIxZS1hYzI1LThiYjMzMmRiZThmZiIsInNjIjoxMDYsInQiOjIzNn0.KyVE8srH-dxHUL7L4Uvp5HQ9WKXfRA_pYcT4WdIUBrQ"; startswith; fast_pattern; http.host; content:"netflixportal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003354; classtype:social-engineering; sid:6003354; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wisencode.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wisencode.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003355; classtype:social-engineering; sid:6003355; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vlinbgt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.vlinbgt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003356; classtype:social-engineering; sid:6003356; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xhlpau.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xhlpau.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003357; classtype:social-engineering; sid:6003357; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xpcajq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xpcajq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003358; classtype:social-engineering; sid:6003358; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wlovkz.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.wlovkz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003359; classtype:social-engineering; sid:6003359; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xuqmcf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xuqmcf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003360; classtype:social-engineering; sid:6003360; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (poncevacay.com/lom/sl)"; flow:established,to_server; http.uri; content:"/lom/sl"; startswith; fast_pattern; http.host; content:"poncevacay.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003361; classtype:social-engineering; sid:6003361; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lqmvda.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lqmvda.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003362; classtype:social-engineering; sid:6003362; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.toieqk.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.toieqk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003363; classtype:social-engineering; sid:6003363; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xpmyuv.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.xpmyuv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003364; classtype:social-engineering; sid:6003364; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.srbaxv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.srbaxv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003365; classtype:social-engineering; sid:6003365; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xsqipd.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.xsqipd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003366; classtype:social-engineering; sid:6003366; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vhpayw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vhpayw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003367; classtype:social-engineering; sid:6003367; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (excel.officeoutlook.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"excel.officeoutlook.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003368; classtype:social-engineering; sid:6003368; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xkhbct.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xkhbct.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003369; classtype:social-engineering; sid:6003369; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bellsm12.github.io/rogers)"; flow:established,to_server; http.uri; content:"/rogers"; startswith; fast_pattern; http.host; content:"bellsm12.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003370; classtype:social-engineering; sid:6003370; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflixportal.com/l/eyJzIjoiMGUxNDlmZjgtZGY0ZS00ZDNiLTgxOGEtODk0NGI0NzY2NzAyIiwiZSI6IjQ0ODYzNGYyLTM2ZWEtNDBiZS1hZDJlLWMzYWVjMWM0MmNhMCIsInNjIjoxMDYsInQiOjIzMn0.-_lJXwnUm2AonGCMkTkxou9qcyDbM6C2voLaHxk5gyY)"; flow:established,to_server; http.uri; content:"/l/eyJzIjoiMGUxNDlmZjgtZGY0ZS00ZDNiLTgxOGEtODk0NGI0NzY2NzAyIiwiZSI6IjQ0ODYzNGYyLTM2ZWEtNDBiZS1hZDJlLWMzYWVjMWM0MmNhMCIsInNjIjoxMDYsInQiOjIzMn0.-_lJXwnUm2AonGCMkTkxou9qcyDbM6C2voLaHxk5gyY"; startswith; fast_pattern; http.host; content:"netflixportal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003371; classtype:social-engineering; sid:6003371; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.gala-betgiris.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.gala-betgiris.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003372; classtype:social-engineering; sid:6003372; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pasutb.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pasutb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003373; classtype:social-engineering; sid:6003373; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ymgqac.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ymgqac.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003374; classtype:social-engineering; sid:6003374; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8620qq.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8620qq.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003375; classtype:social-engineering; sid:6003375; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (authix.store/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"authix.store"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003376; classtype:social-engineering; sid:6003376; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lhraop.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lhraop.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003377; classtype:social-engineering; sid:6003377; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lineinstagram18.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"lineinstagram18.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003378; classtype:social-engineering; sid:6003378; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tjyzfu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tjyzfu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003379; classtype:social-engineering; sid:6003379; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vqmfph.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vqmfph.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003380; classtype:social-engineering; sid:6003380; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vgcylq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vgcylq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003381; classtype:social-engineering; sid:6003381; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (register-facebook.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"register-facebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003382; classtype:social-engineering; sid:6003382; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rnkbgt.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.rnkbgt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003383; classtype:social-engineering; sid:6003383; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lhodyq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lhodyq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003384; classtype:social-engineering; sid:6003384; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ictkvis.github.io/Stella/)"; flow:established,to_server; http.uri; content:"/Stella/"; startswith; fast_pattern; http.host; content:"ictkvis.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003385; classtype:social-engineering; sid:6003385; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vqkayw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vqkayw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003386; classtype:social-engineering; sid:6003386; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.oclaes.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.oclaes.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003387; classtype:social-engineering; sid:6003387; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.fqplwrn.ink/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.fqplwrn.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003388; classtype:social-engineering; sid:6003388; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pexctq.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.pexctq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003389; classtype:social-engineering; sid:6003389; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpdlocal.co-uklz.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dpdlocal.co-uklz.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003390; classtype:social-engineering; sid:6003390; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.galabet1987.com/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"m.galabet1987.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003391; classtype:social-engineering; sid:6003391; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-notictm.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-notictm.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003392; classtype:social-engineering; sid:6003392; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ourtime.members-dashboard.workers.dev/v3/help)"; flow:established,to_server; http.uri; content:"/v3/help"; startswith; fast_pattern; http.host; content:"ourtime.members-dashboard.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003393; classtype:social-engineering; sid:6003393; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.fqplmwr.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.fqplmwr.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003394; classtype:social-engineering; sid:6003394; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.yctzgq.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.yctzgq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003395; classtype:social-engineering; sid:6003395; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dolmetsch-uebersetzung.de/galafoods/mask.php?token=de0ea1a492cc1fc604304da4610ed7cc66f1338691eb1748d9a4ce2f624d93a6)"; flow:established,to_server; http.uri; content:"/galafoods/mask.php?token=de0ea1a492cc1fc604304da4610ed7cc66f1338691eb1748d9a4ce2f624d93a6"; startswith; fast_pattern; http.host; content:"dolmetsch-uebersetzung.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003396; classtype:social-engineering; sid:6003396; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vlrasd.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vlrasd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003397; classtype:social-engineering; sid:6003397; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gxjale.top/?U5G=zYw)"; flow:established,to_server; http.uri; content:"/?U5G=zYw"; startswith; fast_pattern; http.host; content:"www.gxjale.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003398; classtype:social-engineering; sid:6003398; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (url9436.australiansolarquotes.com.au/ls/click?upn=u001.GfDekECrzdkMuqxE3rD1Y38O5UYD7TxnSV4fJ1y1fJf1YlOVxnr577tUceY0yW2F_a04_-2FNJjR013WkGn05R3MUHkmqHJVvO6rJuXKnMBULDf8bIre9iM5C-2BzZSpNYzjCpMe8vEEfx6GlQ1dbv3zT8bOEKZ4EhTUdW1JWDqDx5kxp-2BpelH0iiksIQ1BfMps2drWE2228AkIfwpgD0aYtNdr9PvdqZ2QDY91q6Oxu7nzW-2BJsmoBi0j3ODbgAuF1uHaGxdBFparP4ciVzwAy6bgNsevBA-3D-3D)"; flow:established,to_server; http.uri; content:"/ls/click?upn=u001.GfDekECrzdkMuqxE3rD1Y38O5UYD7TxnSV4fJ1y1fJf1YlOVxnr577tUceY0yW2F_a04_-2FNJjR013WkGn05R3MUHkmqHJVvO6rJuXKnMBULDf8bIre9iM5C-2BzZSpNYzjCpMe8vEEfx6GlQ1dbv3zT8bOEKZ4EhTUdW1JWDqDx5kxp-2BpelH0iiksIQ1BfMps2drWE2228AkIfwpgD0aYtNdr9PvdqZ2QDY91q6Oxu7nzW-2BJsmoBi0j3ODbgAuF1uHaGxdBFparP4ciVzwAy6bgNsevBA-3D-3D"; startswith; fast_pattern; http.host; content:"url9436.australiansolarquotes.com.au"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003399; classtype:social-engineering; sid:6003399; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nwcgbo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nwcgbo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003400; classtype:social-engineering; sid:6003400; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflixportal.com/l/eyJzIjoiNGY4OWFiNjItZjY5MS00ZTc5LWExZDQtMTJhNjQzYjE5MzE2IiwiZSI6ImIzOWU3YmFhLThlYmYtNDk0My04MzI0LTFmZmRiYTc5OTY3MSIsInNjIjoxMDYsInQiOjIzNn0.XVX_vDvuZb8x8XwZpqgQ3rD7mgDmexlhD26RisW8aD0)"; flow:established,to_server; http.uri; content:"/l/eyJzIjoiNGY4OWFiNjItZjY5MS00ZTc5LWExZDQtMTJhNjQzYjE5MzE2IiwiZSI6ImIzOWU3YmFhLThlYmYtNDk0My04MzI0LTFmZmRiYTc5OTY3MSIsInNjIjoxMDYsInQiOjIzNn0.XVX_vDvuZb8x8XwZpqgQ3rD7mgDmexlhD26RisW8aD0"; startswith; fast_pattern; http.host; content:"netflixportal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003401; classtype:social-engineering; sid:6003401; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xdmuny.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xdmuny.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003402; classtype:social-engineering; sid:6003402; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vlinbgr.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.vlinbgr.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003403; classtype:social-engineering; sid:6003403; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qnwbsc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qnwbsc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003404; classtype:social-engineering; sid:6003404; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.oelcsx.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.oelcsx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003405; classtype:social-engineering; sid:6003405; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kxfdey.top/pay?fmu=NO1Rf?aJd=BlWxr)"; flow:established,to_server; http.uri; content:"/pay?fmu=NO1Rf?aJd=BlWxr"; startswith; fast_pattern; http.host; content:"t-mobile.kxfdey.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003406; classtype:social-engineering; sid:6003406; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nvrbca.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nvrbca.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003407; classtype:social-engineering; sid:6003407; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (devocional.github.io/tiktokpay)"; flow:established,to_server; http.uri; content:"/tiktokpay"; startswith; fast_pattern; http.host; content:"devocional.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003408; classtype:social-engineering; sid:6003408; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vxydfr.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vxydfr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003409; classtype:social-engineering; sid:6003409; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kznwvqp.ink/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kznwvqp.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003410; classtype:social-engineering; sid:6003410; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rzmfhv.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.rzmfhv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003411; classtype:social-engineering; sid:6003411; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nwezrd.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.nwezrd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003412; classtype:social-engineering; sid:6003412; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.txmhea.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.txmhea.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003413; classtype:social-engineering; sid:6003413; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.shjicl.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.shjicl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003414; classtype:social-engineering; sid:6003414; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qdbovi.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qdbovi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003415; classtype:social-engineering; sid:6003415; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verif.sukxhj.tacorsa.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"verif.sukxhj.tacorsa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003416; classtype:social-engineering; sid:6003416; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vyfawb.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.vyfawb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003417; classtype:social-engineering; sid:6003417; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.czplwnr.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.czplwnr.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003418; classtype:social-engineering; sid:6003418; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.somnry.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.somnry.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003419; classtype:social-engineering; sid:6003419; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.oiwsze.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.oiwsze.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003420; classtype:social-engineering; sid:6003420; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.maphcf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.maphcf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003421; classtype:social-engineering; sid:6003421; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vdkxht.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vdkxht.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003422; classtype:social-engineering; sid:6003422; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zryefl.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.zryefl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003423; classtype:social-engineering; sid:6003423; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rldzgn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rldzgn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003424; classtype:social-engineering; sid:6003424; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth2usngwd0c88bdrvsharepoint.cshqo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auth2usngwd0c88bdrvsharepoint.cshqo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003425; classtype:social-engineering; sid:6003425; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wfotjn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wfotjn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003426; classtype:social-engineering; sid:6003426; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (network.collabcryptoresolver.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"network.collabcryptoresolver.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003427; classtype:social-engineering; sid:6003427; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.7763333.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.7763333.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003428; classtype:social-engineering; sid:6003428; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lqdtaz.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.lqdtaz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003429; classtype:social-engineering; sid:6003429; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.onl1ne-cityp1chnha2026.hstn.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.onl1ne-cityp1chnha2026.hstn.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003430; classtype:social-engineering; sid:6003430; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tevhcy.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tevhcy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003431; classtype:social-engineering; sid:6003431; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tmbide.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.tmbide.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003432; classtype:social-engineering; sid:6003432; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.plwrzn.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.plwrzn.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003433; classtype:social-engineering; sid:6003433; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dolmetsch-uebersetzung.de/galafoods/)"; flow:established,to_server; http.uri; content:"/galafoods/"; startswith; fast_pattern; http.host; content:"dolmetsch-uebersetzung.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003434; classtype:social-engineering; sid:6003434; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mpuyjd.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mpuyjd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003435; classtype:social-engineering; sid:6003435; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wnfoib.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.wnfoib.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003436; classtype:social-engineering; sid:6003436; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cmctecnologia.com.br/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cmctecnologia.com.br"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003437; classtype:social-engineering; sid:6003437; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezurstart-app.wixstudio.com/app-en)"; flow:established,to_server; http.uri; content:"/app-en"; startswith; fast_pattern; http.host; content:"trezurstart-app.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003438; classtype:social-engineering; sid:6003438; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (revolut.s-host.net/cgi-sys/suspendedpage.cgi)"; flow:established,to_server; http.uri; content:"/cgi-sys/suspendedpage.cgi"; startswith; fast_pattern; http.host; content:"revolut.s-host.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003439; classtype:social-engineering; sid:6003439; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.oferta30582594.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalnie.oferta30582594.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003440; classtype:social-engineering; sid:6003440; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (traezore-bridge.zapier.app/guide)"; flow:established,to_server; http.uri; content:"/guide"; startswith; fast_pattern; http.host; content:"traezore-bridge.zapier.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003441; classtype:social-engineering; sid:6003441; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (costaricanoticiastoday.com/css/css/)"; flow:established,to_server; http.uri; content:"/css/css/"; startswith; fast_pattern; http.host; content:"costaricanoticiastoday.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003442; classtype:social-engineering; sid:6003442; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (link.sbstck.com/redirect/432813e1-fdef-419d-8f43-8011888df53c?j=eyJ1IjoiNW9oZHVhIn0.EylumtAMfqXg01buj_5H-y5kD7sbF8gowbiwSM0O4c4)"; flow:established,to_server; http.uri; content:"/redirect/432813e1-fdef-419d-8f43-8011888df53c?j=eyJ1IjoiNW9oZHVhIn0.EylumtAMfqXg01buj_5H-y5kD7sbF8gowbiwSM0O4c4"; startswith; fast_pattern; http.host; content:"link.sbstck.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003443; classtype:social-engineering; sid:6003443; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezbridgen.zapier.app/homepage)"; flow:established,to_server; http.uri; content:"/homepage"; startswith; fast_pattern; http.host; content:"trezbridgen.zapier.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003444; classtype:social-engineering; sid:6003444; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help-ledgerstrp.zapier.app/start)"; flow:established,to_server; http.uri; content:"/start"; startswith; fast_pattern; http.host; content:"help-ledgerstrp.zapier.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003445; classtype:social-engineering; sid:6003445; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iostart-app-trexio.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"iostart-app-trexio.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003446; classtype:social-engineering; sid:6003446; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreibihwgzhia5dufn5eqhsuo5fej3li2shfthp76sr74dtpellkvc3q.ipfs.inbrowser.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreibihwgzhia5dufn5eqhsuo5fej3li2shfthp76sr74dtpellkvc3q.ipfs.inbrowser.link"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003447; classtype:social-engineering; sid:6003447; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webkoprabymandiri.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webkoprabymandiri.godaddysites.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003448; classtype:social-engineering; sid:6003448; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ca-app-63.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ca-app-63.info"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003449; classtype:social-engineering; sid:6003449; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (valueser.com/?p=89028)"; flow:established,to_server; http.uri; content:"/?p=89028"; startswith; fast_pattern; http.host; content:"valueser.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003450; classtype:social-engineering; sid:6003450; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pascal.ca-app-63.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pascal.ca-app-63.info"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003451; classtype:social-engineering; sid:6003451; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (scnv.io/debix/)"; flow:established,to_server; http.uri; content:"/debix/"; startswith; fast_pattern; http.host; content:"scnv.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003452; classtype:social-engineering; sid:6003452; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (online-express-53.firebaseapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"online-express-53.firebaseapp.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003453; classtype:social-engineering; sid:6003453; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (points-myshop.yachts/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"points-myshop.yachts"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003454; classtype:social-engineering; sid:6003454; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (leonard.ca-app-63.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"leonard.ca-app-63.info"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003455; classtype:social-engineering; sid:6003455; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (startedio-trxorapps.wixstudio.com/en-start)"; flow:established,to_server; http.uri; content:"/en-start"; startswith; fast_pattern; http.host; content:"startedio-trxorapps.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003456; classtype:social-engineering; sid:6003456; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agricole.bolt.host/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"agricole.bolt.host"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003457; classtype:social-engineering; sid:6003457; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (onl1ne-cityp1chnha2026.hstn.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"onl1ne-cityp1chnha2026.hstn.me"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003458; classtype:social-engineering; sid:6003458; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (startledgersso.ghost.io/en-ldgrlive)"; flow:established,to_server; http.uri; content:"/en-ldgrlive"; startswith; fast_pattern; http.host; content:"startledgersso.ghost.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003459; classtype:social-engineering; sid:6003459; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (623458177244768273454332245.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"623458177244768273454332245.blogspot.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003460; classtype:social-engineering; sid:6003460; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (espressobot.gitbook.io/espressobot-docs)"; flow:established,to_server; http.uri; content:"/espressobot-docs"; startswith; fast_pattern; http.host; content:"espressobot.gitbook.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003461; classtype:social-engineering; sid:6003461; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agricole.bolt.host/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"agricole.bolt.host"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003462; classtype:social-engineering; sid:6003462; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (short.im/opdhfog)"; flow:established,to_server; http.uri; content:"/opdhfog"; startswith; fast_pattern; http.host; content:"short.im"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003463; classtype:social-engineering; sid:6003463; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alexandre.ca-app-63.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"alexandre.ca-app-63.info"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003464; classtype:social-engineering; sid:6003464; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (linknowmedia.vip/wp-signup.php?new=lighthouseintegratedsolutions.com)"; flow:established,to_server; http.uri; content:"/wp-signup.php?new=lighthouseintegratedsolutions.com"; startswith; fast_pattern; http.host; content:"linknowmedia.vip"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003465; classtype:social-engineering; sid:6003465; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (crococommercial.co.zw/jim)"; flow:established,to_server; http.uri; content:"/jim"; startswith; fast_pattern; http.host; content:"crococommercial.co.zw"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003466; classtype:social-engineering; sid:6003466; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgrestart-io.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"ledgrestart-io.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003467; classtype:social-engineering; sid:6003467; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mxtamaseklogxn.gitbook.io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"mxtamaseklogxn.gitbook.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003468; classtype:social-engineering; sid:6003468; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (exceldc01net.web.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"exceldc01net.web.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003469; classtype:social-engineering; sid:6003469; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (plusbhd1-dot.github.io/afpbhd)"; flow:established,to_server; http.uri; content:"/afpbhd"; startswith; fast_pattern; http.host; content:"plusbhd1-dot.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003470; classtype:social-engineering; sid:6003470; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamsklogec.gitbook.io/is)"; flow:established,to_server; http.uri; content:"/is"; startswith; fast_pattern; http.host; content:"metamsklogec.gitbook.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003471; classtype:social-engineering; sid:6003471; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (startguidetrezo.zapier.app/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"startguidetrezo.zapier.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003472; classtype:social-engineering; sid:6003472; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ekans122.github.io/TWA-test/)"; flow:established,to_server; http.uri; content:"/TWA-test/"; startswith; fast_pattern; http.host; content:"ekans122.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003473; classtype:social-engineering; sid:6003473; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (servicioncanje.club/gt?_eat=valid_20260520025913_821ec5a31043da012c0b3e2aa4327ac3)"; flow:established,to_server; http.uri; content:"/gt?_eat=valid_20260520025913_821ec5a31043da012c0b3e2aa4327ac3"; startswith; fast_pattern; http.host; content:"servicioncanje.club"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003474; classtype:social-engineering; sid:6003474; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.urbanvixenclothing.com/wp-content/DKB/)"; flow:established,to_server; http.uri; content:"/wp-content/DKB/"; startswith; fast_pattern; http.host; content:"www.urbanvixenclothing.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003475; classtype:social-engineering; sid:6003475; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (873ue64.top/ylprzghg/jniolM/l8xV3O)"; flow:established,to_server; http.uri; content:"/ylprzghg/jniolM/l8xV3O"; startswith; fast_pattern; http.host; content:"873ue64.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003476; classtype:social-engineering; sid:6003476; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail-free.clients-2.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webmail-free.clients-2.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003477; classtype:social-engineering; sid:6003477; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (start-trezerioapps.wixstudio.com/en-start)"; flow:established,to_server; http.uri; content:"/en-start"; startswith; fast_pattern; http.host; content:"start-trezerioapps.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003478; classtype:social-engineering; sid:6003478; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www-currently-sign-in-6fdb9c.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www-currently-sign-in-6fdb9c.webflow.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003479; classtype:social-engineering; sid:6003479; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myshop-points.yachts/ms/home.html)"; flow:established,to_server; http.uri; content:"/ms/home.html"; startswith; fast_pattern; http.host; content:"myshop-points.yachts"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003480; classtype:social-engineering; sid:6003480; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (crediitmutueel-fr.s-host.net/cgi-sys/suspendedpage.cgi)"; flow:established,to_server; http.uri; content:"/cgi-sys/suspendedpage.cgi"; startswith; fast_pattern; http.host; content:"crediitmutueel-fr.s-host.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003481; classtype:social-engineering; sid:6003481; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpd.com.sxnckj.com/ksfCEoOuaa)"; flow:established,to_server; http.uri; content:"/ksfCEoOuaa"; startswith; fast_pattern; http.host; content:"www.dpd.com.sxnckj.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003482; classtype:social-engineering; sid:6003482; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.creeditrnutuel.s-host.net/cgi-sys/suspendedpage.cgi)"; flow:established,to_server; http.uri; content:"/cgi-sys/suspendedpage.cgi"; startswith; fast_pattern; http.host; content:"mail.creeditrnutuel.s-host.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003483; classtype:social-engineering; sid:6003483; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tax-en-lrs.braliacorp.com/irs/)"; flow:established,to_server; http.uri; content:"/irs/"; startswith; fast_pattern; http.host; content:"tax-en-lrs.braliacorp.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003484; classtype:social-engineering; sid:6003484; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (startedapp-lexorcdn.wixstudio.com/live-en)"; flow:established,to_server; http.uri; content:"/live-en"; startswith; fast_pattern; http.host; content:"startedapp-lexorcdn.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003485; classtype:social-engineering; sid:6003485; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nav-global.wixstudio.com/bridge-en)"; flow:established,to_server; http.uri; content:"/bridge-en"; startswith; fast_pattern; http.host; content:"nav-global.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003486; classtype:social-engineering; sid:6003486; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.crediitmutueel-fr.s-host.net/cgi-sys/suspendedpage.cgi)"; flow:established,to_server; http.uri; content:"/cgi-sys/suspendedpage.cgi"; startswith; fast_pattern; http.host; content:"mail.crediitmutueel-fr.s-host.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003487; classtype:social-engineering; sid:6003487; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wevtesolve.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wevtesolve.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003488; classtype:social-engineering; sid:6003488; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lekdger-usdesktop.wixstudio.com/enus)"; flow:established,to_server; http.uri; content:"/enus"; startswith; fast_pattern; http.host; content:"lekdger-usdesktop.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003489; classtype:social-engineering; sid:6003489; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mitamxsklogun.gitbook.io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"mitamxsklogun.gitbook.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003490; classtype:social-engineering; sid:6003490; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maxises.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"maxises.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003491; classtype:social-engineering; sid:6003491; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spport1mai1.webcindario.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spport1mai1.webcindario.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003492; classtype:social-engineering; sid:6003492; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-mercadollivre.myshopify.com/products/micro-ondas-electrolux-inox-23l-efficient-me23s?utm_source=organic&\;amp%3Butm_campaign=&\;amp%3Butm_medium=&\;amp%3Butm_content=&\;amp%3Butm_term=)"; flow:established,to_server; http.uri; content:"/products/micro-ondas-electrolux-inox-23l-efficient-me23s?utm_source=organic&|3b|amp%3Butm_campaign=&|3b|amp%3Butm_medium=&|3b|amp%3Butm_content=&|3b|amp%3Butm_term="; startswith; fast_pattern; http.host; content:"app-mercadollivre.myshopify.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003493; classtype:social-engineering; sid:6003493; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pimco-du2.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pimco-du2.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003494; classtype:social-engineering; sid:6003494; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-438c14b363cc46a89d2220ab8fbe9c7b.r2.dev/sharepointPg.html#WjNKNlpXZHZjbm91YzNwMVltRkFjR3R2WW5BdWNHdz0=&excel)"; flow:established,to_server; http.uri; content:"/sharepointPg.html#WjNKNlpXZHZjbm91YzNwMVltRkFjR3R2WW5BdWNHdz0=&excel"; startswith; fast_pattern; http.host; content:"pub-438c14b363cc46a89d2220ab8fbe9c7b.r2.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003495; classtype:social-engineering; sid:6003495; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.crediitmutueel-fr.s-host.net/cgi-sys/suspendedpage.cgi)"; flow:established,to_server; http.uri; content:"/cgi-sys/suspendedpage.cgi"; startswith; fast_pattern; http.host; content:"www.crediitmutueel-fr.s-host.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003496; classtype:social-engineering; sid:6003496; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myshop-points.boats/ms/home.html)"; flow:established,to_server; http.uri; content:"/ms/home.html"; startswith; fast_pattern; http.host; content:"myshop-points.boats"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003497; classtype:social-engineering; sid:6003497; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bancopichinchastage.prod.acquia-sites.com/restrict_ip/access_denied)"; flow:established,to_server; http.uri; content:"/restrict_ip/access_denied"; startswith; fast_pattern; http.host; content:"bancopichinchastage.prod.acquia-sites.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003498; classtype:social-engineering; sid:6003498; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.creeditrnutuel.s-host.net/cgi-sys/suspendedpage.cgi)"; flow:established,to_server; http.uri; content:"/cgi-sys/suspendedpage.cgi"; startswith; fast_pattern; http.host; content:"www.creeditrnutuel.s-host.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003499; classtype:social-engineering; sid:6003499; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (canjeaefpuntos.club/gt)"; flow:established,to_server; http.uri; content:"/gt"; startswith; fast_pattern; http.host; content:"canjeaefpuntos.club"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003500; classtype:social-engineering; sid:6003500; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rsdn.org/Users/Logout.aspx?ReturnUrl=https%3A%2F%2Ftdzebli.com%2F1%2F%23Vp_K6eji)"; flow:established,to_server; http.uri; content:"/Users/Logout.aspx?ReturnUrl=https%3A%2F%2Ftdzebli.com%2F1%2F%23Vp_K6eji"; startswith; fast_pattern; http.host; content:"rsdn.org"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003501; classtype:social-engineering; sid:6003501; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (customer.farmersqueenslandpotato.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"customer.farmersqueenslandpotato.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003502; classtype:social-engineering; sid:6003502; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www-att-bellsouth-verifier-810c55.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www-att-bellsouth-verifier-810c55.webflow.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003503; classtype:social-engineering; sid:6003503; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (creeditrnutuel.s-host.net/cgi-sys/suspendedpage.cgi)"; flow:established,to_server; http.uri; content:"/cgi-sys/suspendedpage.cgi"; startswith; fast_pattern; http.host; content:"creeditrnutuel.s-host.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003504; classtype:social-engineering; sid:6003504; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-1d553c139e2b4614ab4a7a10ad8c064d.r2.dev/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-1d553c139e2b4614ab4a7a10ad8c064d.r2.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003505; classtype:social-engineering; sid:6003505; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (donnabellaeventos.com.br/launch/)"; flow:established,to_server; http.uri; content:"/launch/"; startswith; fast_pattern; http.host; content:"donnabellaeventos.com.br"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003506; classtype:social-engineering; sid:6003506; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flowcode.com/p/eUp9BHOaup?fc=0)"; flow:established,to_server; http.uri; content:"/p/eUp9BHOaup?fc=0"; startswith; fast_pattern; http.host; content:"flowcode.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003507; classtype:social-engineering; sid:6003507; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.banpromericabeneficios.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.banpromericabeneficios.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003508; classtype:social-engineering; sid:6003508; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paypal.cardpaysecurity.org/login/k3ZXZz5PrN87W8YYvf98PC7tyGARWWwY5VEA=4BQ==8SFlBSFlUZ1RXX1FW/itrbAUX3V4NnCpTUNsEnK9rZkxcrOcHP/)"; flow:established,to_server; http.uri; content:"/login/k3ZXZz5PrN87W8YYvf98PC7tyGARWWwY5VEA=4BQ==8SFlBSFlUZ1RXX1FW/itrbAUX3V4NnCpTUNsEnK9rZkxcrOcHP/"; startswith; fast_pattern; http.host; content:"paypal.cardpaysecurity.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003509; classtype:social-engineering; sid:6003509; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.we-tl-t-omj-s1b-qr-ci-sigma.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.we-tl-t-omj-s1b-qr-ci-sigma.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003510; classtype:social-engineering; sid:6003510; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (parcelwaybill.co.za/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"parcelwaybill.co.za"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003511; classtype:social-engineering; sid:6003511; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (20-251-152-0.cprapid.com/ch/update.php)"; flow:established,to_server; http.uri; content:"/ch/update.php"; startswith; fast_pattern; http.host; content:"20-251-152-0.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003512; classtype:social-engineering; sid:6003512; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflx.bill.updt.paymt.0auth.129-121-102-155.cpanel.site/secure-3/loginbaru?auth_max_open=0&ref=C88Cfcqb1jrLUrY8onDXYH1Sthjk9FiF8GrinThIOLz4JKHbwmRjpfNADJQ2VTYkv7JxYqYnYZLeGqrRxwYPV2hGTWB1O87ztBdh)"; flow:established,to_server; http.uri; content:"/secure-3/loginbaru?auth_max_open=0&ref=C88Cfcqb1jrLUrY8onDXYH1Sthjk9FiF8GrinThIOLz4JKHbwmRjpfNADJQ2VTYkv7JxYqYnYZLeGqrRxwYPV2hGTWB1O87ztBdh"; startswith; fast_pattern; http.host; content:"netflx.bill.updt.paymt.0auth.129-121-102-155.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003513; classtype:social-engineering; sid:6003513; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticyh.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-noticyh.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003514; classtype:social-engineering; sid:6003514; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hottest-squirting.verifytoken.com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"hottest-squirting.verifytoken.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003515; classtype:social-engineering; sid:6003515; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.zimbras.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.zimbras.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003516; classtype:social-engineering; sid:6003516; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pratik-ghrcemp.github.io/amazon-clone-project./)"; flow:established,to_server; http.uri; content:"/amazon-clone-project./"; startswith; fast_pattern; http.host; content:"pratik-ghrcemp.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003517; classtype:social-engineering; sid:6003517; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bitter-limit-a1c1.dazesdsxcxmlcxcxcc.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bitter-limit-a1c1.dazesdsxcxmlcxcxcc.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003518; classtype:social-engineering; sid:6003518; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.both-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.both-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003519; classtype:social-engineering; sid:6003519; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (semprebuscandoaltoalcance.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"semprebuscandoaltoalcance.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003520; classtype:social-engineering; sid:6003520; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (24431253615351.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"24431253615351.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003521; classtype:social-engineering; sid:6003521; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ec2-100-24-254-151.compute-1.amazonaws.com/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"ec2-100-24-254-151.compute-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003522; classtype:social-engineering; sid:6003522; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mahwi.com/wp-admin/az/reb/)"; flow:established,to_server; http.uri; content:"/wp-admin/az/reb/"; startswith; fast_pattern; http.host; content:"mahwi.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003523; classtype:social-engineering; sid:6003523; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (parama-ekspresskargo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"parama-ekspresskargo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003524; classtype:social-engineering; sid:6003524; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dnyaneshwarkumbhar510-design.github.io/Amazon_clone)"; flow:established,to_server; http.uri; content:"/Amazon_clone"; startswith; fast_pattern; http.host; content:"dnyaneshwarkumbhar510-design.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003525; classtype:social-engineering; sid:6003525; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.rogersreplay.us/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.rogersreplay.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003526; classtype:social-engineering; sid:6003526; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0ffice355docuiment.kpmg.tecnopackbolivia.com/cgi-bin/save?aGFucy5oYWxsZWZvcnNAa3BtZy5zZQ)"; flow:established,to_server; http.uri; content:"/cgi-bin/save?aGFucy5oYWxsZWZvcnNAa3BtZy5zZQ"; startswith; fast_pattern; http.host; content:"0ffice355docuiment.kpmg.tecnopackbolivia.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003527; classtype:social-engineering; sid:6003527; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-project-c3b61.web.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-project-c3b61.web.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003528; classtype:social-engineering; sid:6003528; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cn.hot-bet365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cn.hot-bet365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003529; classtype:social-engineering; sid:6003529; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0905twrlpa.syncpath-connectsrv.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0905twrlpa.syncpath-connectsrv.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003530; classtype:social-engineering; sid:6003530; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (compr1sw.webcindario.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"compr1sw.webcindario.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003531; classtype:social-engineering; sid:6003531; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mummyweberp.com/kloi/)"; flow:established,to_server; http.uri; content:"/kloi/"; startswith; fast_pattern; http.host; content:"mummyweberp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003532; classtype:social-engineering; sid:6003532; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (phylo-8.github.io/Amazon-github.io/)"; flow:established,to_server; http.uri; content:"/Amazon-github.io/"; startswith; fast_pattern; http.host; content:"phylo-8.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003533; classtype:social-engineering; sid:6003533; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pardeepbansal882-gif.github.io/netflix/login.html)"; flow:established,to_server; http.uri; content:"/netflix/login.html"; startswith; fast_pattern; http.host; content:"pardeepbansal882-gif.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003534; classtype:social-engineering; sid:6003534; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kucoim-login.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kucoim-login.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003535; classtype:social-engineering; sid:6003535; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpdlocal.co-ukci.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dpdlocal.co-ukci.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003536; classtype:social-engineering; sid:6003536; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (plane-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"plane-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003537; classtype:social-engineering; sid:6003537; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amzwon.at/?r=94c6b7a7-0cc0-43e7-83b4-cc37b6f485ad&rg=eu)"; flow:established,to_server; http.uri; content:"/?r=94c6b7a7-0cc0-43e7-83b4-cc37b6f485ad&rg=eu"; startswith; fast_pattern; http.host; content:"amzwon.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003538; classtype:social-engineering; sid:6003538; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.qrcodechimp.com/page/tf8d92yjdge4?v=chk1779105063)"; flow:established,to_server; http.uri; content:"/page/tf8d92yjdge4?v=chk1779105063"; startswith; fast_pattern; http.host; content:"www.qrcodechimp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003539; classtype:social-engineering; sid:6003539; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (74-161-163-131.cprapid.com/ch/update.php)"; flow:established,to_server; http.uri; content:"/ch/update.php"; startswith; fast_pattern; http.host; content:"74-161-163-131.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003540; classtype:social-engineering; sid:6003540; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-website-beryl.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-website-beryl.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003541; classtype:social-engineering; sid:6003541; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sunny-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.sunny-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003542; classtype:social-engineering; sid:6003542; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ss-5ee.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ss-5ee.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003543; classtype:social-engineering; sid:6003543; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (h5.doc-bet365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"h5.doc-bet365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003544; classtype:social-engineering; sid:6003544; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (walrus-app-ufekd.ondigitalocean.app/werrx01USAHTML/)"; flow:established,to_server; http.uri; content:"/werrx01USAHTML/"; startswith; fast_pattern; http.host; content:"walrus-app-ufekd.ondigitalocean.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003545; classtype:social-engineering; sid:6003545; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-notictb.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-notictb.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003546; classtype:social-engineering; sid:6003546; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortcomp.lol/id/login)"; flow:established,to_server; http.uri; content:"/id/login"; startswith; fast_pattern; http.host; content:"fortcomp.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003547; classtype:social-engineering; sid:6003547; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ht-links.de/Express)"; flow:established,to_server; http.uri; content:"/Express"; startswith; fast_pattern; http.host; content:"ht-links.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003548; classtype:social-engineering; sid:6003548; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix555-login.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix555-login.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003549; classtype:social-engineering; sid:6003549; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortylocker.life/id/login)"; flow:established,to_server; http.uri; content:"/id/login"; startswith; fast_pattern; http.host; content:"fortylocker.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003550; classtype:social-engineering; sid:6003550; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hfuihsdfhsdbfdshfbsdhbf.shop/id/login)"; flow:established,to_server; http.uri; content:"/id/login"; startswith; fast_pattern; http.host; content:"hfuihsdfhsdbfdshfbsdhbf.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003551; classtype:social-engineering; sid:6003551; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortvalue.info/id/login)"; flow:established,to_server; http.uri; content:"/id/login"; startswith; fast_pattern; http.host; content:"fortvalue.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003552; classtype:social-engineering; sid:6003552; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icy-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"icy-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003553; classtype:social-engineering; sid:6003553; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (luissalinas28021993-sys.github.io/finalfinal/)"; flow:established,to_server; http.uri; content:"/finalfinal/"; startswith; fast_pattern; http.host; content:"luissalinas28021993-sys.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003554; classtype:social-engineering; sid:6003554; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (carterearamos.us/dddd/all1.html?eta=salan9@86da112d488ac563c0658ed151e11371e045.net)"; flow:established,to_server; http.uri; content:"/dddd/all1.html?eta=salan9@86da112d488ac563c0658ed151e11371e045.net"; startswith; fast_pattern; http.host; content:"carterearamos.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003555; classtype:social-engineering; sid:6003555; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-family-affair.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-family-affair.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003556; classtype:social-engineering; sid:6003556; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.qpointsurvey.com/s/vjmotsuhuve7al3c/)"; flow:established,to_server; http.uri; content:"/s/vjmotsuhuve7al3c/"; startswith; fast_pattern; http.host; content:"app.qpointsurvey.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003557; classtype:social-engineering; sid:6003557; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ashmirekha.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"ashmirekha.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003558; classtype:social-engineering; sid:6003558; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sonhealtocopachegandosuachanceeagora.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"sonhealtocopachegandosuachanceeagora.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003559; classtype:social-engineering; sid:6003559; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bowyensr-3927ckoidz-conarjt.pages.dev/help/contact/24)"; flow:established,to_server; http.uri; content:"/help/contact/24"; startswith; fast_pattern; http.host; content:"bowyensr-3927ckoidz-conarjt.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003560; classtype:social-engineering; sid:6003560; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xsorex.com/id/login)"; flow:established,to_server; http.uri; content:"/id/login"; startswith; fast_pattern; http.host; content:"xsorex.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003561; classtype:social-engineering; sid:6003561; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jarahayat.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"jarahayat.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003562; classtype:social-engineering; sid:6003562; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sourcefuel.co.zw/postInf3gmbh-delivery/amount.php)"; flow:established,to_server; http.uri; content:"/postInf3gmbh-delivery/amount.php"; startswith; fast_pattern; http.host; content:"sourcefuel.co.zw"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003563; classtype:social-engineering; sid:6003563; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.faquob.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.faquob.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003564; classtype:social-engineering; sid:6003564; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aizhara.apsny.land/assfv43/log.php?ip=54.38.153.179)"; flow:established,to_server; http.uri; content:"/assfv43/log.php?ip=54.38.153.179"; startswith; fast_pattern; http.host; content:"aizhara.apsny.land"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003565; classtype:social-engineering; sid:6003565; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (beneficioswebonline-a594436edf62.herokuapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"beneficioswebonline-a594436edf62.herokuapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003566; classtype:social-engineering; sid:6003566; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (manmohantogi-wq.github.io/Amazone-clone-project/)"; flow:established,to_server; http.uri; content:"/Amazone-clone-project/"; startswith; fast_pattern; http.host; content:"manmohantogi-wq.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003567; classtype:social-engineering; sid:6003567; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alibharde2008.github.io/netflix-landing-page/)"; flow:established,to_server; http.uri; content:"/netflix-landing-page/"; startswith; fast_pattern; http.host; content:"alibharde2008.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003568; classtype:social-engineering; sid:6003568; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vishalls24.github.io/microsoft-clone/)"; flow:established,to_server; http.uri; content:"/microsoft-clone/"; startswith; fast_pattern; http.host; content:"vishalls24.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003569; classtype:social-engineering; sid:6003569; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (owa.sarbacame.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"owa.sarbacame.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003570; classtype:social-engineering; sid:6003570; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0ffice355docuiment.kpmg.tecnopackbolivia.com/cgi-bin/save/?aGFucy5oYWxsZWZvcnNAa3BtZy5zZQ)"; flow:established,to_server; http.uri; content:"/cgi-bin/save/?aGFucy5oYWxsZWZvcnNAa3BtZy5zZQ"; startswith; fast_pattern; http.host; content:"0ffice355docuiment.kpmg.tecnopackbolivia.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003571; classtype:social-engineering; sid:6003571; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.coinbaseinv.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.coinbaseinv.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003572; classtype:social-engineering; sid:6003572; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-growth.busines-help-center.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"business-growth.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003573; classtype:social-engineering; sid:6003573; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortnows.top/id/login)"; flow:established,to_server; http.uri; content:"/id/login"; startswith; fast_pattern; http.host; content:"fortnows.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003574; classtype:social-engineering; sid:6003574; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tkapp.wmorders.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tkapp.wmorders.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003575; classtype:social-engineering; sid:6003575; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (al-masrur.github.io/Amazon-Clone)"; flow:established,to_server; http.uri; content:"/Amazon-Clone"; startswith; fast_pattern; http.host; content:"al-masrur.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003576; classtype:social-engineering; sid:6003576; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.easybk.app.avanteshipping.com/lg/n3/R0BK6UGC0C/Select/login.php?cgi=GiELKO3wYgb73SkZHcabpx57rVT8RQgiiAohZwh067Pf9jqiAMA3n55UAdzdQBRNvcgI3qsG3aGiDzWnC3O4FPRkDXr6VwYkuCzMy4yEiLJh9)"; flow:established,to_server; http.uri; content:"/lg/n3/R0BK6UGC0C/Select/login.php?cgi=GiELKO3wYgb73SkZHcabpx57rVT8RQgiiAohZwh067Pf9jqiAMA3n55UAdzdQBRNvcgI3qsG3aGiDzWnC3O4FPRkDXr6VwYkuCzMy4yEiLJh9"; startswith; fast_pattern; http.host; content:"www.easybk.app.avanteshipping.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003577; classtype:social-engineering; sid:6003577; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ykone-tiktok.shop/login?next=%2F)"; flow:established,to_server; http.uri; content:"/login?next=%2F"; startswith; fast_pattern; http.host; content:"ykone-tiktok.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003578; classtype:social-engineering; sid:6003578; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suhfg120.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"suhfg120.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003579; classtype:social-engineering; sid:6003579; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (plans-powell-appreciated-helicopter.trycloudflare.com/sbv/main/login.php)"; flow:established,to_server; http.uri; content:"/sbv/main/login.php"; startswith; fast_pattern; http.host; content:"plans-powell-appreciated-helicopter.trycloudflare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003580; classtype:social-engineering; sid:6003580; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tkapp.horologehue.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tkapp.horologehue.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003581; classtype:social-engineering; sid:6003581; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store.workshopscommunityshared.com/sharedfiles/filesdetails/id=3669539904/)"; flow:established,to_server; http.uri; content:"/sharedfiles/filesdetails/id=3669539904/"; startswith; fast_pattern; http.host; content:"store.workshopscommunityshared.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003582; classtype:social-engineering; sid:6003582; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticyp.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-noticyp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003583; classtype:social-engineering; sid:6003583; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member757.partner-business-hub.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member757.partner-business-hub.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003584; classtype:social-engineering; sid:6003584; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ojajt-niea-7v4f.c-7jw91027.workers.dev/lp/J9iCjTP1kZw)"; flow:established,to_server; http.uri; content:"/lp/J9iCjTP1kZw"; startswith; fast_pattern; http.host; content:"ojajt-niea-7v4f.c-7jw91027.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003585; classtype:social-engineering; sid:6003585; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (exel.programcraftsoft.com/?etext=2202.g45OxrA0N8E76bx-l8btDkU2Iz1dfdz8rreIIHMLMX6CKkt3oF8fZgSHfDZoCo-3dmRtY2N6YXNranVhdnV0dA.df1512d061a723904da4d04ef1e973d84380be6d)"; flow:established,to_server; http.uri; content:"/?etext=2202.g45OxrA0N8E76bx-l8btDkU2Iz1dfdz8rreIIHMLMX6CKkt3oF8fZgSHfDZoCo-3dmRtY2N6YXNranVhdnV0dA.df1512d061a723904da4d04ef1e973d84380be6d"; startswith; fast_pattern; http.host; content:"exel.programcraftsoft.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003586; classtype:social-engineering; sid:6003586; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ledgers.at/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ledgers.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003587; classtype:social-engineering; sid:6003587; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mapodi.it/der/index.html)"; flow:established,to_server; http.uri; content:"/der/index.html"; startswith; fast_pattern; http.host; content:"www.mapodi.it"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003588; classtype:social-engineering; sid:6003588; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticyu.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-noticyu.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003589; classtype:social-engineering; sid:6003589; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (frank-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"frank-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003590; classtype:social-engineering; sid:6003590; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.paris-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.paris-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003591; classtype:social-engineering; sid:6003591; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (security-information.daftare.com/login?wa=wsignin1.0&$2y$10$v6W7bdPknzdkF1jbllCE3eXoH0.Fi/jKYFjJ7/JtSdZSCOYFrDmCO&openid.identity=Mozilla/5.0%20(Macintosh\;%20Intel%20Mac%20OS%20X%2010_14_4)%20AppleWebKit/605.1.15%20(KHTML,%20like%20Gecko))"; flow:established,to_server; http.uri; content:"/login?wa=wsignin1.0&$2y$10$v6W7bdPknzdkF1jbllCE3eXoH0.Fi/jKYFjJ7/JtSdZSCOYFrDmCO&openid.identity=Mozilla/5.0%20(Macintosh|3b|%20Intel%20Mac%20OS%20X%2010_14_4)%20AppleWebKit/605.1.15%20(KHTML,%20like%20Gecko)"; startswith; fast_pattern; http.host; content:"security-information.daftare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003592; classtype:social-engineering; sid:6003592; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0905twrlpa.syncpath-connectsrv.com/public/index?ref=business-support-center-DASDFDSYUYEE43FJDSHFSDFsetting%25popup%3fclient_id=889943718806-ual26tplnot2ea8b7n5t4p77keo8eb)"; flow:established,to_server; http.uri; content:"/public/index?ref=business-support-center-DASDFDSYUYEE43FJDSHFSDFsetting%25popup%3fclient_id=889943718806-ual26tplnot2ea8b7n5t4p77keo8eb"; startswith; fast_pattern; http.host; content:"0905twrlpa.syncpath-connectsrv.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003593; classtype:social-engineering; sid:6003593; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (erdaulet997.github.io/instagram-login/)"; flow:established,to_server; http.uri; content:"/instagram-login/"; startswith; fast_pattern; http.host; content:"erdaulet997.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003594; classtype:social-engineering; sid:6003594; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sourcefuel.co.zw/postInf3gmbh-delivery/load.php)"; flow:established,to_server; http.uri; content:"/postInf3gmbh-delivery/load.php"; startswith; fast_pattern; http.host; content:"sourcefuel.co.zw"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003595; classtype:social-engineering; sid:6003595; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (captshop.singharaya-syndicate.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"captshop.singharaya-syndicate.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003596; classtype:social-engineering; sid:6003596; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticru.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticru.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003597; classtype:social-engineering; sid:6003597; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lob.st/15mtiwp6dwrq)"; flow:established,to_server; http.uri; content:"/15mtiwp6dwrq"; startswith; fast_pattern; http.host; content:"lob.st"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003598; classtype:social-engineering; sid:6003598; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shynegrains.com.ng/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shynegrains.com.ng"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003599; classtype:social-engineering; sid:6003599; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (belloutverify.webflow.io/?Email=gvggyjgyj&Pass=uhuh)"; flow:established,to_server; http.uri; content:"/?Email=gvggyjgyj&Pass=uhuh"; startswith; fast_pattern; http.host; content:"belloutverify.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003600; classtype:social-engineering; sid:6003600; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (strosin.fujiwar.site/redirect.html/?x=b2Q9MXN5aTZhMGI3MjE3NDZjNTd0MHRfb3V0dmxfUHJlbWl1bQ%3D%3D&\;v=NmtxeHA2&\;q=QzAwMDByZng4eXkydnluMDBnX3g0MTU5Nw%3D%3D&\;o=Zng4eXk%3D&\;u=Zng4eXk%3D&\;k=Zng4eXk%3D&\;m=X3g0&\;c=&\;l=&\;a=X3g0&\;r=X3g0&\;t=&\;y=X3g0&\;s=&\;b=X3g0M2w0dmgtMGx1M2htMg==4j3dDX)"; flow:established,to_server; http.uri; content:"/redirect.html/?x=b2Q9MXN5aTZhMGI3MjE3NDZjNTd0MHRfb3V0dmxfUHJlbWl1bQ%3D%3D&|3b|v=NmtxeHA2&|3b|q=QzAwMDByZng4eXkydnluMDBnX3g0MTU5Nw%3D%3D&|3b|o=Zng4eXk%3D&|3b|u=Zng4eXk%3D&|3b|k=Zng4eXk%3D&|3b|m=X3g0&|3b|c=&|3b|l=&|3b|a=X3g0&|3b|r=X3g0&|3b|t=&|3b|y=X3g0&|3b|s=&|3b|b=X3g0M2w0dmgtMGx1M2htMg==4j3dDX"; startswith; fast_pattern; http.host; content:"strosin.fujiwar.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003601; classtype:social-engineering; sid:6003601; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coinbase-cloned.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coinbase-cloned.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003602; classtype:social-engineering; sid:6003602; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netfilx-account.dynv6.net/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"netfilx-account.dynv6.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003603; classtype:social-engineering; sid:6003603; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mapodi.it/der/error.html)"; flow:established,to_server; http.uri; content:"/der/error.html"; startswith; fast_pattern; http.host; content:"www.mapodi.it"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003604; classtype:social-engineering; sid:6003604; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (true-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"true-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003605; classtype:social-engineering; sid:6003605; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sslserver1.sviluppo.host/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sslserver1.sviluppo.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003606; classtype:social-engineering; sid:6003606; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ohuyxt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ohuyxt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003607; classtype:social-engineering; sid:6003607; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.secure-base.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.secure-base.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003608; classtype:social-engineering; sid:6003608; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robloxc.com.es/users/477504383/profile)"; flow:established,to_server; http.uri; content:"/users/477504383/profile"; startswith; fast_pattern; http.host; content:"robloxc.com.es"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003609; classtype:social-engineering; sid:6003609; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (scotiaonlinebank-chi.vercel.app/signinfolder/login.html)"; flow:established,to_server; http.uri; content:"/signinfolder/login.html"; startswith; fast_pattern; http.host; content:"scotiaonlinebank-chi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003610; classtype:social-engineering; sid:6003610; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (learningsanjith-cpu.github.io/srisha-birthday)"; flow:established,to_server; http.uri; content:"/srisha-birthday"; startswith; fast_pattern; http.host; content:"learningsanjith-cpu.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003611; classtype:social-engineering; sid:6003611; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member297.business-support-partner.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member297.business-support-partner.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003612; classtype:social-engineering; sid:6003612; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (linko.page/tf8d92yjdge4)"; flow:established,to_server; http.uri; content:"/tf8d92yjdge4"; startswith; fast_pattern; http.host; content:"linko.page"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003613; classtype:social-engineering; sid:6003613; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lob.st/vaeotqdjnk69)"; flow:established,to_server; http.uri; content:"/vaeotqdjnk69"; startswith; fast_pattern; http.host; content:"lob.st"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003614; classtype:social-engineering; sid:6003614; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (invencoesdatiaaline.verifytoken.com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"invencoesdatiaaline.verifytoken.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003615; classtype:social-engineering; sid:6003615; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bzeisq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bzeisq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003616; classtype:social-engineering; sid:6003616; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wkphxz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wkphxz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003617; classtype:social-engineering; sid:6003617; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ykone-tiktok.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ykone-tiktok.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003618; classtype:social-engineering; sid:6003618; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylatersll.gyct.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylatersll.gyct.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003619; classtype:social-engineering; sid:6003619; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robloxc.com.es/users/570224686/profile)"; flow:established,to_server; http.uri; content:"/users/570224686/profile"; startswith; fast_pattern; http.host; content:"robloxc.com.es"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003620; classtype:social-engineering; sid:6003620; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (desavias.today/pr/)"; flow:established,to_server; http.uri; content:"/pr/"; startswith; fast_pattern; http.host; content:"desavias.today"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003621; classtype:social-engineering; sid:6003621; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kucooindogn.gitbook.io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"kucooindogn.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003622; classtype:social-engineering; sid:6003622; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dqnwdiqnwdiqnwdninsad.shop/id/login)"; flow:established,to_server; http.uri; content:"/id/login"; startswith; fast_pattern; http.host; content:"dqnwdiqnwdiqnwdninsad.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003623; classtype:social-engineering; sid:6003623; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (activacion-final.iceiy.com/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"activacion-final.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003624; classtype:social-engineering; sid:6003624; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortskoop.com/id/login)"; flow:established,to_server; http.uri; content:"/id/login"; startswith; fast_pattern; http.host; content:"fortskoop.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003625; classtype:social-engineering; sid:6003625; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.f27g.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.f27g.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003626; classtype:social-engineering; sid:6003626; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflixinyourneighborhoodnm.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"netflixinyourneighborhoodnm.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003627; classtype:social-engineering; sid:6003627; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.zqplrvbnk.club/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.zqplrvbnk.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003628; classtype:social-engineering; sid:6003628; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (greatcbec.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"greatcbec.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003629; classtype:social-engineering; sid:6003629; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.free-netflix-plan.one/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.free-netflix-plan.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003630; classtype:social-engineering; sid:6003630; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cn.kkmxxw.com/home/register?code=20860)"; flow:established,to_server; http.uri; content:"/home/register?code=20860"; startswith; fast_pattern; http.host; content:"cn.kkmxxw.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003631; classtype:social-engineering; sid:6003631; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (security-information.daftare.com/?signin2)"; flow:established,to_server; http.uri; content:"/?signin2"; startswith; fast_pattern; http.host; content:"security-information.daftare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003632; classtype:social-engineering; sid:6003632; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j61w.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j61w.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003633; classtype:social-engineering; sid:6003633; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflixcasino784.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflixcasino784.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003634; classtype:social-engineering; sid:6003634; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (olka-tv.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"olka-tv.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003635; classtype:social-engineering; sid:6003635; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aizhara.apsny.land/assfv43/)"; flow:established,to_server; http.uri; content:"/assfv43/"; startswith; fast_pattern; http.host; content:"aizhara.apsny.land"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003636; classtype:social-engineering; sid:6003636; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clone-netflix-debs.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"clone-netflix-debs.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003637; classtype:social-engineering; sid:6003637; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.azuriu.com/crosslake/)"; flow:established,to_server; http.uri; content:"/crosslake/"; startswith; fast_pattern; http.host; content:"www.azuriu.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003638; classtype:social-engineering; sid:6003638; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pnd3ndhb5hsvdka7nxbzh8qns6grdxfdf9hdbh1gdbh5rx-ehavasewg2fahbe4.z03.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pnd3ndhb5hsvdka7nxbzh8qns6grdxfdf9hdbh1gdbh5rx-ehavasewg2fahbe4.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003639; classtype:social-engineering; sid:6003639; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.able-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.able-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003640; classtype:social-engineering; sid:6003640; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aziizmusyafa18.github.io/wedding-netflix/)"; flow:established,to_server; http.uri; content:"/wedding-netflix/"; startswith; fast_pattern; http.host; content:"aziizmusyafa18.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003641; classtype:social-engineering; sid:6003641; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ehay.uk.login-secures-rs8rzsws.jamssbkn.in/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ehay.uk.login-secures-rs8rzsws.jamssbkn.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003642; classtype:social-engineering; sid:6003642; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sahni.com.au/metalworkservice/index.php)"; flow:established,to_server; http.uri; content:"/metalworkservice/index.php"; startswith; fast_pattern; http.host; content:"sahni.com.au"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003643; classtype:social-engineering; sid:6003643; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (isaquesigma.github.io/instagram/)"; flow:established,to_server; http.uri; content:"/instagram/"; startswith; fast_pattern; http.host; content:"isaquesigma.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003644; classtype:social-engineering; sid:6003644; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.0396133.cfd/oferta/przyczepka-samochodowa-750-kg-lekka-jak-nowa/51658)"; flow:established,to_server; http.uri; content:"/oferta/przyczepka-samochodowa-750-kg-lekka-jak-nowa/51658"; startswith; fast_pattern; http.host; content:"allegrolokalnie.0396133.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003645; classtype:social-engineering; sid:6003645; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (phylo-8.github.io/Amazon-github.io)"; flow:established,to_server; http.uri; content:"/Amazon-github.io"; startswith; fast_pattern; http.host; content:"phylo-8.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003646; classtype:social-engineering; sid:6003646; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whetsapp-sfdw.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whetsapp-sfdw.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003647; classtype:social-engineering; sid:6003647; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (scotiaonlinebank-chi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"scotiaonlinebank-chi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003648; classtype:social-engineering; sid:6003648; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zimbras.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zimbras.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003649; classtype:social-engineering; sid:6003649; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (crest-bet365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"crest-bet365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003650; classtype:social-engineering; sid:6003650; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (code-obi.github.io/FaceLoginPage-NoResponsive/)"; flow:established,to_server; http.uri; content:"/FaceLoginPage-NoResponsive/"; startswith; fast_pattern; http.host; content:"code-obi.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003651; classtype:social-engineering; sid:6003651; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tixmcw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tixmcw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003652; classtype:social-engineering; sid:6003652; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coastal-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coastal-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003653; classtype:social-engineering; sid:6003653; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (viso26.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"viso26.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003654; classtype:social-engineering; sid:6003654; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a.hsusen.de/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a.hsusen.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003655; classtype:social-engineering; sid:6003655; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortexployer.com/id/login)"; flow:established,to_server; http.uri; content:"/id/login"; startswith; fast_pattern; http.host; content:"fortexployer.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003656; classtype:social-engineering; sid:6003656; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (daltonint.com/_wildcard_.verif.daltonint.com/)"; flow:established,to_server; http.uri; content:"/_wildcard_.verif.daltonint.com/"; startswith; fast_pattern; http.host; content:"daltonint.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003657; classtype:social-engineering; sid:6003657; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tkapp.usanavsite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tkapp.usanavsite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003658; classtype:social-engineering; sid:6003658; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shreebiharijiexport.com/magicmomentss)"; flow:established,to_server; http.uri; content:"/magicmomentss"; startswith; fast_pattern; http.host; content:"shreebiharijiexport.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003659; classtype:social-engineering; sid:6003659; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.b27m.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.b27m.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003660; classtype:social-engineering; sid:6003660; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atgamipost.web.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"atgamipost.web.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003661; classtype:social-engineering; sid:6003661; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fancy-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fancy-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003662; classtype:social-engineering; sid:6003662; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sophia-venus.com/wor1/NEWPDFPAGE.html)"; flow:established,to_server; http.uri; content:"/wor1/NEWPDFPAGE.html"; startswith; fast_pattern; http.host; content:"www.sophia-venus.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003663; classtype:social-engineering; sid:6003663; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comfy-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comfy-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003664; classtype:social-engineering; sid:6003664; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kucooindogn.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kucooindogn.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003665; classtype:social-engineering; sid:6003665; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflixbet.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflixbet.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003666; classtype:social-engineering; sid:6003666; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ready-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ready-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003667; classtype:social-engineering; sid:6003667; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (corpperu.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"corpperu.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003668; classtype:social-engineering; sid:6003668; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.come-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.come-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003669; classtype:social-engineering; sid:6003669; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mahwi.com/wp-admin/az/reb/out.php)"; flow:established,to_server; http.uri; content:"/wp-admin/az/reb/out.php"; startswith; fast_pattern; http.host; content:"mahwi.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003670; classtype:social-engineering; sid:6003670; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vip.doc-bet365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vip.doc-bet365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003671; classtype:social-engineering; sid:6003671; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tkapp.jbrautos.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tkapp.jbrautos.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003672; classtype:social-engineering; sid:6003672; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abel-asmelash.github.io/Netflix-Clone-2025/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone-2025/"; startswith; fast_pattern; http.host; content:"abel-asmelash.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003673; classtype:social-engineering; sid:6003673; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pratik-ghrcemp.github.io/amazon-clone-project.)"; flow:established,to_server; http.uri; content:"/amazon-clone-project."; startswith; fast_pattern; http.host; content:"pratik-ghrcemp.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003674; classtype:social-engineering; sid:6003674; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (regal-concha-e4c379.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"regal-concha-e4c379.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003675; classtype:social-engineering; sid:6003675; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.euradoner.com/09900058978765GTVJ-edocumetsSigned.html)"; flow:established,to_server; http.uri; content:"/09900058978765GTVJ-edocumetsSigned.html"; startswith; fast_pattern; http.host; content:"www.euradoner.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003676; classtype:social-engineering; sid:6003676; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metaimask-wbjhllet.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metaimask-wbjhllet.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003677; classtype:social-engineering; sid:6003677; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortskem.top/id/login)"; flow:established,to_server; http.uri; content:"/id/login"; startswith; fast_pattern; http.host; content:"fortskem.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003678; classtype:social-engineering; sid:6003678; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dv.dtxso.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.dv.dtxso.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003679; classtype:social-engineering; sid:6003679; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cool-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cool-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003680; classtype:social-engineering; sid:6003680; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thenewebill.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"thenewebill.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003681; classtype:social-engineering; sid:6003681; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (danaaa-paaylaaateerr.acdgx.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"danaaa-paaylaaateerr.acdgx.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003682; classtype:social-engineering; sid:6003682; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tkapp.tunemusic.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tkapp.tunemusic.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003683; classtype:social-engineering; sid:6003683; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (landing-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"landing-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003684; classtype:social-engineering; sid:6003684; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreifoduewvnaxldwyjk6d76fejsbywkfjuvd3khjw7a5rl65xjypqqa.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreifoduewvnaxldwyjk6d76fejsbywkfjuvd3khjw7a5rl65xjypqqa.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003685; classtype:social-engineering; sid:6003685; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wesley-recognized-housing-belle.trycloudflare.com/?kelor2@79eefed604e143ece3a868620e09b6820f23.com)"; flow:established,to_server; http.uri; content:"/?kelor2@79eefed604e143ece3a868620e09b6820f23.com"; startswith; fast_pattern; http.host; content:"wesley-recognized-housing-belle.trycloudflare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003686; classtype:social-engineering; sid:6003686; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ec2-13-216-97-34.compute-1.amazonaws.com/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"ec2-13-216-97-34.compute-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003687; classtype:social-engineering; sid:6003687; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (411308-coinbase.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"411308-coinbase.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003688; classtype:social-engineering; sid:6003688; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rogersreplay.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rogersreplay.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003689; classtype:social-engineering; sid:6003689; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.pkrlqvbnz.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.pkrlqvbnz.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003690; classtype:social-engineering; sid:6003690; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (squid-app-67sb8.ondigitalocean.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"squid-app-67sb8.ondigitalocean.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003691; classtype:social-engineering; sid:6003691; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.central-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.central-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003692; classtype:social-engineering; sid:6003692; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aine.sjhub.info/?app_vl=ZoRwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=cororhub@d79d10db299393650b67f9f575160f2f258f.com&sui=%7Bsui%7D&fn=&ln=&p=1&z=PLNONACL-1905-Dig03)"; flow:established,to_server; http.uri; content:"/?app_vl=ZoRwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=cororhub@d79d10db299393650b67f9f575160f2f258f.com&sui=%7Bsui%7D&fn=&ln=&p=1&z=PLNONACL-1905-Dig03"; startswith; fast_pattern; http.host; content:"aine.sjhub.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003693; classtype:social-engineering; sid:6003693; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgere.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledgere.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003694; classtype:social-engineering; sid:6003694; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.basic-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.basic-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003695; classtype:social-engineering; sid:6003695; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (raj24k.github.io/amazon.com/)"; flow:established,to_server; http.uri; content:"/amazon.com/"; startswith; fast_pattern; http.host; content:"raj24k.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003696; classtype:social-engineering; sid:6003696; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rendabaixamaislimite.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"rendabaixamaislimite.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003697; classtype:social-engineering; sid:6003697; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jwadrt.top/pay?FDI=iDMt9?stj=RDI4r)"; flow:established,to_server; http.uri; content:"/pay?FDI=iDMt9?stj=RDI4r"; startswith; fast_pattern; http.host; content:"t-mobile.jwadrt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003698; classtype:social-engineering; sid:6003698; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (phytomrespomain.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"phytomrespomain.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003699; classtype:social-engineering; sid:6003699; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev/mycarimage.html)"; flow:established,to_server; http.uri; content:"/mycarimage.html"; startswith; fast_pattern; http.host; content:"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003700; classtype:social-engineering; sid:6003700; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (forthubs.com/id/login)"; flow:established,to_server; http.uri; content:"/id/login"; startswith; fast_pattern; http.host; content:"forthubs.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003701; classtype:social-engineering; sid:6003701; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amaaaannnnn.github.io/insta/)"; flow:established,to_server; http.uri; content:"/insta/"; startswith; fast_pattern; http.host; content:"amaaaannnnn.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003702; classtype:social-engineering; sid:6003702; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tkapp.flycatmall.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tkapp.flycatmall.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003703; classtype:social-engineering; sid:6003703; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (plumbersyonkers.com/main)"; flow:established,to_server; http.uri; content:"/main"; startswith; fast_pattern; http.host; content:"plumbersyonkers.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003704; classtype:social-engineering; sid:6003704; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpdlocooh.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpdlocooh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003705; classtype:social-engineering; sid:6003705; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (phytomrespomain.wasmer.app/shaw-ross)"; flow:established,to_server; http.uri; content:"/shaw-ross"; startswith; fast_pattern; http.host; content:"phytomrespomain.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003706; classtype:social-engineering; sid:6003706; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booking-com.prop031675.homes/property-in-Denia-ssid-R1XQTpdYOJzfqfF3M0bw900hvs2Ofx.booking)"; flow:established,to_server; http.uri; content:"/property-in-Denia-ssid-R1XQTpdYOJzfqfF3M0bw900hvs2Ofx.booking"; startswith; fast_pattern; http.host; content:"booking-com.prop031675.homes"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003707; classtype:social-engineering; sid:6003707; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my-mail-sign-in-users.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"my-mail-sign-in-users.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003708; classtype:social-engineering; sid:6003708; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sourcefuel.co.zw/postInf3gmbh-delivery/)"; flow:established,to_server; http.uri; content:"/postInf3gmbh-delivery/"; startswith; fast_pattern; http.host; content:"sourcefuel.co.zw"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003709; classtype:social-engineering; sid:6003709; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.648899.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.648899.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003710; classtype:social-engineering; sid:6003710; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (owa.sarbacame.com/owa/auth/)"; flow:established,to_server; http.uri; content:"/owa/auth/"; startswith; fast_pattern; http.host; content:"owa.sarbacame.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003711; classtype:social-engineering; sid:6003711; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cliff.spahotel.guru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cliff.spahotel.guru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003712; classtype:social-engineering; sid:6003712; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gamsgo.com/fr/)"; flow:established,to_server; http.uri; content:"/fr/"; startswith; fast_pattern; http.host; content:"www.gamsgo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003713; classtype:social-engineering; sid:6003713; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (make-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"make-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003714; classtype:social-engineering; sid:6003714; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ceram-part.com/vets)"; flow:established,to_server; http.uri; content:"/vets"; startswith; fast_pattern; http.host; content:"ceram-part.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003715; classtype:social-engineering; sid:6003715; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagramcom-instagramcom.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagramcom-instagramcom.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003716; classtype:social-engineering; sid:6003716; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (huzur.de/profinishplumbing)"; flow:established,to_server; http.uri; content:"/profinishplumbing"; startswith; fast_pattern; http.host; content:"huzur.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003717; classtype:social-engineering; sid:6003717; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortyview.life/id/login)"; flow:established,to_server; http.uri; content:"/id/login"; startswith; fast_pattern; http.host; content:"fortyview.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003718; classtype:social-engineering; sid:6003718; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagramcom-instagramcom.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagramcom-instagramcom.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003719; classtype:social-engineering; sid:6003719; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icuwtzw.cloudaccess.host/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"icuwtzw.cloudaccess.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003720; classtype:social-engineering; sid:6003720; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.j62e.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.j62e.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003721; classtype:social-engineering; sid:6003721; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kucoim-login.gitbook.io/kucoin)"; flow:established,to_server; http.uri; content:"/kucoin"; startswith; fast_pattern; http.host; content:"kucoim-login.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003722; classtype:social-engineering; sid:6003722; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cips.verifytoken.com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"cips.verifytoken.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003723; classtype:social-engineering; sid:6003723; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (scotiaonlinebank-chi.vercel.app/global/en/global-site.html)"; flow:established,to_server; http.uri; content:"/global/en/global-site.html"; startswith; fast_pattern; http.host; content:"scotiaonlinebank-chi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003724; classtype:social-engineering; sid:6003724; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-help.busines-help-center.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"business-help.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003725; classtype:social-engineering; sid:6003725; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uniswap-chi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uniswap-chi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003726; classtype:social-engineering; sid:6003726; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.search-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.search-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003727; classtype:social-engineering; sid:6003727; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icuwtzw.cloudaccess.host/Datenswizerland-fox/19-05-2026.html)"; flow:established,to_server; http.uri; content:"/Datenswizerland-fox/19-05-2026.html"; startswith; fast_pattern; http.host; content:"icuwtzw.cloudaccess.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003728; classtype:social-engineering; sid:6003728; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.lokalna-ofeta343.sbs/oferta/Kukirin-G2-Master-Tuning-Hamulce-XOD-Carbon-Deck-Szeroka-Kierownica/390110158)"; flow:established,to_server; http.uri; content:"/oferta/Kukirin-G2-Master-Tuning-Hamulce-XOD-Carbon-Deck-Szeroka-Kierownica/390110158"; startswith; fast_pattern; http.host; content:"allegrolokalnie.lokalna-ofeta343.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003729; classtype:social-engineering; sid:6003729; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (matamsklogcn.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"matamsklogcn.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003730; classtype:social-engineering; sid:6003730; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sun-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sun-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003731; classtype:social-engineering; sid:6003731; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.easybk.app.avanteshipping.com/lg/n3/R0BK6UGC0C)"; flow:established,to_server; http.uri; content:"/lg/n3/R0BK6UGC0C"; startswith; fast_pattern; http.host; content:"www.easybk.app.avanteshipping.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003732; classtype:social-engineering; sid:6003732; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booking--dubai--com.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"booking--dubai--com.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003733; classtype:social-engineering; sid:6003733; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f003.backblazeb2.com/b2api/v1/b2_download_file_by_id?fileId=4_z7a04aa88cc33107c9fe20210_f1031843078dcf0f3_d20260516_m202449_c003_v0312024_t0024_u01778963089110)"; flow:established,to_server; http.uri; content:"/b2api/v1/b2_download_file_by_id?fileId=4_z7a04aa88cc33107c9fe20210_f1031843078dcf0f3_d20260516_m202449_c003_v0312024_t0024_u01778963089110"; startswith; fast_pattern; http.host; content:"f003.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003734; classtype:social-engineering; sid:6003734; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (buy.ssshopfb.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"buy.ssshopfb.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003735; classtype:social-engineering; sid:6003735; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chunky-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"chunky-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003736; classtype:social-engineering; sid:6003736; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (posh-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"posh-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003737; classtype:social-engineering; sid:6003737; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j62c.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j62c.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003738; classtype:social-engineering; sid:6003738; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (correo-contraloria-gob-ec.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"correo-contraloria-gob-ec.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003739; classtype:social-engineering; sid:6003739; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aml-dichiarazione-bybit.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aml-dichiarazione-bybit.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003740; classtype:social-engineering; sid:6003740; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-0.lovable.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-0.lovable.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003741; classtype:social-engineering; sid:6003741; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortnite-inv.pro/id/login)"; flow:established,to_server; http.uri; content:"/id/login"; startswith; fast_pattern; http.host; content:"fortnite-inv.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003742; classtype:social-engineering; sid:6003742; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anitaprasad10.github.io/amazone-clone/)"; flow:established,to_server; http.uri; content:"/amazone-clone/"; startswith; fast_pattern; http.host; content:"anitaprasad10.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003743; classtype:social-engineering; sid:6003743; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tax-en-lrs.ceylonicus.com/irs/)"; flow:established,to_server; http.uri; content:"/irs/"; startswith; fast_pattern; http.host; content:"tax-en-lrs.ceylonicus.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003744; classtype:social-engineering; sid:6003744; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member289.business-support-partner.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member289.business-support-partner.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003745; classtype:social-engineering; sid:6003745; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.schoenerblick-hotel.de/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.schoenerblick-hotel.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003746; classtype:social-engineering; sid:6003746; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpdlocal.co-uklx.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dpdlocal.co-uklx.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003747; classtype:social-engineering; sid:6003747; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapps.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapps.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003748; classtype:social-engineering; sid:6003748; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.santafeklansdonarehjytydf.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.santafeklansdonarehjytydf.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003749; classtype:social-engineering; sid:6003749; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cobig99.github.io/microsoft365-en-us-excel/)"; flow:established,to_server; http.uri; content:"/microsoft365-en-us-excel/"; startswith; fast_pattern; http.host; content:"cobig99.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003750; classtype:social-engineering; sid:6003750; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yummy-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yummy-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003751; classtype:social-engineering; sid:6003751; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflixcasino783.com/?btag=124642831)"; flow:established,to_server; http.uri; content:"/?btag=124642831"; startswith; fast_pattern; http.host; content:"netflixcasino783.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003752; classtype:social-engineering; sid:6003752; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (testmeqwidmimqw.shop/id/login)"; flow:established,to_server; http.uri; content:"/id/login"; startswith; fast_pattern; http.host; content:"testmeqwidmimqw.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003753; classtype:social-engineering; sid:6003753; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fnshop.vu/id/login)"; flow:established,to_server; http.uri; content:"/id/login"; startswith; fast_pattern; http.host; content:"fnshop.vu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003754; classtype:social-engineering; sid:6003754; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fun-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fun-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003755; classtype:social-engineering; sid:6003755; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (banpromericabeneficios.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"banpromericabeneficios.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003756; classtype:social-engineering; sid:6003756; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (raj24k.github.io/amazon.com)"; flow:established,to_server; http.uri; content:"/amazon.com"; startswith; fast_pattern; http.host; content:"raj24k.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003757; classtype:social-engineering; sid:6003757; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b27y.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b27y.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003758; classtype:social-engineering; sid:6003758; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vishal07xi.github.io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"vishal07xi.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003759; classtype:social-engineering; sid:6003759; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.apex-bet365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.apex-bet365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003760; classtype:social-engineering; sid:6003760; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.head-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.head-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003761; classtype:social-engineering; sid:6003761; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whiteless.icu/id/login)"; flow:established,to_server; http.uri; content:"/id/login"; startswith; fast_pattern; http.host; content:"whiteless.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003762; classtype:social-engineering; sid:6003762; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.omjirt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.omjirt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003763; classtype:social-engineering; sid:6003763; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gffy.liui.sosoyumi360.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gffy.liui.sosoyumi360.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003764; classtype:social-engineering; sid:6003764; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mzcexi.top/pay?vZQ=nPlPe?JlT=aoPhD%5Cr)"; flow:established,to_server; http.uri; content:"/pay?vZQ=nPlPe?JlT=aoPhD%5Cr"; startswith; fast_pattern; http.host; content:"t-mobile.mzcexi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003765; classtype:social-engineering; sid:6003765; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tiktokshopsell.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tiktokshopsell.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003766; classtype:social-engineering; sid:6003766; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpdlocal.co-ukci.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dpdlocal.co-ukci.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003767; classtype:social-engineering; sid:6003767; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.meek-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.meek-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003768; classtype:social-engineering; sid:6003768; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortnitehub.us/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortnitehub.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003769; classtype:social-engineering; sid:6003769; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docs.itpatches.com/3/db6c98/9c312354-c09a-4402-a2ad-7590207f6705)"; flow:established,to_server; http.uri; content:"/3/db6c98/9c312354-c09a-4402-a2ad-7590207f6705"; startswith; fast_pattern; http.host; content:"docs.itpatches.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003770; classtype:social-engineering; sid:6003770; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (x17a.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"x17a.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003771; classtype:social-engineering; sid:6003771; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d8i3e0p2i7s3t.github.io/DFQF425SDF)"; flow:established,to_server; http.uri; content:"/DFQF425SDF"; startswith; fast_pattern; http.host; content:"d8i3e0p2i7s3t.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003772; classtype:social-engineering; sid:6003772; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www-revisar-necesario-ahora.clinicadeojossanandres.com/portales/uy/auth/cancel.php)"; flow:established,to_server; http.uri; content:"/portales/uy/auth/cancel.php"; startswith; fast_pattern; http.host; content:"www-revisar-necesario-ahora.clinicadeojossanandres.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003773; classtype:social-engineering; sid:6003773; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8-tv.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8-tv.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003774; classtype:social-engineering; sid:6003774; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (novaoportunidadelimite.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"novaoportunidadelimite.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003775; classtype:social-engineering; sid:6003775; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-502b05dd72194beeb3dbb59e5ca29d96.r2.dev/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-502b05dd72194beeb3dbb59e5ca29d96.r2.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003776; classtype:social-engineering; sid:6003776; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ca-app-68.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ca-app-68.info"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003777; classtype:social-engineering; sid:6003777; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lnpoowpol-qgc6-dem.hi7ekf.casa/i/h22uc/1779121090313#selectedbank6)"; flow:established,to_server; http.uri; content:"/i/h22uc/1779121090313#selectedbank6"; startswith; fast_pattern; http.host; content:"lnpoowpol-qgc6-dem.hi7ekf.casa"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003778; classtype:social-engineering; sid:6003778; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alexandre.ca-app-68.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"alexandre.ca-app-68.info"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003779; classtype:social-engineering; sid:6003779; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bio.site/desbloqueousuario_bhd)"; flow:established,to_server; http.uri; content:"/desbloqueousuario_bhd"; startswith; fast_pattern; http.host; content:"bio.site"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003780; classtype:social-engineering; sid:6003780; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alexandre.ca-app-49.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"alexandre.ca-app-49.info"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003781; classtype:social-engineering; sid:6003781; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (get-startedbridge.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"get-startedbridge.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003782; classtype:social-engineering; sid:6003782; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alexandre.ca-app-92.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"alexandre.ca-app-92.info"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003783; classtype:social-engineering; sid:6003783; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ca-app-92.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ca-app-92.info"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003784; classtype:social-engineering; sid:6003784; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokainie.8549431021-g4.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokainie.8549431021-g4.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003785; classtype:social-engineering; sid:6003785; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie.923812-y04359.cyou/lokalnie/?id=3t3m4t9e0l6d8y8q5z8l1j7o0j7o5f3j)"; flow:established,to_server; http.uri; content:"/lokalnie/?id=3t3m4t9e0l6d8y8q5z8l1j7o0j7o5f3j"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.923812-y04359.cyou"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003786; classtype:social-engineering; sid:6003786; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gov-declarar.com/cgi-sys/suspendedpage.cgi)"; flow:established,to_server; http.uri; content:"/cgi-sys/suspendedpage.cgi"; startswith; fast_pattern; http.host; content:"gov-declarar.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003787; classtype:social-engineering; sid:6003787; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ca-app-49.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ca-app-49.info"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003788; classtype:social-engineering; sid:6003788; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.smart-0439238329012.bond/lokalnie/?id=5a2j3w0t0x4r7u6d9k7s7q2n5w9d1v5c)"; flow:established,to_server; http.uri; content:"/lokalnie/?id=5a2j3w0t0x4r7u6d9k7s7q2n5w9d1v5c"; startswith; fast_pattern; http.host; content:"allegro.smart-0439238329012.bond"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003789; classtype:social-engineering; sid:6003789; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (impots.gouv.fr.x-update.org/fr/loading.php?id=2)"; flow:established,to_server; http.uri; content:"/fr/loading.php?id=2"; startswith; fast_pattern; http.host; content:"impots.gouv.fr.x-update.org"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003790; classtype:social-engineering; sid:6003790; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (o111xppolbox3e7p7.mg1kqm.casa/o/nlhea/1779205313578#selectedbank2&LOADS)"; flow:established,to_server; http.uri; content:"/o/nlhea/1779205313578#selectedbank2&LOADS"; startswith; fast_pattern; http.host; content:"o111xppolbox3e7p7.mg1kqm.casa"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003791; classtype:social-engineering; sid:6003791; rev:1; metadata: signature_severity Major, created_et 2026_05_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (io-en-leadzoirelive.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"io-en-leadzoirelive.wasmer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003792; classtype:social-engineering; sid:6003792; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bncnbcbnnbc89893.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bncnbcbnnbc89893.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003793; classtype:social-engineering; sid:6003793; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tryjhytyjctfhdrxtse46ysxfgjxfyjfyjxdthtrterrthfhhhfff.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tryjhytyjctfhdrxtse46ysxfgjxfyjfyjxdthtrterrthfhhhfff.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003794; classtype:social-engineering; sid:6003794; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-41dcc2b0c242484a90a139557123d677.r2.dev/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-41dcc2b0c242484a90a139557123d677.r2.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003795; classtype:social-engineering; sid:6003795; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.pl-ogloszenie9783245612.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.pl-ogloszenie9783245612.click"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003796; classtype:social-engineering; sid:6003796; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alexandre.ca-app-50.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"alexandre.ca-app-50.info"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003797; classtype:social-engineering; sid:6003797; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (urlz.fr/uxrS)"; flow:established,to_server; http.uri; content:"/uxrS"; startswith; fast_pattern; http.host; content:"urlz.fr"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003798; classtype:social-engineering; sid:6003798; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.pl-ogloszenie9347235437.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.pl-ogloszenie9347235437.click"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003799; classtype:social-engineering; sid:6003799; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (workcontrolcenter.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"workcontrolcenter.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003800; classtype:social-engineering; sid:6003800; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.visualez.com/PDF/testambiences/mmmimge.html)"; flow:established,to_server; http.uri; content:"/PDF/testambiences/mmmimge.html"; startswith; fast_pattern; http.host; content:"www.visualez.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003801; classtype:social-engineering; sid:6003801; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (onlinesxxfiintydesk.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"onlinesxxfiintydesk.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003802; classtype:social-engineering; sid:6003802; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netempresas.atendimentoexclusivo.digital/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netempresas.atendimentoexclusivo.digital"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003803; classtype:social-engineering; sid:6003803; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (orange.portailclients.com/captcha.php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"orange.portailclients.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003804; classtype:social-engineering; sid:6003804; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.annuler-espace.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.annuler-espace.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003805; classtype:social-engineering; sid:6003805; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.925389h451.shop/lokalnie)"; flow:established,to_server; http.uri; content:"/lokalnie"; startswith; fast_pattern; http.host; content:"allegrolokalnie.925389h451.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003806; classtype:social-engineering; sid:6003806; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bradesco.clientenegocios.lol/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bradesco.clientenegocios.lol"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003807; classtype:social-engineering; sid:6003807; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (libera-blue-bidcap.vercel.app/inicio/index.html)"; flow:established,to_server; http.uri; content:"/inicio/index.html"; startswith; fast_pattern; http.host; content:"libera-blue-bidcap.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003808; classtype:social-engineering; sid:6003808; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cm-annulation-operation.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cm-annulation-operation.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003809; classtype:social-engineering; sid:6003809; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bradesco.empresaatuliza.digital/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bradesco.empresaatuliza.digital"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003810; classtype:social-engineering; sid:6003810; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verifique-agoraveja.vercel.app/inicio/index.html)"; flow:established,to_server; http.uri; content:"/inicio/index.html"; startswith; fast_pattern; http.host; content:"verifique-agoraveja.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003811; classtype:social-engineering; sid:6003811; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure.watermelonfarmersydney.com/r/ehFohqR)"; flow:established,to_server; http.uri; content:"/r/ehFohqR"; startswith; fast_pattern; http.host; content:"secure.watermelonfarmersydney.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003812; classtype:social-engineering; sid:6003812; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atualizanetempresapj.app/acesso-seguro.php?token=18199634536a0d5c328c5596.83184240)"; flow:established,to_server; http.uri; content:"/acesso-seguro.php?token=18199634536a0d5c328c5596.83184240"; startswith; fast_pattern; http.host; content:"atualizanetempresapj.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003813; classtype:social-engineering; sid:6003813; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acessando-agoraonline.vercel.app/inicio/index.html)"; flow:established,to_server; http.uri; content:"/inicio/index.html"; startswith; fast_pattern; http.host; content:"acessando-agoraonline.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003814; classtype:social-engineering; sid:6003814; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (monease.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"monease.cc"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003815; classtype:social-engineering; sid:6003815; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie.prywatn83812034.bond/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.prywatn83812034.bond"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003816; classtype:social-engineering; sid:6003816; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bradesco.gestaoweb.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bradesco.gestaoweb.info"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003817; classtype:social-engineering; sid:6003817; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (formulario-registro-gestion-2026-aklm.cr-web.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"formulario-registro-gestion-2026-aklm.cr-web.workers.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003818; classtype:social-engineering; sid:6003818; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalne.01289523rt.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalne.01289523rt.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003819; classtype:social-engineering; sid:6003819; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acterax.help/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"acterax.help"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003820; classtype:social-engineering; sid:6003820; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bradesco.gestaoweb.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bradesco.gestaoweb.click"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003821; classtype:social-engineering; sid:6003821; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kifofjfjeio488dzedeuihui48.cfolks.pl/at/vx/)"; flow:established,to_server; http.uri; content:"/at/vx/"; startswith; fast_pattern; http.host; content:"kifofjfjeio488dzedeuihui48.cfolks.pl"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003822; classtype:social-engineering; sid:6003822; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cita-digital-apklm-2026.cr-web.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cita-digital-apklm-2026.cr-web.workers.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003823; classtype:social-engineering; sid:6003823; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flashobmen.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"flashobmen.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003824; classtype:social-engineering; sid:6003824; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalne.925389h451.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalne.925389h451.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003825; classtype:social-engineering; sid:6003825; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netempresasatualizar.digital/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netempresasatualizar.digital"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003826; classtype:social-engineering; sid:6003826; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atualizacaocadastralbia.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"atualizacaocadastralbia.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003827; classtype:social-engineering; sid:6003827; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bnrzvq.ink/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.bnrzvq.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003828; classtype:social-engineering; sid:6003828; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store.workshopcommunityrevote.com/sharedfiles/filesdetails/storm_blade/)"; flow:established,to_server; http.uri; content:"/sharedfiles/filesdetails/storm_blade/"; startswith; fast_pattern; http.host; content:"store.workshopcommunityrevote.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003829; classtype:social-engineering; sid:6003829; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ads-support.busines-help-center.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ads-support.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003830; classtype:social-engineering; sid:6003830; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (committed.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"committed.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003831; classtype:social-engineering; sid:6003831; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.j62n.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.j62n.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003832; classtype:social-engineering; sid:6003832; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-cs.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-cs.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003833; classtype:social-engineering; sid:6003833; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (viewpackagetracking.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"viewpackagetracking.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003834; classtype:social-engineering; sid:6003834; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bpzfqr.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bpzfqr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003835; classtype:social-engineering; sid:6003835; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jukchl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jukchl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003836; classtype:social-engineering; sid:6003836; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hrcroiatian.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hrcroiatian.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003837; classtype:social-engineering; sid:6003837; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (asistance1.sells-for-less.com/appmanager/)"; flow:established,to_server; http.uri; content:"/appmanager/"; startswith; fast_pattern; http.host; content:"asistance1.sells-for-less.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003838; classtype:social-engineering; sid:6003838; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bquezm.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bquezm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003839; classtype:social-engineering; sid:6003839; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cc.wtes.as.whatsppeb.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cc.wtes.as.whatsppeb.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003840; classtype:social-engineering; sid:6003840; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vininxz789.github.io/instagram)"; flow:established,to_server; http.uri; content:"/instagram"; startswith; fast_pattern; http.host; content:"vininxz789.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003841; classtype:social-engineering; sid:6003841; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dieschweizerpost.com/pages/ban.php)"; flow:established,to_server; http.uri; content:"/pages/ban.php"; startswith; fast_pattern; http.host; content:"dieschweizerpost.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003842; classtype:social-engineering; sid:6003842; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jvqlrkbnp.cloud/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.jvqlrkbnp.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003843; classtype:social-engineering; sid:6003843; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-lilac-eight.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-lilac-eight.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003844; classtype:social-engineering; sid:6003844; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.joelfq.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.joelfq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003845; classtype:social-engineering; sid:6003845; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p211q.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p211q.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003846; classtype:social-engineering; sid:6003846; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.xupqevr.one/uqjmw/)"; flow:established,to_server; http.uri; content:"/uqjmw/"; startswith; fast_pattern; http.host; content:"usps.xupqevr.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003847; classtype:social-engineering; sid:6003847; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2-c3p.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2-c3p.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003848; classtype:social-engineering; sid:6003848; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fbshop.ffbbshop.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fbshop.ffbbshop.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003849; classtype:social-engineering; sid:6003849; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.davidlillis.com/Janine_files/verification.html)"; flow:established,to_server; http.uri; content:"/Janine_files/verification.html"; startswith; fast_pattern; http.host; content:"www.davidlillis.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003850; classtype:social-engineering; sid:6003850; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (joaobof8.github.io/instagram/)"; flow:established,to_server; http.uri; content:"/instagram/"; startswith; fast_pattern; http.host; content:"joaobof8.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003851; classtype:social-engineering; sid:6003851; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (govauinboxupdate-review.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"govauinboxupdate-review.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003852; classtype:social-engineering; sid:6003852; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clever-employees-423448.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"clever-employees-423448.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003853; classtype:social-engineering; sid:6003853; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazone-clone-teal.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazone-clone-teal.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003854; classtype:social-engineering; sid:6003854; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (invfort.guru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"invfort.guru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003855; classtype:social-engineering; sid:6003855; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kontakt.de-digittal.me/profil-46498/)"; flow:established,to_server; http.uri; content:"/profil-46498/"; startswith; fast_pattern; http.host; content:"kontakt.de-digittal.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003856; classtype:social-engineering; sid:6003856; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.delayed.help/cJV)"; flow:established,to_server; http.uri; content:"/cJV"; startswith; fast_pattern; http.host; content:"usps.delayed.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003857; classtype:social-engineering; sid:6003857; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.yh2861.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.yh2861.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003858; classtype:social-engineering; sid:6003858; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dieschweizerpost.com/pages/login.php)"; flow:established,to_server; http.uri; content:"/pages/login.php"; startswith; fast_pattern; http.host; content:"dieschweizerpost.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003859; classtype:social-engineering; sid:6003859; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.p25m.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.p25m.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003860; classtype:social-engineering; sid:6003860; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cf99999.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cf99999.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003861; classtype:social-engineering; sid:6003861; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (berryledger.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"berryledger.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003862; classtype:social-engineering; sid:6003862; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bvxqmtp.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.bvxqmtp.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003863; classtype:social-engineering; sid:6003863; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (noticealerttermonation.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"noticealerttermonation.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003864; classtype:social-engineering; sid:6003864; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (committed.wasmer.app/longevityanalysis)"; flow:established,to_server; http.uri; content:"/longevityanalysis"; startswith; fast_pattern; http.host; content:"committed.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003865; classtype:social-engineering; sid:6003865; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jiymvt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jiymvt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003866; classtype:social-engineering; sid:6003866; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.encryptn.quantumopenx.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.encryptn.quantumopenx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003867; classtype:social-engineering; sid:6003867; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bvnqzrp.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.bvnqzrp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003868; classtype:social-engineering; sid:6003868; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (securechain-dapps.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"securechain-dapps.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003869; classtype:social-engineering; sid:6003869; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.us-deaii.life/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"usps.us-deaii.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003870; classtype:social-engineering; sid:6003870; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (leopsmapsteamworkspace.myclickfunnels.com/fr/)"; flow:established,to_server; http.uri; content:"/fr/"; startswith; fast_pattern; http.host; content:"leopsmapsteamworkspace.myclickfunnels.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003871; classtype:social-engineering; sid:6003871; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.24431253615351.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.24431253615351.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003872; classtype:social-engineering; sid:6003872; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pymes-negocios.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pymes-negocios.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003873; classtype:social-engineering; sid:6003873; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (systemnoticeupgrade.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"systemnoticeupgrade.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003874; classtype:social-engineering; sid:6003874; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metasklgerns.gitbook.io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"metasklgerns.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003875; classtype:social-engineering; sid:6003875; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (credienlineaecuadovali.hstn.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"credienlineaecuadovali.hstn.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003876; classtype:social-engineering; sid:6003876; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (k365.ag/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"k365.ag"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003877; classtype:social-engineering; sid:6003877; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hawxdc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hawxdc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003878; classtype:social-engineering; sid:6003878; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gumtree-au.ss-pay.cfd/277046104/)"; flow:established,to_server; http.uri; content:"/277046104/"; startswith; fast_pattern; http.host; content:"gumtree-au.ss-pay.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003879; classtype:social-engineering; sid:6003879; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eex.co.jp/fb/2FA.html)"; flow:established,to_server; http.uri; content:"/fb/2FA.html"; startswith; fast_pattern; http.host; content:"eex.co.jp"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003880; classtype:social-engineering; sid:6003880; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ehay.uk.login-secures-rs8rzsws.jamssbkn.in/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ehay.uk.login-secures-rs8rzsws.jamssbkn.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003881; classtype:social-engineering; sid:6003881; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (beihai-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"beihai-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003882; classtype:social-engineering; sid:6003882; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qevnux.casa/wp-content/plugins/iuo/RackSpace/index.php)"; flow:established,to_server; http.uri; content:"/wp-content/plugins/iuo/RackSpace/index.php"; startswith; fast_pattern; http.host; content:"qevnux.casa"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003883; classtype:social-engineering; sid:6003883; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.uvxriy.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.uvxriy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003884; classtype:social-engineering; sid:6003884; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (encryptn.quantumopenx.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"encryptn.quantumopenx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003885; classtype:social-engineering; sid:6003885; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16546.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16546.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003886; classtype:social-engineering; sid:6003886; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xpwanz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xpwanz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003887; classtype:social-engineering; sid:6003887; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-ballspeedtiyu.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app-ballspeedtiyu.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003888; classtype:social-engineering; sid:6003888; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-plum-gamma.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-plum-gamma.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003889; classtype:social-engineering; sid:6003889; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (backup-exoduscentre.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"backup-exoduscentre.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003890; classtype:social-engineering; sid:6003890; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cloudappleid.sviluppo.host/7823120-ACES/)"; flow:established,to_server; http.uri; content:"/7823120-ACES/"; startswith; fast_pattern; http.host; content:"cloudappleid.sviluppo.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003891; classtype:social-engineering; sid:6003891; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.seuxrv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.seuxrv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003892; classtype:social-engineering; sid:6003892; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (h34k.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"h34k.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003893; classtype:social-engineering; sid:6003893; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tckxew.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tckxew.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003894; classtype:social-engineering; sid:6003894; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vyqpdo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vyqpdo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003895; classtype:social-engineering; sid:6003895; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (helpwithlifestuff.info/?app_vl=ZoFwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=lanynz@babb04988becc7e6cfed5e29bb634802a0bb.net&sui=%7Bsui%7D&fn=&ln=&p=&z=PLNONARAW-1805-ind48Relay)"; flow:established,to_server; http.uri; content:"/?app_vl=ZoFwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=lanynz@babb04988becc7e6cfed5e29bb634802a0bb.net&sui=%7Bsui%7D&fn=&ln=&p=&z=PLNONARAW-1805-ind48Relay"; startswith; fast_pattern; http.host; content:"helpwithlifestuff.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003896; classtype:social-engineering; sid:6003896; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.uniswap-chi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.uniswap-chi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003897; classtype:social-engineering; sid:6003897; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bvnwzrq.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.bvnwzrq.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003898; classtype:social-engineering; sid:6003898; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox-tools.lol/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"roblox-tools.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003899; classtype:social-engineering; sid:6003899; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (direct-auth.org/2e750135-1145-4969-b0e3-6f3a58e8866c/bWFkZWxlaW5lLm5pbHNlbkBlcnN0YWRpYWtvbmkuc2U=)"; flow:established,to_server; http.uri; content:"/2e750135-1145-4969-b0e3-6f3a58e8866c/bWFkZWxlaW5lLm5pbHNlbkBlcnN0YWRpYWtvbmkuc2U="; startswith; fast_pattern; http.host; content:"direct-auth.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003900; classtype:social-engineering; sid:6003900; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.2026galabetguvenilir.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.2026galabetguvenilir.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003901; classtype:social-engineering; sid:6003901; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.solicitaaquienlineaecua.hstn.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.solicitaaquienlineaecua.hstn.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003902; classtype:social-engineering; sid:6003902; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bradesco.portal-seguro.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bradesco.portal-seguro.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003903; classtype:social-engineering; sid:6003903; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (16498.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"16498.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003904; classtype:social-engineering; sid:6003904; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-network.busines-help-center.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"business-network.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003905; classtype:social-engineering; sid:6003905; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adrenalin.win/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"adrenalin.win"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003906; classtype:social-engineering; sid:6003906; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xfytvn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xfytvn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003907; classtype:social-engineering; sid:6003907; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.us-klieu.life/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"usps.us-klieu.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003908; classtype:social-engineering; sid:6003908; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.yhnjzg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.yhnjzg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003909; classtype:social-engineering; sid:6003909; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xqtrvm.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.xqtrvm.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003910; classtype:social-engineering; sid:6003910; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tkworld-store.co/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tkworld-store.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003911; classtype:social-engineering; sid:6003911; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zukyec.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zukyec.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003912; classtype:social-engineering; sid:6003912; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member290.business-support-partner.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member290.business-support-partner.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003913; classtype:social-engineering; sid:6003913; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a-atendentebrasilon.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a-atendentebrasilon.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003914; classtype:social-engineering; sid:6003914; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.uktiqd.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.uktiqd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003915; classtype:social-engineering; sid:6003915; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zyex-d.anym.biz.id/x/int.html)"; flow:established,to_server; http.uri; content:"/x/int.html"; startswith; fast_pattern; http.host; content:"zyex-d.anym.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003916; classtype:social-engineering; sid:6003916; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eex.co.jp/fb/)"; flow:established,to_server; http.uri; content:"/fb/"; startswith; fast_pattern; http.host; content:"eex.co.jp"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003917; classtype:social-engineering; sid:6003917; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.cxmvqtr.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.cxmvqtr.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003918; classtype:social-engineering; sid:6003918; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.65249.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.65249.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003919; classtype:social-engineering; sid:6003919; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (replicasitiocoinbasebootstrap.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"replicasitiocoinbasebootstrap.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003920; classtype:social-engineering; sid:6003920; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.boaonline.help/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.boaonline.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003921; classtype:social-engineering; sid:6003921; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.teams-mi.com/p/fjbd-cbcr/yxbzwlse/)"; flow:established,to_server; http.uri; content:"/p/fjbd-cbcr/yxbzwlse/"; startswith; fast_pattern; http.host; content:"s.teams-mi.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003922; classtype:social-engineering; sid:6003922; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (int-ccbleasing.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"int-ccbleasing.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003923; classtype:social-engineering; sid:6003923; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cx0mx6eh.authlnk.com/login/zvsKEFnooMnGYylLlJOBrxes1rPF2ooclObx)"; flow:established,to_server; http.uri; content:"/login/zvsKEFnooMnGYylLlJOBrxes1rPF2ooclObx"; startswith; fast_pattern; http.host; content:"cx0mx6eh.authlnk.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003924; classtype:social-engineering; sid:6003924; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (16501.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"16501.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003925; classtype:social-engineering; sid:6003925; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bet73096.com/fish/202)"; flow:established,to_server; http.uri; content:"/fish/202"; startswith; fast_pattern; http.host; content:"bet73096.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003926; classtype:social-engineering; sid:6003926; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-olive-iota.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-olive-iota.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003927; classtype:social-engineering; sid:6003927; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kznwqpl.ink/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.kznwqpl.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003928; classtype:social-engineering; sid:6003928; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (999xxcp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"999xxcp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003929; classtype:social-engineering; sid:6003929; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (topupdisini.officiall-rewards.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"topupdisini.officiall-rewards.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003930; classtype:social-engineering; sid:6003930; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.htlxwa.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.htlxwa.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003931; classtype:social-engineering; sid:6003931; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (securreways.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"securreways.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003932; classtype:social-engineering; sid:6003932; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.xupqff.one/uqjmw)"; flow:established,to_server; http.uri; content:"/uqjmw"; startswith; fast_pattern; http.host; content:"usps.xupqff.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003933; classtype:social-engineering; sid:6003933; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prime-memebrship.su/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"prime-memebrship.su"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003934; classtype:social-engineering; sid:6003934; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lgrdzk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lgrdzk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003935; classtype:social-engineering; sid:6003935; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (r.robloxr.cv/users/14085142931/profile)"; flow:established,to_server; http.uri; content:"/users/14085142931/profile"; startswith; fast_pattern; http.host; content:"r.robloxr.cv"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003936; classtype:social-engineering; sid:6003936; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qevnux.casa/wp-content/plugins/iuo/RackSpace/rackspace.html?cmd=login&id=88378de869daddf8fda616596699b3c888378de869daddf8fda616596699b3c8&session=88378de869daddf8fda616596699b3c888378de869daddf8fda616596699b3c8)"; flow:established,to_server; http.uri; content:"/wp-content/plugins/iuo/RackSpace/rackspace.html?cmd=login&id=88378de869daddf8fda616596699b3c888378de869daddf8fda616596699b3c8&session=88378de869daddf8fda616596699b3c888378de869daddf8fda616596699b3c8"; startswith; fast_pattern; http.host; content:"qevnux.casa"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003937; classtype:social-engineering; sid:6003937; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (solicitaaquienlineaecua.hstn.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"solicitaaquienlineaecua.hstn.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003938; classtype:social-engineering; sid:6003938; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (groupmailserver.co.uk/?r=69d68603-7d12-4252-b55a-372ce2321bb7)"; flow:established,to_server; http.uri; content:"/?r=69d68603-7d12-4252-b55a-372ce2321bb7"; startswith; fast_pattern; http.host; content:"groupmailserver.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003939; classtype:social-engineering; sid:6003939; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-8868sports.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app-8868sports.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003940; classtype:social-engineering; sid:6003940; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yearling-coral-ahgz1ctyuy.edgeone.app/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"yearling-coral-ahgz1ctyuy.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003941; classtype:social-engineering; sid:6003941; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-c7vip.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app-c7vip.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003942; classtype:social-engineering; sid:6003942; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.frboym.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.frboym.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003943; classtype:social-engineering; sid:6003943; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.coinbase-cloned.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.coinbase-cloned.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003944; classtype:social-engineering; sid:6003944; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.propertysss.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.propertysss.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003945; classtype:social-engineering; sid:6003945; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.ejxhzs.click/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.ejxhzs.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003946; classtype:social-engineering; sid:6003946; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.meuservidorcorporativo.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.meuservidorcorporativo.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003947; classtype:social-engineering; sid:6003947; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ngbrjk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ngbrjk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003948; classtype:social-engineering; sid:6003948; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dharani2006lakshmi-sys.github.io/insta)"; flow:established,to_server; http.uri; content:"/insta"; startswith; fast_pattern; http.host; content:"dharani2006lakshmi-sys.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003949; classtype:social-engineering; sid:6003949; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16529.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16529.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003950; classtype:social-engineering; sid:6003950; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pull-sona.b-cdn.net/@docx.html)"; flow:established,to_server; http.uri; content:"/@docx.html"; startswith; fast_pattern; http.host; content:"pull-sona.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003951; classtype:social-engineering; sid:6003951; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pnuzvo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pnuzvo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003952; classtype:social-engineering; sid:6003952; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whatsvsapq.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whatsvsapq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003953; classtype:social-engineering; sid:6003953; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.checkpage201.site/2147/)"; flow:established,to_server; http.uri; content:"/2147/"; startswith; fast_pattern; http.host; content:"www.checkpage201.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003954; classtype:social-engineering; sid:6003954; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metasklgerns.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metasklgerns.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003955; classtype:social-engineering; sid:6003955; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.fxtrmq.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.fxtrmq.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003956; classtype:social-engineering; sid:6003956; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fbshop.funbbuuy.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fbshop.funbbuuy.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003957; classtype:social-engineering; sid:6003957; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.app-funsports.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.app-funsports.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003958; classtype:social-engineering; sid:6003958; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.trackingvq.cam/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"usps.trackingvq.cam"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003959; classtype:social-engineering; sid:6003959; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.credienlineaecuadovali.hstn.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.credienlineaecuadovali.hstn.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003960; classtype:social-engineering; sid:6003960; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cshqo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cshqo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003961; classtype:social-engineering; sid:6003961; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nyjkbx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nyjkbx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003962; classtype:social-engineering; sid:6003962; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16541.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16541.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003963; classtype:social-engineering; sid:6003963; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (schalk078.github.io/QUOTATION-SM0012/SM5484638%20Quotation)"; flow:established,to_server; http.uri; content:"/QUOTATION-SM0012/SM5484638%20Quotation"; startswith; fast_pattern; http.host; content:"schalk078.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003964; classtype:social-engineering; sid:6003964; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (doc53usngwd0c85bdrvsharepoint.capitolelectrics.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"doc53usngwd0c85bdrvsharepoint.capitolelectrics.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003965; classtype:social-engineering; sid:6003965; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (awtairdrop.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"awtairdrop.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003966; classtype:social-engineering; sid:6003966; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moviruedas.com/folder/)"; flow:established,to_server; http.uri; content:"/folder/"; startswith; fast_pattern; http.host; content:"moviruedas.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003967; classtype:social-engineering; sid:6003967; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j.ws2549.wineclo.com/VIP/instagram/?ID=8539831950)"; flow:established,to_server; http.uri; content:"/VIP/instagram/?ID=8539831950"; startswith; fast_pattern; http.host; content:"j.ws2549.wineclo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003968; classtype:social-engineering; sid:6003968; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (victorlua-hash.github.io/instagram/)"; flow:established,to_server; http.uri; content:"/instagram/"; startswith; fast_pattern; http.host; content:"victorlua-hash.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003969; classtype:social-engineering; sid:6003969; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ixagdz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ixagdz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003970; classtype:social-engineering; sid:6003970; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.galabet-mobiladres.co/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.galabet-mobiladres.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003971; classtype:social-engineering; sid:6003971; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (og-pg.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"og-pg.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003972; classtype:social-engineering; sid:6003972; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-boyuesports.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app-boyuesports.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003973; classtype:social-engineering; sid:6003973; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nihyzo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nihyzo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003974; classtype:social-engineering; sid:6003974; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s3.us-east-2.amazonaws.com/bu.adpobe.reading.us/30bg/30bg/index.html)"; flow:established,to_server; http.uri; content:"/bu.adpobe.reading.us/30bg/30bg/index.html"; startswith; fast_pattern; http.host; content:"s3.us-east-2.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003975; classtype:social-engineering; sid:6003975; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nvekta.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nvekta.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003976; classtype:social-engineering; sid:6003976; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yhc31.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yhc31.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003977; classtype:social-engineering; sid:6003977; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apsdev.psce.pw/Danaaa-lndonesia/)"; flow:established,to_server; http.uri; content:"/Danaaa-lndonesia/"; startswith; fast_pattern; http.host; content:"apsdev.psce.pw"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003978; classtype:social-engineering; sid:6003978; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kplznw.ink/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.kplznw.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003979; classtype:social-engineering; sid:6003979; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pdf-statement-370813.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pdf-statement-370813.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003980; classtype:social-engineering; sid:6003980; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.opkqvs.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.opkqvs.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003981; classtype:social-engineering; sid:6003981; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (121z2.catex.at/trs/)"; flow:established,to_server; http.uri; content:"/trs/"; startswith; fast_pattern; http.host; content:"121z2.catex.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003982; classtype:social-engineering; sid:6003982; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16539.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16539.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003983; classtype:social-engineering; sid:6003983; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (radostkartin.com.tr/id=5185124)"; flow:established,to_server; http.uri; content:"/id=5185124"; startswith; fast_pattern; http.host; content:"radostkartin.com.tr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003984; classtype:social-engineering; sid:6003984; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ordinary-violet-aiqitdrvzm.edgeone.app/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"ordinary-violet-aiqitdrvzm.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003985; classtype:social-engineering; sid:6003985; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gsojmr.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gsojmr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003986; classtype:social-engineering; sid:6003986; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (x16z.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"x16z.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003987; classtype:social-engineering; sid:6003987; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (costumernewpaylterx.guaranted.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"costumernewpaylterx.guaranted.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003988; classtype:social-engineering; sid:6003988; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mobile-tim.brflow.com.br/capture/timultrafibra/login/67ih5sb366o84wg08o/)"; flow:established,to_server; http.uri; content:"/capture/timultrafibra/login/67ih5sb366o84wg08o/"; startswith; fast_pattern; http.host; content:"mobile-tim.brflow.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003989; classtype:social-engineering; sid:6003989; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqtmvxp.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.rqtmvxp.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003990; classtype:social-engineering; sid:6003990; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yin1-hpc7g7cqd4eyfxfc.z03.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yin1-hpc7g7cqd4eyfxfc.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003991; classtype:social-engineering; sid:6003991; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bet73096.com/about/contact)"; flow:established,to_server; http.uri; content:"/about/contact"; startswith; fast_pattern; http.host; content:"bet73096.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003992; classtype:social-engineering; sid:6003992; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (humanres.ie/?r=1eacf063-f7fc-42f6-abfc-a284b4b8deb9&rg=eu)"; flow:established,to_server; http.uri; content:"/?r=1eacf063-f7fc-42f6-abfc-a284b4b8deb9&rg=eu"; startswith; fast_pattern; http.host; content:"humanres.ie"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003993; classtype:social-engineering; sid:6003993; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bvnqwrp.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.bvnqwrp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003994; classtype:social-engineering; sid:6003994; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sun6618.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sun6618.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003995; classtype:social-engineering; sid:6003995; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (outlookdrivestoragehubfiles.mbiofuels.com/mu0uk172/CPswnRj1jgcv6YD9oQaxFHNQ.html)"; flow:established,to_server; http.uri; content:"/mu0uk172/CPswnRj1jgcv6YD9oQaxFHNQ.html"; startswith; fast_pattern; http.host; content:"outlookdrivestoragehubfiles.mbiofuels.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003996; classtype:social-engineering; sid:6003996; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (win-acrobat-instruction.web.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"win-acrobat-instruction.web.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003997; classtype:social-engineering; sid:6003997; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mrchdi.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mrchdi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003998; classtype:social-engineering; sid:6003998; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e7ledger-live-login-battery-support.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e7ledger-live-login-battery-support.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003999; classtype:social-engineering; sid:6003999; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shssc.edu.bd/santd/login.php)"; flow:established,to_server; http.uri; content:"/santd/login.php"; startswith; fast_pattern; http.host; content:"shssc.edu.bd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004000; classtype:social-engineering; sid:6004000; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xkgszf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xkgszf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004001; classtype:social-engineering; sid:6004001; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fvw0ah.binanceltd.ltd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fvw0ah.binanceltd.ltd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004002; classtype:social-engineering; sid:6004002; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (74-248-232-196.cprapid.com/eu/update.php)"; flow:established,to_server; http.uri; content:"/eu/update.php"; startswith; fast_pattern; http.host; content:"74-248-232-196.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004003; classtype:social-engineering; sid:6004003; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-ahmetbasli.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-ahmetbasli.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004004; classtype:social-engineering; sid:6004004; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hsbccommunityuae.square-community.com.au/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hsbccommunityuae.square-community.com.au"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004005; classtype:social-engineering; sid:6004005; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hg50999.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hg50999.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004006; classtype:social-engineering; sid:6004006; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jithu-2358.github.io/Instagram-Get-1000-followers/)"; flow:established,to_server; http.uri; content:"/Instagram-Get-1000-followers/"; startswith; fast_pattern; http.host; content:"jithu-2358.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004007; classtype:social-engineering; sid:6004007; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.maukjd.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.maukjd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004008; classtype:social-engineering; sid:6004008; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.suhfg120.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.suhfg120.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004009; classtype:social-engineering; sid:6004009; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vo.la/ZAYLMTt)"; flow:established,to_server; http.uri; content:"/ZAYLMTt"; startswith; fast_pattern; http.host; content:"vo.la"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004010; classtype:social-engineering; sid:6004010; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.iomrjg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.iomrjg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004011; classtype:social-engineering; sid:6004011; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (track.freshpetals.info/ga/click/2-17710760-34-7252-14165-7739-c7eaf3d1e6-63188a4c5a)"; flow:established,to_server; http.uri; content:"/ga/click/2-17710760-34-7252-14165-7739-c7eaf3d1e6-63188a4c5a"; startswith; fast_pattern; http.host; content:"track.freshpetals.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004012; classtype:social-engineering; sid:6004012; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store.workshopscommunitreward.com/sharedfiles/filesdetails/id=3721598204/)"; flow:established,to_server; http.uri; content:"/sharedfiles/filesdetails/id=3721598204/"; startswith; fast_pattern; http.host; content:"store.workshopscommunitreward.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004013; classtype:social-engineering; sid:6004013; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (beneficioenlinearegistro-7e2bfd9b3de1.herokuapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"beneficioenlinearegistro-7e2bfd9b3de1.herokuapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004014; classtype:social-engineering; sid:6004014; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.xupqez.one/uqjmw)"; flow:established,to_server; http.uri; content:"/uqjmw"; startswith; fast_pattern; http.host; content:"usps.xupqez.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004015; classtype:social-engineering; sid:6004015; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox.com.ml/users/214376215131/profile)"; flow:established,to_server; http.uri; content:"/users/214376215131/profile"; startswith; fast_pattern; http.host; content:"roblox.com.ml"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004016; classtype:social-engineering; sid:6004016; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (positiveposition.com/callawaysmith/secure_access-5.html)"; flow:established,to_server; http.uri; content:"/callawaysmith/secure_access-5.html"; startswith; fast_pattern; http.host; content:"positiveposition.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004017; classtype:social-engineering; sid:6004017; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.us-fifa.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.us-fifa.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004018; classtype:social-engineering; sid:6004018; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dolvax.casa/so/co/)"; flow:established,to_server; http.uri; content:"/so/co/"; startswith; fast_pattern; http.host; content:"dolvax.casa"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004019; classtype:social-engineering; sid:6004019; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.davidlillis.com/ox_roots/verify.html)"; flow:established,to_server; http.uri; content:"/ox_roots/verify.html"; startswith; fast_pattern; http.host; content:"www.davidlillis.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004020; classtype:social-engineering; sid:6004020; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (credencils.ucoz.net/login.html)"; flow:established,to_server; http.uri; content:"/login.html"; startswith; fast_pattern; http.host; content:"credencils.ucoz.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004021; classtype:social-engineering; sid:6004021; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nlink.at/www_roblox_com_users_4424610850_profile)"; flow:established,to_server; http.uri; content:"/www_roblox_com_users_4424610850_profile"; startswith; fast_pattern; http.host; content:"nlink.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004022; classtype:social-engineering; sid:6004022; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.spykzt.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.spykzt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004023; classtype:social-engineering; sid:6004023; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.scotiaonlinebank-chi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.scotiaonlinebank-chi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004024; classtype:social-engineering; sid:6004024; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.yhcuqj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.yhcuqj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004025; classtype:social-engineering; sid:6004025; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cf995.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cf995.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004026; classtype:social-engineering; sid:6004026; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16531.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16531.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004027; classtype:social-engineering; sid:6004027; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fbshop.ffastbbuy.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fbshop.ffastbbuy.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004028; classtype:social-engineering; sid:6004028; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clientfundsportal.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"clientfundsportal.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004029; classtype:social-engineering; sid:6004029; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.securechain-dapps.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.securechain-dapps.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004030; classtype:social-engineering; sid:6004030; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (praadconsulting.com/xmx/secure_access-5.html)"; flow:established,to_server; http.uri; content:"/xmx/secure_access-5.html"; startswith; fast_pattern; http.host; content:"praadconsulting.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004031; classtype:social-engineering; sid:6004031; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.886xc.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.886xc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004032; classtype:social-engineering; sid:6004032; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pymes-negocios.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pymes-negocios.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004033; classtype:social-engineering; sid:6004033; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vmi3300525.contaboserver.net/cor/corres/COR/COR/corr.php)"; flow:established,to_server; http.uri; content:"/cor/corres/COR/COR/corr.php"; startswith; fast_pattern; http.host; content:"vmi3300525.contaboserver.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004034; classtype:social-engineering; sid:6004034; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (16489.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"16489.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004035; classtype:social-engineering; sid:6004035; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hyaxte.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hyaxte.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004036; classtype:social-engineering; sid:6004036; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (16547.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"16547.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004037; classtype:social-engineering; sid:6004037; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.patdyj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.patdyj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004038; classtype:social-engineering; sid:6004038; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.fqnzrlpkv.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.fqnzrlpkv.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004039; classtype:social-engineering; sid:6004039; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bvnwzr.club/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.bvnwzr.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004040; classtype:social-engineering; sid:6004040; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ubpsco.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ubpsco.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004041; classtype:social-engineering; sid:6004041; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth-netfliix-mov.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auth-netfliix-mov.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004042; classtype:social-engineering; sid:6004042; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-cs.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-cs.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004043; classtype:social-engineering; sid:6004043; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (digital-support.busines-help-center.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"digital-support.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004044; classtype:social-engineering; sid:6004044; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rtenjq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rtenjq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004045; classtype:social-engineering; sid:6004045; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.hvplznq.ink/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.hvplznq.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004046; classtype:social-engineering; sid:6004046; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thelastjedi00.github.io/instagram/)"; flow:established,to_server; http.uri; content:"/instagram/"; startswith; fast_pattern; http.host; content:"thelastjedi00.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004047; classtype:social-engineering; sid:6004047; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j62l.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j62l.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004048; classtype:social-engineering; sid:6004048; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (111obmen.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"111obmen.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004049; classtype:social-engineering; sid:6004049; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (marmoud.urge844284.pro/captcha.php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"marmoud.urge844284.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004050; classtype:social-engineering; sid:6004050; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fgahagdhfgvfhfghfgdgdyduhgc.cfolks.pl/fe/lk/auth/log.php)"; flow:established,to_server; http.uri; content:"/fe/lk/auth/log.php"; startswith; fast_pattern; http.host; content:"fgahagdhfgvfhfghfgdgdyduhgc.cfolks.pl"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004051; classtype:social-engineering; sid:6004051; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alice.urge844284.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"alice.urge844284.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004052; classtype:social-engineering; sid:6004052; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (recanto.pt/pri.html)"; flow:established,to_server; http.uri; content:"/pri.html"; startswith; fast_pattern; http.host; content:"recanto.pt"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004053; classtype:social-engineering; sid:6004053; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maxiswo.vip/mymaxis)"; flow:established,to_server; http.uri; content:"/mymaxis"; startswith; fast_pattern; http.host; content:"maxiswo.vip"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004054; classtype:social-engineering; sid:6004054; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ca-app-05.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ca-app-05.info"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004055; classtype:social-engineering; sid:6004055; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (64464id.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"64464id.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004056; classtype:social-engineering; sid:6004056; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (redirectqsdhvazdq.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"redirectqsdhvazdq.xyz"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004057; classtype:social-engineering; sid:6004057; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nsbrestrictcare.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nsbrestrictcare.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004058; classtype:social-engineering; sid:6004058; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fernand.urge844284.pro/captcha.php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"fernand.urge844284.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004059; classtype:social-engineering; sid:6004059; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (team-ledger.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"team-ledger.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004060; classtype:social-engineering; sid:6004060; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.urge844284.pro/captcha.php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"www.urge844284.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004061; classtype:social-engineering; sid:6004061; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-base.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-base.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004062; classtype:social-engineering; sid:6004062; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anuschkatmader.github.io/METRO-GER)"; flow:established,to_server; http.uri; content:"/METRO-GER"; startswith; fast_pattern; http.host; content:"anuschkatmader.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004063; classtype:social-engineering; sid:6004063; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vault1passvword.com/verify)"; flow:established,to_server; http.uri; content:"/verify"; startswith; fast_pattern; http.host; content:"vault1passvword.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004064; classtype:social-engineering; sid:6004064; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (albert.urge844284.pro/captcha.php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"albert.urge844284.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004065; classtype:social-engineering; sid:6004065; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (09474br.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"09474br.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004066; classtype:social-engineering; sid:6004066; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.oferta8500341pl.cfd/oferta/sony-zv-e10-obiektyw-kitowy-nd-filter-karta-sd-128-gb?id=uL9Zo8sky8W0Gbib)"; flow:established,to_server; http.uri; content:"/oferta/sony-zv-e10-obiektyw-kitowy-nd-filter-karta-sd-128-gb?id=uL9Zo8sky8W0Gbib"; startswith; fast_pattern; http.host; content:"allegrolokalnie.oferta8500341pl.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004067; classtype:social-engineering; sid:6004067; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wmchanger.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wmchanger.org"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004068; classtype:social-engineering; sid:6004068; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (monservicelivreo.com/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"monservicelivreo.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004069; classtype:social-engineering; sid:6004069; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (connect-trxzor.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"connect-trxzor.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004070; classtype:social-engineering; sid:6004070; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suiteio-treor.wixstudio.com/enus)"; flow:established,to_server; http.uri; content:"/enus"; startswith; fast_pattern; http.host; content:"suiteio-treor.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004071; classtype:social-engineering; sid:6004071; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (detection-autoroute.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"detection-autoroute.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004072; classtype:social-engineering; sid:6004072; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nav-intro.wixstudio.com/desktop-en)"; flow:established,to_server; http.uri; content:"/desktop-en"; startswith; fast_pattern; http.host; content:"nav-intro.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004073; classtype:social-engineering; sid:6004073; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oh.haouv.cam/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"oh.haouv.cam"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004074; classtype:social-engineering; sid:6004074; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adesao-nivel5.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"adesao-nivel5.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004075; classtype:social-engineering; sid:6004075; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (changee.biz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"changee.biz"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004076; classtype:social-engineering; sid:6004076; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (terra-money.wixstudio.com/home)"; flow:established,to_server; http.uri; content:"/home"; startswith; fast_pattern; http.host; content:"terra-money.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004077; classtype:social-engineering; sid:6004077; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (office3652cougarnetuhedu.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"office3652cougarnetuhedu.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004078; classtype:social-engineering; sid:6004078; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4rwebr.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4rwebr.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004079; classtype:social-engineering; sid:6004079; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (us-lekder-live.wixstudio.com/desktop-en)"; flow:established,to_server; http.uri; content:"/desktop-en"; startswith; fast_pattern; http.host; content:"us-lekder-live.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004080; classtype:social-engineering; sid:6004080; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (browser-desktops.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"browser-desktops.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004081; classtype:social-engineering; sid:6004081; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cryptoroyal.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cryptoroyal.cc"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004082; classtype:social-engineering; sid:6004082; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cryptovortex.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cryptovortex.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004083; classtype:social-engineering; sid:6004083; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (globalnems.com/work/project8371341)"; flow:established,to_server; http.uri; content:"/work/project8371341"; startswith; fast_pattern; http.host; content:"globalnems.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004084; classtype:social-engineering; sid:6004084; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ldgroe-homepage.wixstudio.com/en-desktop)"; flow:established,to_server; http.uri; content:"/en-desktop"; startswith; fast_pattern; http.host; content:"ldgroe-homepage.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004085; classtype:social-engineering; sid:6004085; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (leistenschneider.urge842284.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"leistenschneider.urge842284.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004086; classtype:social-engineering; sid:6004086; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezurlearn.wixstudio.com/suite-en)"; flow:established,to_server; http.uri; content:"/suite-en"; startswith; fast_pattern; http.host; content:"trezurlearn.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004087; classtype:social-engineering; sid:6004087; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gomezmunisanisidro.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gomezmunisanisidro.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004088; classtype:social-engineering; sid:6004088; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oh.paost.cam/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"oh.paost.cam"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004089; classtype:social-engineering; sid:6004089; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smart-lekdger.wixstudio.com/eng-us)"; flow:established,to_server; http.uri; content:"/eng-us"; startswith; fast_pattern; http.host; content:"smart-lekdger.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004090; classtype:social-engineering; sid:6004090; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suiteapps-trexr.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"suiteapps-trexr.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004091; classtype:social-engineering; sid:6004091; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (marouan.urge842284.pro/captcha.php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"marouan.urge842284.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004092; classtype:social-engineering; sid:6004092; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pilatesreforma.cl/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pilatesreforma.cl"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004093; classtype:social-engineering; sid:6004093; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.urge842284.pro/captcha.php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"www.urge842284.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004094; classtype:social-engineering; sid:6004094; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (informationendkb.sviluppo.host/de/)"; flow:established,to_server; http.uri; content:"/de/"; startswith; fast_pattern; http.host; content:"informationendkb.sviluppo.host"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004095; classtype:social-engineering; sid:6004095; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (start-with-ledger.zapier.app/start)"; flow:established,to_server; http.uri; content:"/start"; startswith; fast_pattern; http.host; content:"start-with-ledger.zapier.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004096; classtype:social-engineering; sid:6004096; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (desktops-unknown.wixstudio.com/enus)"; flow:established,to_server; http.uri; content:"/enus"; startswith; fast_pattern; http.host; content:"desktops-unknown.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004097; classtype:social-engineering; sid:6004097; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uiocena.s3.us-east-005.backblazeb2.com/ionos.html)"; flow:established,to_server; http.uri; content:"/ionos.html"; startswith; fast_pattern; http.host; content:"uiocena.s3.us-east-005.backblazeb2.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004098; classtype:social-engineering; sid:6004098; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appsbizzhost.com.au/capo)"; flow:established,to_server; http.uri; content:"/capo"; startswith; fast_pattern; http.host; content:"appsbizzhost.com.au"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004099; classtype:social-engineering; sid:6004099; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezorr-suites.wixstudio.com/enus)"; flow:established,to_server; http.uri; content:"/enus"; startswith; fast_pattern; http.host; content:"trezorr-suites.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004100; classtype:social-engineering; sid:6004100; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (startedsuites-apps.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"startedsuites-apps.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004101; classtype:social-engineering; sid:6004101; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmailmcnorgdgnloginphp.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webmailmcnorgdgnloginphp.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004102; classtype:social-engineering; sid:6004102; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (peagedefrance.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"peagedefrance.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004103; classtype:social-engineering; sid:6004103; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.oferta412475.cfd/oferta/sprzedam-busa-lt-vw-1999r/90555)"; flow:established,to_server; http.uri; content:"/oferta/sprzedam-busa-lt-vw-1999r/90555"; startswith; fast_pattern; http.host; content:"allegrolokalnie.oferta412475.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004104; classtype:social-engineering; sid:6004104; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (guidecdn-ldgre.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"guidecdn-ldgre.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004105; classtype:social-engineering; sid:6004105; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ensuite-global.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"ensuite-global.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004106; classtype:social-engineering; sid:6004106; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (host-services.com/suspended/pri.html)"; flow:established,to_server; http.uri; content:"/suspended/pri.html"; startswith; fast_pattern; http.host; content:"host-services.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004107; classtype:social-engineering; sid:6004107; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p-bienr2m4ozdectneccaorwgqaynae5rz.kimi.page/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p-bienr2m4ozdectneccaorwgqaynae5rz.kimi.page"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004108; classtype:social-engineering; sid:6004108; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (in44i.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"in44i.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004109; classtype:social-engineering; sid:6004109; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trejortstarts.wixstudio.com/start)"; flow:established,to_server; http.uri; content:"/start"; startswith; fast_pattern; http.host; content:"trejortstarts.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004110; classtype:social-engineering; sid:6004110; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (x02btroundcube.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"x02btroundcube.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004111; classtype:social-engineering; sid:6004111; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coincraddle.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coincraddle.cc"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004112; classtype:social-engineering; sid:6004112; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (livestarts-ledgre.wixstudio.com/start)"; flow:established,to_server; http.uri; content:"/start"; startswith; fast_pattern; http.host; content:"livestarts-ledgre.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004113; classtype:social-engineering; sid:6004113; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yaobmen.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yaobmen.org"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004114; classtype:social-engineering; sid:6004114; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3duzy5sgifg2i.kimi.page/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3duzy5sgifg2i.kimi.page"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004115; classtype:social-engineering; sid:6004115; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mouloud.urge842284.pro/captcha.php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"mouloud.urge842284.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004116; classtype:social-engineering; sid:6004116; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eng-trezo-logon.zapier.app/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"eng-trezo-logon.zapier.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004117; classtype:social-engineering; sid:6004117; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.detection-autoroute.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.detection-autoroute.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004118; classtype:social-engineering; sid:6004118; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (livestarts-ledgre.wixstudio.com/enus)"; flow:established,to_server; http.uri; content:"/enus"; startswith; fast_pattern; http.host; content:"livestarts-ledgre.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004119; classtype:social-engineering; sid:6004119; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ca-app-249.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ca-app-249.info"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004120; classtype:social-engineering; sid:6004120; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (benmed1778652514257.2301823.meusitehostgator.com.br/pl/ipko/pages/login.php)"; flow:established,to_server; http.uri; content:"/pl/ipko/pages/login.php"; startswith; fast_pattern; http.host; content:"benmed1778652514257.2301823.meusitehostgator.com.br"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004121; classtype:social-engineering; sid:6004121; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jfuifhjudkiod.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jfuifhjudkiod.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004122; classtype:social-engineering; sid:6004122; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gencatverifytchws.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gencatverifytchws.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004123; classtype:social-engineering; sid:6004123; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.looprx166-tpui.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.looprx166-tpui.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004124; classtype:social-engineering; sid:6004124; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ckbtvn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ckbtvn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004125; classtype:social-engineering; sid:6004125; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (concave-learning-102651.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"concave-learning-102651.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004126; classtype:social-engineering; sid:6004126; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.13835.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.13835.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004127; classtype:social-engineering; sid:6004127; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (16484.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"16484.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004128; classtype:social-engineering; sid:6004128; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sapphire-shannen-90.tiiny.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sapphire-shannen-90.tiiny.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004129; classtype:social-engineering; sid:6004129; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (realestate.milai-ie.com/irrs/tilfux/)"; flow:established,to_server; http.uri; content:"/irrs/tilfux/"; startswith; fast_pattern; http.host; content:"realestate.milai-ie.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004130; classtype:social-engineering; sid:6004130; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mydwjs.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mydwjs.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004131; classtype:social-engineering; sid:6004131; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wqsebp.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wqsebp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004132; classtype:social-engineering; sid:6004132; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vmkqep.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vmkqep.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004133; classtype:social-engineering; sid:6004133; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecortbabylon.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ecortbabylon.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004134; classtype:social-engineering; sid:6004134; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inicioinusual003.webcindario.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"inicioinusual003.webcindario.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004135; classtype:social-engineering; sid:6004135; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bhabanagarafoundation.org/parolifts/MayRFP.php)"; flow:established,to_server; http.uri; content:"/parolifts/MayRFP.php"; startswith; fast_pattern; http.host; content:"bhabanagarafoundation.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004136; classtype:social-engineering; sid:6004136; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pelun-moral-biz-savir-nelon-nd11kt12.pages.dev/form_submit_appeal/)"; flow:established,to_server; http.uri; content:"/form_submit_appeal/"; startswith; fast_pattern; http.host; content:"pelun-moral-biz-savir-nelon-nd11kt12.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004137; classtype:social-engineering; sid:6004137; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rvsolb.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rvsolb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004138; classtype:social-engineering; sid:6004138; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (upgrade-102066.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"upgrade-102066.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004139; classtype:social-engineering; sid:6004139; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en-bri-dge-trazorr.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"en-bri-dge-trazorr.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004140; classtype:social-engineering; sid:6004140; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (g365kvip.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"g365kvip.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004141; classtype:social-engineering; sid:6004141; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mglfpb.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mglfpb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004142; classtype:social-engineering; sid:6004142; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mercadolibre.com.ar/gz/account-verification?go=https%3A%2F%2Fwww.mercadolibre.com.ar%2Fp%2FMLA54224113%2F&tid=7f50f1ff-8b04-4bc5-b80e-6df8e6da8d2a)"; flow:established,to_server; http.uri; content:"/gz/account-verification?go=https%3A%2F%2Fwww.mercadolibre.com.ar%2Fp%2FMLA54224113%2F&tid=7f50f1ff-8b04-4bc5-b80e-6df8e6da8d2a"; startswith; fast_pattern; http.host; content:"www.mercadolibre.com.ar"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004143; classtype:social-engineering; sid:6004143; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dhj.szytnfbl.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dhj.szytnfbl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004144; classtype:social-engineering; sid:6004144; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maachineveriifyoffice365.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"maachineveriifyoffice365.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004145; classtype:social-engineering; sid:6004145; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xerim-savix-biz-qelon-deril-nd11kt12.pages.dev/form_submit_appeal/)"; flow:established,to_server; http.uri; content:"/form_submit_appeal/"; startswith; fast_pattern; http.host; content:"xerim-savix-biz-qelon-deril-nd11kt12.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004146; classtype:social-engineering; sid:6004146; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (295cb424-62fa-f87d-7967-adobe2.reynoldsjace5.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"295cb424-62fa-f87d-7967-adobe2.reynoldsjace5.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004147; classtype:social-engineering; sid:6004147; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.katomb.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.katomb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004148; classtype:social-engineering; sid:6004148; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vpmega2010.github.io/ista.html/)"; flow:established,to_server; http.uri; content:"/ista.html/"; startswith; fast_pattern; http.host; content:"vpmega2010.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004149; classtype:social-engineering; sid:6004149; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (n53i3.r.ag.d.sendibm3.com/mk/cl/f/sh/1f8JIKXwHGYox0Goyu54KhjL6X/4Cgt5f8Y41bq)"; flow:established,to_server; http.uri; content:"/mk/cl/f/sh/1f8JIKXwHGYox0Goyu54KhjL6X/4Cgt5f8Y41bq"; startswith; fast_pattern; http.host; content:"n53i3.r.ag.d.sendibm3.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004150; classtype:social-engineering; sid:6004150; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (omnicomproductionstudios.github.io/PNC-Display-Banners/)"; flow:established,to_server; http.uri; content:"/PNC-Display-Banners/"; startswith; fast_pattern; http.host; content:"omnicomproductionstudios.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004151; classtype:social-engineering; sid:6004151; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tkmsbl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tkmsbl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004152; classtype:social-engineering; sid:6004152; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gazxdq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gazxdq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004153; classtype:social-engineering; sid:6004153; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (haberglobal44.shop/auth)"; flow:established,to_server; http.uri; content:"/auth"; startswith; fast_pattern; http.host; content:"haberglobal44.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004154; classtype:social-engineering; sid:6004154; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.jnlgt.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.jnlgt.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004155; classtype:social-engineering; sid:6004155; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (determined-click-845532.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"determined-click-845532.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004156; classtype:social-engineering; sid:6004156; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.vintagevoltageengineering.com/ParatusLLC/AgnetaDahl.html)"; flow:established,to_server; http.uri; content:"/ParatusLLC/AgnetaDahl.html"; startswith; fast_pattern; http.host; content:"www.vintagevoltageengineering.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004157; classtype:social-engineering; sid:6004157; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.microsofltonline.org/landing/form/c2ebe1b9-7f32-48bb-b17f-8b298a04cb4e)"; flow:established,to_server; http.uri; content:"/landing/form/c2ebe1b9-7f32-48bb-b17f-8b298a04cb4e"; startswith; fast_pattern; http.host; content:"login.microsofltonline.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004158; classtype:social-engineering; sid:6004158; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.doxcsb.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.doxcsb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004159; classtype:social-engineering; sid:6004159; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-pancakeswap.to/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app-pancakeswap.to"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004160; classtype:social-engineering; sid:6004160; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sarin-delor-biz-morix-havel-nd11kt12.pages.dev/form_submit_appeal/)"; flow:established,to_server; http.uri; content:"/form_submit_appeal/"; startswith; fast_pattern; http.host; content:"sarin-delor-biz-morix-havel-nd11kt12.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004161; classtype:social-engineering; sid:6004161; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (haberglobal44.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"haberglobal44.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004162; classtype:social-engineering; sid:6004162; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wjsmec.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wjsmec.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004163; classtype:social-engineering; sid:6004163; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.xupqmkz.one/uqjmw)"; flow:established,to_server; http.uri; content:"/uqjmw"; startswith; fast_pattern; http.host; content:"usps.xupqmkz.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004164; classtype:social-engineering; sid:6004164; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bhabanagarafoundation.org/conceptlab/TenderRFP.php)"; flow:established,to_server; http.uri; content:"/conceptlab/TenderRFP.php"; startswith; fast_pattern; http.host; content:"bhabanagarafoundation.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004165; classtype:social-engineering; sid:6004165; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.next13-rentbnb-clone.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.next13-rentbnb-clone.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004166; classtype:social-engineering; sid:6004166; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kisldyloutlook.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kisldyloutlook.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004167; classtype:social-engineering; sid:6004167; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account.remote-otp.com/recoveryidprofile?rid=pmWV64y)"; flow:established,to_server; http.uri; content:"/recoveryidprofile?rid=pmWV64y"; startswith; fast_pattern; http.host; content:"account.remote-otp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004168; classtype:social-engineering; sid:6004168; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gentle-cedar-122.allcompredirectportalshare.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gentle-cedar-122.allcompredirectportalshare.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004169; classtype:social-engineering; sid:6004169; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.epygom.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.epygom.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004170; classtype:social-engineering; sid:6004170; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.grchiu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.grchiu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004171; classtype:social-engineering; sid:6004171; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (projeto-dio.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"projeto-dio.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004172; classtype:social-engineering; sid:6004172; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suporte-inc.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"suporte-inc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004173; classtype:social-engineering; sid:6004173; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mirandaromario09.github.io/estudo-html-div-span/)"; flow:established,to_server; http.uri; content:"/estudo-html-div-span/"; startswith; fast_pattern; http.host; content:"mirandaromario09.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004174; classtype:social-engineering; sid:6004174; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.auqisg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.auqisg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004175; classtype:social-engineering; sid:6004175; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.aubmox.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.aubmox.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004176; classtype:social-engineering; sid:6004176; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.feiji-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.feiji-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004177; classtype:social-engineering; sid:6004177; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ecdyvl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ecdyvl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004178; classtype:social-engineering; sid:6004178; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sicredlseguranca.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sicredlseguranca.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004179; classtype:social-engineering; sid:6004179; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ghostproc565-bgqv.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ghostproc565-bgqv.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004180; classtype:social-engineering; sid:6004180; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (govuk-cons-uk.github.io/momathdiop/)"; flow:established,to_server; http.uri; content:"/momathdiop/"; startswith; fast_pattern; http.host; content:"govuk-cons-uk.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004181; classtype:social-engineering; sid:6004181; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortsom.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortsom.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004182; classtype:social-engineering; sid:6004182; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.eorybx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.eorybx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004183; classtype:social-engineering; sid:6004183; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecortbabylon.site/location-live/test)"; flow:established,to_server; http.uri; content:"/location-live/test"; startswith; fast_pattern; http.host; content:"ecortbabylon.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004184; classtype:social-engineering; sid:6004184; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bhabanagarafoundation.org/risecompliance/RequestTender.php)"; flow:established,to_server; http.uri; content:"/risecompliance/RequestTender.php"; startswith; fast_pattern; http.host; content:"bhabanagarafoundation.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004185; classtype:social-engineering; sid:6004185; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (farix-selun-biz-mevol-tarax-nd11kt12.pages.dev/form_submit_appeal/)"; flow:established,to_server; http.uri; content:"/form_submit_appeal/"; startswith; fast_pattern; http.host; content:"farix-selun-biz-mevol-tarax-nd11kt12.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004186; classtype:social-engineering; sid:6004186; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bhabanagarafoundation.org/dpsyass/RFPPORTAL.php)"; flow:established,to_server; http.uri; content:"/dpsyass/RFPPORTAL.php"; startswith; fast_pattern; http.host; content:"bhabanagarafoundation.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004187; classtype:social-engineering; sid:6004187; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brdge-trezr-faq.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"brdge-trezr-faq.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004188; classtype:social-engineering; sid:6004188; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qscmxz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qscmxz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004189; classtype:social-engineering; sid:6004189; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (govuk-cons-uk.github.io/serignediaw/)"; flow:established,to_server; http.uri; content:"/serignediaw/"; startswith; fast_pattern; http.host; content:"govuk-cons-uk.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004190; classtype:social-engineering; sid:6004190; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dennisriani2-design.github.io/onedriv/)"; flow:established,to_server; http.uri; content:"/onedriv/"; startswith; fast_pattern; http.host; content:"dennisriani2-design.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004191; classtype:social-engineering; sid:6004191; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nqvljz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nqvljz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004192; classtype:social-engineering; sid:6004192; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ujghy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ujghy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004193; classtype:social-engineering; sid:6004193; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.eldtzy.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.eldtzy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004194; classtype:social-engineering; sid:6004194; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deck574.github.io/Doc/PO)"; flow:established,to_server; http.uri; content:"/Doc/PO"; startswith; fast_pattern; http.host; content:"deck574.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004195; classtype:social-engineering; sid:6004195; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.xupqwbf.one/uqjmw)"; flow:established,to_server; http.uri; content:"/uqjmw"; startswith; fast_pattern; http.host; content:"usps.xupqwbf.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004196; classtype:social-engineering; sid:6004196; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tbjacd.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tbjacd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004197; classtype:social-engineering; sid:6004197; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.uolpmb.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.uolpmb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004198; classtype:social-engineering; sid:6004198; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mjpxuw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mjpxuw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004199; classtype:social-engineering; sid:6004199; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (formapply-verifiedbadge-now.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"formapply-verifiedbadge-now.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004200; classtype:social-engineering; sid:6004200; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qvxjhl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qvxjhl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004201; classtype:social-engineering; sid:6004201; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecortbabylon.site/duo/test)"; flow:established,to_server; http.uri; content:"/duo/test"; startswith; fast_pattern; http.host; content:"ecortbabylon.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004202; classtype:social-engineering; sid:6004202; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bhabanagarafoundation.org/johnpardeyarchitects/RequestTender.php)"; flow:established,to_server; http.uri; content:"/johnpardeyarchitects/RequestTender.php"; startswith; fast_pattern; http.host; content:"bhabanagarafoundation.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004203; classtype:social-engineering; sid:6004203; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fore38b9x5p12xeb76tf.s3.us-east-1.amazonaws.com/17f11d63g7rgr8j5qazofe_mdlqb5gtoj4gljy_jfplw8.html)"; flow:established,to_server; http.uri; content:"/17f11d63g7rgr8j5qazofe_mdlqb5gtoj4gljy_jfplw8.html"; startswith; fast_pattern; http.host; content:"fore38b9x5p12xeb76tf.s3.us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004204; classtype:social-engineering; sid:6004204; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.jimmysjeepadventures.com/baysidepropertyltd/joerogersopendocaccess.html)"; flow:established,to_server; http.uri; content:"/baysidepropertyltd/joerogersopendocaccess.html"; startswith; fast_pattern; http.host; content:"www.jimmysjeepadventures.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004205; classtype:social-engineering; sid:6004205; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mahmoudallammahmoud088-cell.github.io/faceName)"; flow:established,to_server; http.uri; content:"/faceName"; startswith; fast_pattern; http.host; content:"mahmoudallammahmoud088-cell.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004206; classtype:social-engineering; sid:6004206; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (php-ac67csbbpasschid.wasmer.app/login.php)"; flow:established,to_server; http.uri; content:"/login.php"; startswith; fast_pattern; http.host; content:"php-ac67csbbpasschid.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004207; classtype:social-engineering; sid:6004207; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.xupqorl.one/uqjmw)"; flow:established,to_server; http.uri; content:"/uqjmw"; startswith; fast_pattern; http.host; content:"usps.xupqorl.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004208; classtype:social-engineering; sid:6004208; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamaskwallet.to/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metamaskwallet.to"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004209; classtype:social-engineering; sid:6004209; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gemini.xiaogpt1.eu.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gemini.xiaogpt1.eu.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004210; classtype:social-engineering; sid:6004210; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gemini.enjoyit.dpdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gemini.enjoyit.dpdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004211; classtype:social-engineering; sid:6004211; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jlexkv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jlexkv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004212; classtype:social-engineering; sid:6004212; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (testdomain17122223.com/home/index.php)"; flow:established,to_server; http.uri; content:"/home/index.php"; startswith; fast_pattern; http.host; content:"testdomain17122223.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004213; classtype:social-engineering; sid:6004213; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (serverdocx.s-drc2.cloud.gcore.lu/n1wnww.html)"; flow:established,to_server; http.uri; content:"/n1wnww.html"; startswith; fast_pattern; http.host; content:"serverdocx.s-drc2.cloud.gcore.lu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004214; classtype:social-engineering; sid:6004214; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.emsglc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.emsglc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004215; classtype:social-engineering; sid:6004215; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-clone-olive-iota.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-olive-iota.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004216; classtype:social-engineering; sid:6004216; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rtranstics.co.za/assets_old/redirect.htm)"; flow:established,to_server; http.uri; content:"/assets_old/redirect.htm"; startswith; fast_pattern; http.host; content:"rtranstics.co.za"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004217; classtype:social-engineering; sid:6004217; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-for-quay-workshop.pages.dev/login/)"; flow:established,to_server; http.uri; content:"/login/"; startswith; fast_pattern; http.host; content:"business-for-quay-workshop.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004218; classtype:social-engineering; sid:6004218; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fenor-lexav-biz-qerin-melot-nd11kt12.pages.dev/form_submit_appeal/)"; flow:established,to_server; http.uri; content:"/form_submit_appeal/"; startswith; fast_pattern; http.host; content:"fenor-lexav-biz-qerin-melot-nd11kt12.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004219; classtype:social-engineering; sid:6004219; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (boerse.raiffeisen.ch/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"boerse.raiffeisen.ch"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004220; classtype:social-engineering; sid:6004220; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ujsfha.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ujsfha.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004221; classtype:social-engineering; sid:6004221; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (caseid-1605plkqzm.integradatalink.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"caseid-1605plkqzm.integradatalink.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004222; classtype:social-engineering; sid:6004222; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ergdob.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ergdob.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004223; classtype:social-engineering; sid:6004223; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.novopinhal.com/budget/budget.php)"; flow:established,to_server; http.uri; content:"/budget/budget.php"; startswith; fast_pattern; http.host; content:"www.novopinhal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004224; classtype:social-engineering; sid:6004224; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (skinboard.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"skinboard.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004225; classtype:social-engineering; sid:6004225; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (first-plum-844011.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"first-plum-844011.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004226; classtype:social-engineering; sid:6004226; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bobox81176bayxscom.bobox81176.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bobox81176bayxscom.bobox81176.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004227; classtype:social-engineering; sid:6004227; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ads2026.online/facebook-ads-meta2026/)"; flow:established,to_server; http.uri; content:"/facebook-ads-meta2026/"; startswith; fast_pattern; http.host; content:"www.ads2026.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004228; classtype:social-engineering; sid:6004228; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vibuen.com/assets/css/su0OMkRs&saiAMflYTgmC8fWFlyDKmODFOhDlMLXZV2tObY33ijNiNvLvbmkQEagBRrkPF04TIAUHFpbC0va0XuYyzt2Jq59gSDIX1LKFWNIM/)"; flow:established,to_server; http.uri; content:"/assets/css/su0OMkRs&saiAMflYTgmC8fWFlyDKmODFOhDlMLXZV2tObY33ijNiNvLvbmkQEagBRrkPF04TIAUHFpbC0va0XuYyzt2Jq59gSDIX1LKFWNIM/"; startswith; fast_pattern; http.host; content:"vibuen.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004229; classtype:social-engineering; sid:6004229; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-phi-mocha.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-phi-mocha.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004230; classtype:social-engineering; sid:6004230; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticui.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-noticui.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004231; classtype:social-engineering; sid:6004231; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.double-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.double-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004232; classtype:social-engineering; sid:6004232; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rblx.asia/IIGtj5L)"; flow:established,to_server; http.uri; content:"/IIGtj5L"; startswith; fast_pattern; http.host; content:"rblx.asia"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004233; classtype:social-engineering; sid:6004233; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (renukadevchake.github.io/NETFLIX-UI-CLONE/)"; flow:established,to_server; http.uri; content:"/NETFLIX-UI-CLONE/"; startswith; fast_pattern; http.host; content:"renukadevchake.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004234; classtype:social-engineering; sid:6004234; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (doblebe.com.ar/wp-content/shop/verification/88M3DN9M5398EC052N91/choose.php)"; flow:established,to_server; http.uri; content:"/wp-content/shop/verification/88M3DN9M5398EC052N91/choose.php"; startswith; fast_pattern; http.host; content:"doblebe.com.ar"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004235; classtype:social-engineering; sid:6004235; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (digital-center.busines-help-center.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"digital-center.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004236; classtype:social-engineering; sid:6004236; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.lockfort.lol/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.lockfort.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004237; classtype:social-engineering; sid:6004237; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.amazon-clone-phi-mocha.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazon-clone-phi-mocha.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004238; classtype:social-engineering; sid:6004238; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (formidnxz-dnacostmer.frusciante.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"formidnxz-dnacostmer.frusciante.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004239; classtype:social-engineering; sid:6004239; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.adpygq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.adpygq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004240; classtype:social-engineering; sid:6004240; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.uzeokp.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.uzeokp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004241; classtype:social-engineering; sid:6004241; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-dd20b357ea46415a903f6ae9a80de701.r2.dev/Zim_E.html)"; flow:established,to_server; http.uri; content:"/Zim_E.html"; startswith; fast_pattern; http.host; content:"pub-dd20b357ea46415a903f6ae9a80de701.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004242; classtype:social-engineering; sid:6004242; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (donex-helor-biz-vamin-qelur-nd11kt12.pages.dev/form_submit_appeal/)"; flow:established,to_server; http.uri; content:"/form_submit_appeal/"; startswith; fast_pattern; http.host; content:"donex-helor-biz-vamin-qelur-nd11kt12.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004243; classtype:social-engineering; sid:6004243; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rdf-sewq.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rdf-sewq.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004244; classtype:social-engineering; sid:6004244; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rss.readles.at/go/y2b403/y274x274)"; flow:established,to_server; http.uri; content:"/go/y2b403/y274x274"; startswith; fast_pattern; http.host; content:"rss.readles.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004245; classtype:social-engineering; sid:6004245; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pubtjf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pubtjf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004246; classtype:social-engineering; sid:6004246; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fyplrv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.fyplrv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004247; classtype:social-engineering; sid:6004247; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecortbabylon.site/google-meet/test)"; flow:established,to_server; http.uri; content:"/google-meet/test"; startswith; fast_pattern; http.host; content:"ecortbabylon.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004248; classtype:social-engineering; sid:6004248; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tzrwyo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tzrwyo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004249; classtype:social-engineering; sid:6004249; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qkcxwh.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qkcxwh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004250; classtype:social-engineering; sid:6004250; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (picture-ads-202665.pages.dev/facebook.com-id-00463710.html)"; flow:established,to_server; http.uri; content:"/facebook.com-id-00463710.html"; startswith; fast_pattern; http.host; content:"picture-ads-202665.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004251; classtype:social-engineering; sid:6004251; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alcancenuplus.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"alcancenuplus.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004252; classtype:social-engineering; sid:6004252; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.xupqoxx.one/uqjmw/)"; flow:established,to_server; http.uri; content:"/uqjmw/"; startswith; fast_pattern; http.host; content:"usps.xupqoxx.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004253; classtype:social-engineering; sid:6004253; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ompsju.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ompsju.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004254; classtype:social-engineering; sid:6004254; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (live-iive.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"live-iive.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004255; classtype:social-engineering; sid:6004255; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fortfind.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fortfind.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004256; classtype:social-engineering; sid:6004256; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (creditoradvice.co.uk/buzz/pages/redraiffeisen.php)"; flow:established,to_server; http.uri; content:"/buzz/pages/redraiffeisen.php"; startswith; fast_pattern; http.host; content:"creditoradvice.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004257; classtype:social-engineering; sid:6004257; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hqimgt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hqimgt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004258; classtype:social-engineering; sid:6004258; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ldgrijsjbhj.malibu02.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ldgrijsjbhj.malibu02.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004259; classtype:social-engineering; sid:6004259; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ugxphb.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ugxphb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004260; classtype:social-engineering; sid:6004260; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.twslic.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.twslic.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004261; classtype:social-engineering; sid:6004261; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telegrambotbd.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"telegrambotbd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004262; classtype:social-engineering; sid:6004262; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ezdhsb.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ezdhsb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004263; classtype:social-engineering; sid:6004263; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentosim04.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentosim04.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004264; classtype:social-engineering; sid:6004264; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.absurc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.absurc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004265; classtype:social-engineering; sid:6004265; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (himeshagarwal.github.io/Amazon-UI-Project/)"; flow:established,to_server; http.uri; content:"/Amazon-UI-Project/"; startswith; fast_pattern; http.host; content:"himeshagarwal.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004266; classtype:social-engineering; sid:6004266; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amlar2026.com/nextlevel-auto/)"; flow:established,to_server; http.uri; content:"/nextlevel-auto/"; startswith; fast_pattern; http.host; content:"amlar2026.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004267; classtype:social-engineering; sid:6004267; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (govuk-cons-uk.github.io/papacheikhcisse/)"; flow:established,to_server; http.uri; content:"/papacheikhcisse/"; startswith; fast_pattern; http.host; content:"govuk-cons-uk.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004268; classtype:social-engineering; sid:6004268; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticui.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-noticui.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004269; classtype:social-engineering; sid:6004269; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.naazoms.co.za/assets/js/ie/budget.php)"; flow:established,to_server; http.uri; content:"/assets/js/ie/budget.php"; startswith; fast_pattern; http.host; content:"www.naazoms.co.za"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004270; classtype:social-engineering; sid:6004270; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ncdiym.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ncdiym.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004271; classtype:social-engineering; sid:6004271; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xxv.cesnimusic.com/register?code=maTiy2)"; flow:established,to_server; http.uri; content:"/register?code=maTiy2"; startswith; fast_pattern; http.host; content:"xxv.cesnimusic.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004272; classtype:social-engineering; sid:6004272; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.eazrkt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.eazrkt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004273; classtype:social-engineering; sid:6004273; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kzmwas.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kzmwas.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004274; classtype:social-engineering; sid:6004274; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qzdugy.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qzdugy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004275; classtype:social-engineering; sid:6004275; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rps2610.github.io/mini-project-1/)"; flow:established,to_server; http.uri; content:"/mini-project-1/"; startswith; fast_pattern; http.host; content:"rps2610.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004276; classtype:social-engineering; sid:6004276; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (messenger-smeta-verification.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"messenger-smeta-verification.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004277; classtype:social-engineering; sid:6004277; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.canvasphotography.id/hom/kbk/login.php)"; flow:established,to_server; http.uri; content:"/hom/kbk/login.php"; startswith; fast_pattern; http.host; content:"www.canvasphotography.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004278; classtype:social-engineering; sid:6004278; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.shuzwx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.shuzwx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004279; classtype:social-engineering; sid:6004279; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecortbabylon.site/location/test)"; flow:established,to_server; http.uri; content:"/location/test"; startswith; fast_pattern; http.host; content:"ecortbabylon.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004280; classtype:social-engineering; sid:6004280; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dlecjq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dlecjq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004281; classtype:social-engineering; sid:6004281; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (encouraging-adopt-symantec-lists.trycloudflare.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"encouraging-adopt-symantec-lists.trycloudflare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004282; classtype:social-engineering; sid:6004282; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ripe-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ripe-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004283; classtype:social-engineering; sid:6004283; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xebfqn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xebfqn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004284; classtype:social-engineering; sid:6004284; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.evaskw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.evaskw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004285; classtype:social-engineering; sid:6004285; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-red-nine.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-red-nine.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004286; classtype:social-engineering; sid:6004286; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kkiosked.web.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kkiosked.web.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004287; classtype:social-engineering; sid:6004287; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (next13-rentbnb-clone.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"next13-rentbnb-clone.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004288; classtype:social-engineering; sid:6004288; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.xupqlzs.one/uqjmw)"; flow:established,to_server; http.uri; content:"/uqjmw"; startswith; fast_pattern; http.host; content:"usps.xupqlzs.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004289; classtype:social-engineering; sid:6004289; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (samyakdutta835.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"samyakdutta835.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004290; classtype:social-engineering; sid:6004290; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticyv.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-noticyv.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004291; classtype:social-engineering; sid:6004291; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maisnovolimitedisponivell.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"maisnovolimitedisponivell.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004292; classtype:social-engineering; sid:6004292; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wajpuq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wajpuq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004293; classtype:social-engineering; sid:6004293; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wdimore.offiallyy.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wdimore.offiallyy.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004294; classtype:social-engineering; sid:6004294; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.qinzhou-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.qinzhou-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004295; classtype:social-engineering; sid:6004295; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (germodis.rest/sanmarcogas)"; flow:established,to_server; http.uri; content:"/sanmarcogas"; startswith; fast_pattern; http.host; content:"germodis.rest"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004296; classtype:social-engineering; sid:6004296; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qyfkh.leasdes.com/ifaopjxrknbfh?ajeyx_im=tDZ1CoC3At6EL1LW5w_OL)"; flow:established,to_server; http.uri; content:"/ifaopjxrknbfh?ajeyx_im=tDZ1CoC3At6EL1LW5w_OL"; startswith; fast_pattern; http.host; content:"qyfkh.leasdes.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004297; classtype:social-engineering; sid:6004297; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (code-with-farhan-cs.github.io/netflix-clone)"; flow:established,to_server; http.uri; content:"/netflix-clone"; startswith; fast_pattern; http.host; content:"code-with-farhan-cs.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004298; classtype:social-engineering; sid:6004298; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.syefvu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.syefvu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004299; classtype:social-engineering; sid:6004299; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tqbxro.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tqbxro.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004300; classtype:social-engineering; sid:6004300; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.irvlkq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.irvlkq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004301; classtype:social-engineering; sid:6004301; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mkloi.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mkloi.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004302; classtype:social-engineering; sid:6004302; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ynxz-ld.nxtxle.biz.id/x09/p5/)"; flow:established,to_server; http.uri; content:"/x09/p5/"; startswith; fast_pattern; http.host; content:"ynxz-ld.nxtxle.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004303; classtype:social-engineering; sid:6004303; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pbsmdv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pbsmdv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004304; classtype:social-engineering; sid:6004304; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bhabanagarafoundation.org/riacharchitects/MayRequest.php)"; flow:established,to_server; http.uri; content:"/riacharchitects/MayRequest.php"; startswith; fast_pattern; http.host; content:"bhabanagarafoundation.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004305; classtype:social-engineering; sid:6004305; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xdtwpv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xdtwpv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004306; classtype:social-engineering; sid:6004306; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clickoncehosting.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"clickoncehosting.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004307; classtype:social-engineering; sid:6004307; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qljanz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qljanz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004308; classtype:social-engineering; sid:6004308; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (govuk-cons-uk.github.io/khadimfaye/)"; flow:established,to_server; http.uri; content:"/khadimfaye/"; startswith; fast_pattern; http.host; content:"govuk-cons-uk.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004309; classtype:social-engineering; sid:6004309; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bnayqs.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bnayqs.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004310; classtype:social-engineering; sid:6004310; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gjapof.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gjapof.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004311; classtype:social-engineering; sid:6004311; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ptamitk.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"ptamitk.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004312; classtype:social-engineering; sid:6004312; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (click.freshpetals.info/ga/click/2-23766776-50-6595-12872-7051-25fac880ee-3a22d1e4e6)"; flow:established,to_server; http.uri; content:"/ga/click/2-23766776-50-6595-12872-7051-25fac880ee-3a22d1e4e6"; startswith; fast_pattern; http.host; content:"click.freshpetals.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004313; classtype:social-engineering; sid:6004313; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dennisriani2-design.github.io/onedrive)"; flow:established,to_server; http.uri; content:"/onedrive"; startswith; fast_pattern; http.host; content:"dennisriani2-design.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004314; classtype:social-engineering; sid:6004314; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hznrev.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hznrev.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004315; classtype:social-engineering; sid:6004315; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f365kvip.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f365kvip.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004316; classtype:social-engineering; sid:6004316; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (danaid.7xb.web.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"danaid.7xb.web.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004317; classtype:social-engineering; sid:6004317; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ripyba.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ripyba.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004318; classtype:social-engineering; sid:6004318; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qduva-vvxm-19c4.984bd87e928ce48d5b697b2a.workers.dev/lp/uUlf9_fwzPw)"; flow:established,to_server; http.uri; content:"/lp/uUlf9_fwzPw"; startswith; fast_pattern; http.host; content:"qduva-vvxm-19c4.984bd87e928ce48d5b697b2a.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004319; classtype:social-engineering; sid:6004319; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (awesome-dialects-347159.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"awesome-dialects-347159.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004320; classtype:social-engineering; sid:6004320; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecortbabylon.site/review/test)"; flow:established,to_server; http.uri; content:"/review/test"; startswith; fast_pattern; http.host; content:"ecortbabylon.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004321; classtype:social-engineering; sid:6004321; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamask-work.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metamask-work.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004322; classtype:social-engineering; sid:6004322; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.cldnga.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.cldnga.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004323; classtype:social-engineering; sid:6004323; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cooperttran.com.br/Adobe/)"; flow:established,to_server; http.uri; content:"/Adobe/"; startswith; fast_pattern; http.host; content:"www.cooperttran.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004324; classtype:social-engineering; sid:6004324; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wufjym.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wufjym.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004325; classtype:social-engineering; sid:6004325; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jhbdlp.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jhbdlp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004326; classtype:social-engineering; sid:6004326; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vfducs.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vfducs.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004327; classtype:social-engineering; sid:6004327; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (h5.metamaskvip.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"h5.metamaskvip.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004328; classtype:social-engineering; sid:6004328; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.cvexkp.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.cvexkp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004329; classtype:social-engineering; sid:6004329; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ibdspl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ibdspl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004330; classtype:social-engineering; sid:6004330; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (con.signalstacktrend.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"con.signalstacktrend.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004331; classtype:social-engineering; sid:6004331; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ezroxg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ezroxg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004332; classtype:social-engineering; sid:6004332; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ccmkmusicbox.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ccmkmusicbox.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004333; classtype:social-engineering; sid:6004333; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blucex.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"blucex.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004334; classtype:social-engineering; sid:6004334; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chatuchakplants.com/?app_vl=Zn9wlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=Ctoror1@90cc273260e3050b5c21a75edc0d368d49e5.com&sui=%7Bsui%7D&fn=&ln=&p=&z=plnonamecl200526vul2)"; flow:established,to_server; http.uri; content:"/?app_vl=Zn9wlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=Ctoror1@90cc273260e3050b5c21a75edc0d368d49e5.com&sui=%7Bsui%7D&fn=&ln=&p=&z=plnonamecl200526vul2"; startswith; fast_pattern; http.host; content:"chatuchakplants.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004335; classtype:social-engineering; sid:6004335; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticug.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-noticug.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004336; classtype:social-engineering; sid:6004336; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecortbabylon.site/login/test)"; flow:established,to_server; http.uri; content:"/login/test"; startswith; fast_pattern; http.host; content:"ecortbabylon.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004337; classtype:social-engineering; sid:6004337; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qjsvca.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qjsvca.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004338; classtype:social-engineering; sid:6004338; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (free-badge-reward.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"free-badge-reward.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004339; classtype:social-engineering; sid:6004339; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tejkpi.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tejkpi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004340; classtype:social-engineering; sid:6004340; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (crotoiahr.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"crotoiahr.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004341; classtype:social-engineering; sid:6004341; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mercadolibre.com.ar/p/MLA54224113/)"; flow:established,to_server; http.uri; content:"/p/MLA54224113/"; startswith; fast_pattern; http.host; content:"www.mercadolibre.com.ar"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004342; classtype:social-engineering; sid:6004342; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-page-builder-1--makiuzoma.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-page-builder-1--makiuzoma.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004343; classtype:social-engineering; sid:6004343; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortvexa.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortvexa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004344; classtype:social-engineering; sid:6004344; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.exsomg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.exsomg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004345; classtype:social-engineering; sid:6004345; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xjgdum.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xjgdum.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004346; classtype:social-engineering; sid:6004346; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lokfort.lol/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lokfort.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004347; classtype:social-engineering; sid:6004347; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (looprx166-tpui.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"looprx166-tpui.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004348; classtype:social-engineering; sid:6004348; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xxv.cesnimusic.com/?code=BkfYL0)"; flow:established,to_server; http.uri; content:"/?code=BkfYL0"; startswith; fast_pattern; http.host; content:"xxv.cesnimusic.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004349; classtype:social-engineering; sid:6004349; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ldgriokdfsuh.nafis330.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ldgriokdfsuh.nafis330.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004350; classtype:social-engineering; sid:6004350; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.xupqfhz.one/uqjmw)"; flow:established,to_server; http.uri; content:"/uqjmw"; startswith; fast_pattern; http.host; content:"usps.xupqfhz.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004351; classtype:social-engineering; sid:6004351; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iglarchiv.de/kolkmanncourtbuilder)"; flow:established,to_server; http.uri; content:"/kolkmanncourtbuilder"; startswith; fast_pattern; http.host; content:"iglarchiv.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004352; classtype:social-engineering; sid:6004352; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticuo.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-noticuo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004353; classtype:social-engineering; sid:6004353; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (livemeetcall.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"livemeetcall.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004354; classtype:social-engineering; sid:6004354; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.agipk.com/gphaincdaa/)"; flow:established,to_server; http.uri; content:"/gphaincdaa/"; startswith; fast_pattern; http.host; content:"www.agipk.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004355; classtype:social-engineering; sid:6004355; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (php-f658chpassproseconect.wasmer.app/login.php)"; flow:established,to_server; http.uri; content:"/login.php"; startswith; fast_pattern; http.host; content:"php-f658chpassproseconect.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004356; classtype:social-engineering; sid:6004356; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kgv-schoener-fleck.de/Hettena)"; flow:established,to_server; http.uri; content:"/Hettena"; startswith; fast_pattern; http.host; content:"kgv-schoener-fleck.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004357; classtype:social-engineering; sid:6004357; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kwahbv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kwahbv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004358; classtype:social-engineering; sid:6004358; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (luckykaashyap-design.github.io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"luckykaashyap-design.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004359; classtype:social-engineering; sid:6004359; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (caseid-1605plkqzm.integradatalink.com/public/index?ref=business-support-center-DASDFDSYUYEE43FJDSHFSDFsetting%25popup%3fclient_id=889943718806-ual26tplnot2ea8b7n5t4p77keo8eb)"; flow:established,to_server; http.uri; content:"/public/index?ref=business-support-center-DASDFDSYUYEE43FJDSHFSDFsetting%25popup%3fclient_id=889943718806-ual26tplnot2ea8b7n5t4p77keo8eb"; startswith; fast_pattern; http.host; content:"caseid-1605plkqzm.integradatalink.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004360; classtype:social-engineering; sid:6004360; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dl103aksjdb2-slgnin-primember.wilertvision.com/sahklrjqs/asvlaks/mobile/index.php)"; flow:established,to_server; http.uri; content:"/sahklrjqs/asvlaks/mobile/index.php"; startswith; fast_pattern; http.host; content:"dl103aksjdb2-slgnin-primember.wilertvision.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004361; classtype:social-engineering; sid:6004361; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecortbabylon.site/meet/asda)"; flow:established,to_server; http.uri; content:"/meet/asda"; startswith; fast_pattern; http.host; content:"ecortbabylon.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004362; classtype:social-engineering; sid:6004362; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kpvcgw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kpvcgw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004363; classtype:social-engineering; sid:6004363; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rpmlsg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rpmlsg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004364; classtype:social-engineering; sid:6004364; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lnruae.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lnruae.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004365; classtype:social-engineering; sid:6004365; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hwkvgo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hwkvgo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004366; classtype:social-engineering; sid:6004366; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stilles-oertchen.de/HomeWell)"; flow:established,to_server; http.uri; content:"/HomeWell"; startswith; fast_pattern; http.host; content:"stilles-oertchen.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004367; classtype:social-engineering; sid:6004367; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (novaselecaodeaumento.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"novaselecaodeaumento.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004368; classtype:social-engineering; sid:6004368; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.seplan.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.seplan.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004369; classtype:social-engineering; sid:6004369; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ali-bharde.github.io/netflix-landing-page-clone/)"; flow:established,to_server; http.uri; content:"/netflix-landing-page-clone/"; startswith; fast_pattern; http.host; content:"ali-bharde.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004370; classtype:social-engineering; sid:6004370; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.cyzpre.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.cyzpre.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004371; classtype:social-engineering; sid:6004371; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflixclone-mu-nine.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflixclone-mu-nine.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004372; classtype:social-engineering; sid:6004372; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.raoitk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.raoitk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004373; classtype:social-engineering; sid:6004373; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.aokrvp.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.aokrvp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004374; classtype:social-engineering; sid:6004374; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ads-media.busines-help-center.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ads-media.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004375; classtype:social-engineering; sid:6004375; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ubqrhm.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ubqrhm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004376; classtype:social-engineering; sid:6004376; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (much-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"much-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004377; classtype:social-engineering; sid:6004377; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gifting-stean.lat/id=5947221648)"; flow:established,to_server; http.uri; content:"/id=5947221648"; startswith; fast_pattern; http.host; content:"gifting-stean.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004378; classtype:social-engineering; sid:6004378; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.idgvje.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.idgvje.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004379; classtype:social-engineering; sid:6004379; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecortbabylon.site/gmail/asdasd)"; flow:established,to_server; http.uri; content:"/gmail/asdasd"; startswith; fast_pattern; http.host; content:"ecortbabylon.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004380; classtype:social-engineering; sid:6004380; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecortbabylon.site/cashpin)"; flow:established,to_server; http.uri; content:"/cashpin"; startswith; fast_pattern; http.host; content:"ecortbabylon.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004381; classtype:social-engineering; sid:6004381; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (picture-ads-202665.pages.dev/facebook.com-id-00463710)"; flow:established,to_server; http.uri; content:"/facebook.com-id-00463710"; startswith; fast_pattern; http.host; content:"picture-ads-202665.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004382; classtype:social-engineering; sid:6004382; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sonhealtopoisavidanaoexistelimit.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"sonhealtopoisavidanaoexistelimit.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004383; classtype:social-engineering; sid:6004383; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.njblkf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.njblkf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004384; classtype:social-engineering; sid:6004384; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortle.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortle.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004385; classtype:social-engineering; sid:6004385; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gotivu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gotivu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004386; classtype:social-engineering; sid:6004386; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.xupqhwx.one/uqjmw)"; flow:established,to_server; http.uri; content:"/uqjmw"; startswith; fast_pattern; http.host; content:"usps.xupqhwx.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004387; classtype:social-engineering; sid:6004387; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (live-join-gooqle-meet.4-c4.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"live-join-gooqle-meet.4-c4.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004388; classtype:social-engineering; sid:6004388; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (selecaoaumento.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"selecaoaumento.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004389; classtype:social-engineering; sid:6004389; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecortbabylon.site/live/test)"; flow:established,to_server; http.uri; content:"/live/test"; startswith; fast_pattern; http.host; content:"ecortbabylon.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004390; classtype:social-engineering; sid:6004390; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kylarsec.github.io/Netflix-Landing-Page)"; flow:established,to_server; http.uri; content:"/Netflix-Landing-Page"; startswith; fast_pattern; http.host; content:"kylarsec.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004391; classtype:social-engineering; sid:6004391; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hyattregencylondonthechurchill.spahotel.guru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hyattregencylondonthechurchill.spahotel.guru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004392; classtype:social-engineering; sid:6004392; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.utdfmq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.utdfmq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004393; classtype:social-engineering; sid:6004393; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ultravioletoaumento01.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"ultravioletoaumento01.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004394; classtype:social-engineering; sid:6004394; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (waseem-kanhio.github.io/Final-PITP-Project-Fully-Functional-E-Commerce-Website/)"; flow:established,to_server; http.uri; content:"/Final-PITP-Project-Fully-Functional-E-Commerce-Website/"; startswith; fast_pattern; http.host; content:"waseem-kanhio.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004395; classtype:social-engineering; sid:6004395; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qorin-selav-biz-melix-vator-nd11kt12.pages.dev/form_submit_appeal/)"; flow:established,to_server; http.uri; content:"/form_submit_appeal/"; startswith; fast_pattern; http.host; content:"qorin-selav-biz-melix-vator-nd11kt12.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004396; classtype:social-engineering; sid:6004396; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bet365k11.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bet365k11.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004397; classtype:social-engineering; sid:6004397; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.nlhgy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.nlhgy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004398; classtype:social-engineering; sid:6004398; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apparent-performance-639513.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"apparent-performance-639513.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004399; classtype:social-engineering; sid:6004399; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kleinanzeigen.alasolar.com/680580836193?mail=W0FOQUZFTUFd&meta=rlWjMKWwLJ50LJqyVwb1YPWhLJ1yVwbvKUIxBQAxKUIxLmN5VRShLJMyoJRvYPWwnTS0K2yxVwbgZGNjZmH4ZQHmZwVmBFjvp2IlqzywMFV6VzgfMJyhLJ56MJyaMJ4vYPW0rKOyVwbvLJ5uMzIgLI9gLJyfVa0%3D)"; flow:established,to_server; http.uri; content:"/680580836193?mail=W0FOQUZFTUFd&meta=rlWjMKWwLJ50LJqyVwb1YPWhLJ1yVwbvKUIxBQAxKUIxLmN5VRShLJMyoJRvYPWwnTS0K2yxVwbgZGNjZmH4ZQHmZwVmBFjvp2IlqzywMFV6VzgfMJyhLJ56MJyaMJ4vYPW0rKOyVwbvLJ5uMzIgLI9gLJyfVa0%3D"; startswith; fast_pattern; http.host; content:"kleinanzeigen.alasolar.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004400; classtype:social-engineering; sid:6004400; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appreciative-village-712980.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"appreciative-village-712980.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004401; classtype:social-engineering; sid:6004401; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (outlookfortrks.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"outlookfortrks.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004402; classtype:social-engineering; sid:6004402; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (khemaissia.urge843284.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"khemaissia.urge843284.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004403; classtype:social-engineering; sid:6004403; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (forgiving-world-449987.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"forgiving-world-449987.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004404; classtype:social-engineering; sid:6004404; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abdel.urge843284.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"abdel.urge843284.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004405; classtype:social-engineering; sid:6004405; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bpiiggeon.wixstudio.com/my-site)"; flow:established,to_server; http.uri; content:"/my-site"; startswith; fast_pattern; http.host; content:"bpiiggeon.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004406; classtype:social-engineering; sid:6004406; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.urge843284.pro/capchat.php)"; flow:established,to_server; http.uri; content:"/capchat.php"; startswith; fast_pattern; http.host; content:"www.urge843284.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004407; classtype:social-engineering; sid:6004407; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secureeverwlsehelpdesk.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secureeverwlsehelpdesk.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004408; classtype:social-engineering; sid:6004408; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (issam.urge843284.pro/capchat.php)"; flow:established,to_server; http.uri; content:"/capchat.php"; startswith; fast_pattern; http.host; content:"issam.urge843284.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004409; classtype:social-engineering; sid:6004409; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (silly-room-839538.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"silly-room-839538.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004410; classtype:social-engineering; sid:6004410; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (caixaconsultachat.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"caixaconsultachat.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004411; classtype:social-engineering; sid:6004411; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (playful-griffin-463442.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"playful-griffin-463442.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004412; classtype:social-engineering; sid:6004412; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lavender-panther-878662.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lavender-panther-878662.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004413; classtype:social-engineering; sid:6004413; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (insp-upmc6.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"insp-upmc6.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004414; classtype:social-engineering; sid:6004414; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ca-app-988.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ca-app-988.info"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004415; classtype:social-engineering; sid:6004415; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xnxx.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xnxx.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004416; classtype:social-engineering; sid:6004416; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (most-video-685262.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"most-video-685262.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004417; classtype:social-engineering; sid:6004417; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ca-app-940.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ca-app-940.info"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004418; classtype:social-engineering; sid:6004418; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (att-managementt.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"att-managementt.framer.website"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004419; classtype:social-engineering; sid:6004419; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (andres823arehy.hstn.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"andres823arehy.hstn.me"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004420; classtype:social-engineering; sid:6004420; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rotating-channels-629685.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rotating-channels-629685.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004421; classtype:social-engineering; sid:6004421; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ca-app-913.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ca-app-913.info"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004422; classtype:social-engineering; sid:6004422; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (contasecuredadminportalupdate.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"contasecuredadminportalupdate.framer.website"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004423; classtype:social-engineering; sid:6004423; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (formulario-digital-arfd-2026.cr-web.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"formulario-digital-arfd-2026.cr-web.workers.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004424; classtype:social-engineering; sid:6004424; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bncri.cc/cr)"; flow:established,to_server; http.uri; content:"/cr"; startswith; fast_pattern; http.host; content:"bncri.cc"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004425; classtype:social-engineering; sid:6004425; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bplnet.help/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bplnet.help"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004426; classtype:social-engineering; sid:6004426; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (youssef.urge843284.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"youssef.urge843284.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004427; classtype:social-engineering; sid:6004427; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (internalrevenue.us/?id=a1062e8c-584f-4bb5-8371-86af7ea92e61)"; flow:established,to_server; http.uri; content:"/?id=a1062e8c-584f-4bb5-8371-86af7ea92e61"; startswith; fast_pattern; http.host; content:"internalrevenue.us"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004428; classtype:social-engineering; sid:6004428; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ca-app-838.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ca-app-838.info"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004429; classtype:social-engineering; sid:6004429; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ca-app-523.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ca-app-523.info"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004430; classtype:social-engineering; sid:6004430; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jmu-it-team.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jmu-it-team.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004431; classtype:social-engineering; sid:6004431; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (youssef.urge843284.pro/capchat.php)"; flow:established,to_server; http.uri; content:"/capchat.php"; startswith; fast_pattern; http.host; content:"youssef.urge843284.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004432; classtype:social-engineering; sid:6004432; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dkdmynusndacv.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dkdmynusndacv.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004433; classtype:social-engineering; sid:6004433; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chartreuse-fox-501659.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"chartreuse-fox-501659.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004434; classtype:social-engineering; sid:6004434; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (skatterefusion-nemlog-in.wp1.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"skatterefusion-nemlog-in.wp1.sh"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004435; classtype:social-engineering; sid:6004435; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ca-app-310.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ca-app-310.info"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004436; classtype:social-engineering; sid:6004436; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (modernsolutionsllc.com/sw1/#email@email.com)"; flow:established,to_server; http.uri; content:"/sw1/#email@email.com"; startswith; fast_pattern; http.host; content:"modernsolutionsllc.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004437; classtype:social-engineering; sid:6004437; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secondary-consistency-365647.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secondary-consistency-365647.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004438; classtype:social-engineering; sid:6004438; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ybu-edu-tr.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ybu-edu-tr.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004439; classtype:social-engineering; sid:6004439; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ca-app-594.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ca-app-594.info"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004440; classtype:social-engineering; sid:6004440; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xn--b1aaayjbpfcbcaamtigkfwg3h0dp1b0q.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xn--b1aaayjbpfcbcaamtigkfwg3h0dp1b0q.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004441; classtype:social-engineering; sid:6004441; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (202.137.141.244/am.html)"; flow:established,to_server; http.uri; content:"/am.html"; startswith; fast_pattern; http.host; content:"202.137.141.244"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004442; classtype:social-engineering; sid:6004442; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oapdldcidmdo.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"oapdldcidmdo.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004443; classtype:social-engineering; sid:6004443; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member011.agency-partner-request.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member011.agency-partner-request.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004444; classtype:social-engineering; sid:6004444; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rational-delivers-637567.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rational-delivers-637567.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004445; classtype:social-engineering; sid:6004445; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (silverstarwebmail.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"silverstarwebmail.framer.website"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004446; classtype:social-engineering; sid:6004446; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paypay-card.zrddwlc.cn/fingerprint.php)"; flow:established,to_server; http.uri; content:"/fingerprint.php"; startswith; fast_pattern; http.host; content:"paypay-card.zrddwlc.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004447; classtype:social-engineering; sid:6004447; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (order456.top/view/states)"; flow:established,to_server; http.uri; content:"/view/states"; startswith; fast_pattern; http.host; content:"order456.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004448; classtype:social-engineering; sid:6004448; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cold-pink-kpkgjzddyi.edgeone.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cold-pink-kpkgjzddyi.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004449; classtype:social-engineering; sid:6004449; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mazobloxx.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mazobloxx.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004450; classtype:social-engineering; sid:6004450; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (linn-eska.de/tuxk1yh/zgil1jk/ordhig1/jloda/0utFix/Mr_Khan/index2.php)"; flow:established,to_server; http.uri; content:"/tuxk1yh/zgil1jk/ordhig1/jloda/0utFix/Mr_Khan/index2.php"; startswith; fast_pattern; http.host; content:"linn-eska.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004451; classtype:social-engineering; sid:6004451; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (govausinboxsecurealert.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"govausinboxsecurealert.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004452; classtype:social-engineering; sid:6004452; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xpnklrvbq.ink/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.xpnklrvbq.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004453; classtype:social-engineering; sid:6004453; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.amazon-clone-jade-eight.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazon-clone-jade-eight.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004454; classtype:social-engineering; sid:6004454; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bifrostpolicyreview.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bifrostpolicyreview.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004455; classtype:social-engineering; sid:6004455; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portail-swiss.com/pages/ban.php)"; flow:established,to_server; http.uri; content:"/pages/ban.php"; startswith; fast_pattern; http.host; content:"portail-swiss.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004456; classtype:social-engineering; sid:6004456; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paulamis.github.io/Amazon-clone-Website)"; flow:established,to_server; http.uri; content:"/Amazon-clone-Website"; startswith; fast_pattern; http.host; content:"paulamis.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004457; classtype:social-engineering; sid:6004457; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (evelyn-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"evelyn-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004458; classtype:social-engineering; sid:6004458; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aceelpartnersasia.us-mia-1.linodeobjects.com/checker%20copy.html)"; flow:established,to_server; http.uri; content:"/checker%20copy.html"; startswith; fast_pattern; http.host; content:"aceelpartnersasia.us-mia-1.linodeobjects.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004459; classtype:social-engineering; sid:6004459; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.wa-cn-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.wa-cn-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004460; classtype:social-engineering; sid:6004460; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fb10076534676569-8uifqumrprdhjsh4vuref9.vercel.app/mde565hertwhytrh4fdsx.html)"; flow:established,to_server; http.uri; content:"/mde565hertwhytrh4fdsx.html"; startswith; fast_pattern; http.host; content:"fb10076534676569-8uifqumrprdhjsh4vuref9.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004461; classtype:social-engineering; sid:6004461; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web.henry-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web.henry-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004462; classtype:social-engineering; sid:6004462; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inquisitive-harlequin-pxzutp6w7h.edgeone.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"inquisitive-harlequin-pxzutp6w7h.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004463; classtype:social-engineering; sid:6004463; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (media-support.busines-help-center.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"media-support.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004464; classtype:social-engineering; sid:6004464; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gokul-unni93.github.io/Facebook-login-signup/)"; flow:established,to_server; http.uri; content:"/Facebook-login-signup/"; startswith; fast_pattern; http.host; content:"gokul-unni93.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004465; classtype:social-engineering; sid:6004465; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (testman2.dothome.co.kr/login1.php)"; flow:established,to_server; http.uri; content:"/login1.php"; startswith; fast_pattern; http.host; content:"testman2.dothome.co.kr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004466; classtype:social-engineering; sid:6004466; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.padisahbetgiris-mobi.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.padisahbetgiris-mobi.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004467; classtype:social-engineering; sid:6004467; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bdvingresoseguro-d8cxc3dngdgmbwaa.canadacentral-01.azurewebsites.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bdvingresoseguro-d8cxc3dngdgmbwaa.canadacentral-01.azurewebsites.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004468; classtype:social-engineering; sid:6004468; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.yqjvan.top/pay?uWA=QAQh2?iXl=ycaZ1)"; flow:established,to_server; http.uri; content:"/pay?uWA=QAQh2?iXl=ycaZ1"; startswith; fast_pattern; http.host; content:"t-mobile.yqjvan.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004469; classtype:social-engineering; sid:6004469; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ylutrp.top/pay?KwB=n1w4a?Srb=K32zd)"; flow:established,to_server; http.uri; content:"/pay?KwB=n1w4a?Srb=K32zd"; startswith; fast_pattern; http.host; content:"t-mobile.ylutrp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004470; classtype:social-engineering; sid:6004470; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.pc-web-zh-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app.pc-web-zh-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004471; classtype:social-engineering; sid:6004471; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.danaid.7xb.web.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.danaid.7xb.web.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004472; classtype:social-engineering; sid:6004472; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pm-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pm-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004473; classtype:social-engineering; sid:6004473; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tbnkpvrlq.club/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.tbnkpvrlq.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004474; classtype:social-engineering; sid:6004474; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wss.michael-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wss.michael-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004475; classtype:social-engineering; sid:6004475; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.yqkplrvbn.club/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.yqkplrvbn.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004476; classtype:social-engineering; sid:6004476; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apps.mia-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"apps.mia-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004477; classtype:social-engineering; sid:6004477; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (memodd.github.io/My-Portfolio-Project-1-Netflix-UI-Clone/)"; flow:established,to_server; http.uri; content:"/My-Portfolio-Project-1-Netflix-UI-Clone/"; startswith; fast_pattern; http.host; content:"memodd.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004478; classtype:social-engineering; sid:6004478; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nl-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nl-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004479; classtype:social-engineering; sid:6004479; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-delta-five.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-delta-five.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004480; classtype:social-engineering; sid:6004480; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zhanduoduo.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zhanduoduo.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004481; classtype:social-engineering; sid:6004481; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (conwedd.com/lanka/korea.html)"; flow:established,to_server; http.uri; content:"/lanka/korea.html"; startswith; fast_pattern; http.host; content:"conwedd.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004482; classtype:social-engineering; sid:6004482; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreifgreyc6gcuevnbwg2yyahzyxbmizerjql4bprnnpy2tfh5aqa5ka.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreifgreyc6gcuevnbwg2yyahzyxbmizerjql4bprnnpy2tfh5aqa5ka.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004483; classtype:social-engineering; sid:6004483; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bloxfit.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bloxfit.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004484; classtype:social-engineering; sid:6004484; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (service-boncoin.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"service-boncoin.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004485; classtype:social-engineering; sid:6004485; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yashi1204.github.io/Project1)"; flow:established,to_server; http.uri; content:"/Project1"; startswith; fast_pattern; http.host; content:"yashi1204.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004486; classtype:social-engineering; sid:6004486; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.padisahbetresmi.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.padisahbetresmi.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004487; classtype:social-engineering; sid:6004487; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (centerr.b-cdn.net/11a.html?eta=seriklab@d76fe1ccfd9e472cb98f1cc64278bad9f28a.com)"; flow:established,to_server; http.uri; content:"/11a.html?eta=seriklab@d76fe1ccfd9e472cb98f1cc64278bad9f28a.com"; startswith; fast_pattern; http.host; content:"centerr.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004488; classtype:social-engineering; sid:6004488; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafybeicaewgymopbegfhghz7q4fn2fiv7w23w3m5z4vwrxcilbbhcyxgue.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafybeicaewgymopbegfhghz7q4fn2fiv7w23w3m5z4vwrxcilbbhcyxgue.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004489; classtype:social-engineering; sid:6004489; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mfacebock.com.vn/khoa-hoc-7-ngay-trai-nghiem-kien-thuc-toan?a)"; flow:established,to_server; http.uri; content:"/khoa-hoc-7-ngay-trai-nghiem-kien-thuc-toan?a"; startswith; fast_pattern; http.host; content:"mfacebock.com.vn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004490; classtype:social-engineering; sid:6004490; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.wa-web-zh-pc-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app.wa-web-zh-pc-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004491; classtype:social-engineering; sid:6004491; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ethan-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ethan-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004492; classtype:social-engineering; sid:6004492; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b27x.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b27x.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004493; classtype:social-engineering; sid:6004493; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.spoitfypayments.fratellibettoni.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.spoitfypayments.fratellibettoni.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004494; classtype:social-engineering; sid:6004494; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whatsapp-ui-clone-9uuq.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whatsapp-ui-clone-9uuq.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004495; classtype:social-engineering; sid:6004495; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (freasw.github.io/Attacthment-DO/Document%20off)"; flow:established,to_server; http.uri; content:"/Attacthment-DO/Document%20off"; startswith; fast_pattern; http.host; content:"freasw.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004496; classtype:social-engineering; sid:6004496; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pdfprotected-doc-kitsune-22feb6.netlify.app/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"pdfprotected-doc-kitsune-22feb6.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004497; classtype:social-engineering; sid:6004497; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robuxdeals.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"robuxdeals.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004498; classtype:social-engineering; sid:6004498; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreidbm5v2ktexj4a6rt7bnmfk6yy337fqy3gpxirvrhh66e3gtgcu7u.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreidbm5v2ktexj4a6rt7bnmfk6yy337fqy3gpxirvrhh66e3gtgcu7u.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004499; classtype:social-engineering; sid:6004499; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fand-whatsapp.com.cn/wp-admin/includes/misc.php)"; flow:established,to_server; http.uri; content:"/wp-admin/includes/misc.php"; startswith; fast_pattern; http.host; content:"www.fand-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004500; classtype:social-engineering; sid:6004500; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moresimplicis.com/Lt1RrIul3s)"; flow:established,to_server; http.uri; content:"/Lt1RrIul3s"; startswith; fast_pattern; http.host; content:"moresimplicis.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004501; classtype:social-engineering; sid:6004501; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (super.vipfb.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"super.vipfb.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004502; classtype:social-engineering; sid:6004502; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (holdup-app-io.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"holdup-app-io.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004503; classtype:social-engineering; sid:6004503; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (viewdocc.com/44/Android/pdf.php)"; flow:established,to_server; http.uri; content:"/44/Android/pdf.php"; startswith; fast_pattern; http.host; content:"viewdocc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004504; classtype:social-engineering; sid:6004504; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (asdwspotify.beer/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"asdwspotify.beer"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004505; classtype:social-engineering; sid:6004505; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (capitalone.zhygr.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"capitalone.zhygr.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004506; classtype:social-engineering; sid:6004506; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiamshk3z7tdum4vus7rfss7am77apsb5ahyk2xej4z4slsf3emyne.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiamshk3z7tdum4vus7rfss7am77apsb5ahyk2xej4z4slsf3emyne.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004507; classtype:social-engineering; sid:6004507; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.program-resmi27.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.program-resmi27.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004508; classtype:social-engineering; sid:6004508; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-delta-five.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-delta-five.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004509; classtype:social-engineering; sid:6004509; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.game-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.game-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004510; classtype:social-engineering; sid:6004510; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dolvux.today/po)"; flow:established,to_server; http.uri; content:"/po"; startswith; fast_pattern; http.host; content:"dolvux.today"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004511; classtype:social-engineering; sid:6004511; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee116.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopee116.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004512; classtype:social-engineering; sid:6004512; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreih6ziryyz37frw2uf4bikvjrio7dmspmbqbhau6sgcs5cjrxdketa.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreih6ziryyz37frw2uf4bikvjrio7dmspmbqbhau6sgcs5cjrxdketa.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004513; classtype:social-engineering; sid:6004513; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kpjvbnqrl.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.kpjvbnqrl.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004514; classtype:social-engineering; sid:6004514; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cn-hgn-web-whatsapp.com.cn/wp-includes/widgets/class-wp-widget-rss.php)"; flow:established,to_server; http.uri; content:"/wp-includes/widgets/class-wp-widget-rss.php"; startswith; fast_pattern; http.host; content:"www.cn-hgn-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004515; classtype:social-engineering; sid:6004515; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web.lps-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web.lps-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004516; classtype:social-engineering; sid:6004516; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m9bdlf-ghfi0s-8u3-mx38j-jj2gx.netlify.app/welcome_aboard)"; flow:established,to_server; http.uri; content:"/welcome_aboard"; startswith; fast_pattern; http.host; content:"m9bdlf-ghfi0s-8u3-mx38j-jj2gx.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004517; classtype:social-engineering; sid:6004517; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.roblox-canjear.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.roblox-canjear.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004518; classtype:social-engineering; sid:6004518; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info.natalie-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"info.natalie-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004519; classtype:social-engineering; sid:6004519; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-hadiah975.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-hadiah975.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004520; classtype:social-engineering; sid:6004520; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail.secureinvestingonline.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"webmail.secureinvestingonline.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004521; classtype:social-engineering; sid:6004521; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zbopfa.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zbopfa.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004522; classtype:social-engineering; sid:6004522; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info.lucas-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"info.lucas-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004523; classtype:social-engineering; sid:6004523; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.cxmvtrqpl.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.cxmvtrqpl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004524; classtype:social-engineering; sid:6004524; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jump6223.vip/Mobile/index.html)"; flow:established,to_server; http.uri; content:"/Mobile/index.html"; startswith; fast_pattern; http.host; content:"jump6223.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004525; classtype:social-engineering; sid:6004525; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info.ethan-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"info.ethan-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004526; classtype:social-engineering; sid:6004526; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.austin-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.austin-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004527; classtype:social-engineering; sid:6004527; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (samuel-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"samuel-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004528; classtype:social-engineering; sid:6004528; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nadhr.nadqa.nadsoft.co/in/domainindex.html?eta=valus@1ec41150695ef97d5b52fca408c563a08473.com)"; flow:established,to_server; http.uri; content:"/in/domainindex.html?eta=valus@1ec41150695ef97d5b52fca408c563a08473.com"; startswith; fast_pattern; http.host; content:"nadhr.nadqa.nadsoft.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004529; classtype:social-engineering; sid:6004529; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spoitfypayments.fratellibettoni.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spoitfypayments.fratellibettoni.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004530; classtype:social-engineering; sid:6004530; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zbgryj.top/pay?OKT=78jIs?khU=0hpX1)"; flow:established,to_server; http.uri; content:"/pay?OKT=78jIs?khU=0hpX1"; startswith; fast_pattern; http.host; content:"t-mobile.zbgryj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004531; classtype:social-engineering; sid:6004531; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.webmehk-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app.webmehk-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004532; classtype:social-engineering; sid:6004532; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.hvxqtrmpl.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.hvxqtrmpl.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004533; classtype:social-engineering; sid:6004533; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hacher666.github.io/Ff)"; flow:established,to_server; http.uri; content:"/Ff"; startswith; fast_pattern; http.host; content:"hacher666.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004534; classtype:social-engineering; sid:6004534; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xrecnp.top/pay?JnC=274za?pUk=yK03J)"; flow:established,to_server; http.uri; content:"/pay?JnC=274za?pUk=yK03J"; startswith; fast_pattern; http.host; content:"t-mobile.xrecnp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004535; classtype:social-engineering; sid:6004535; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.apple-clone-flame.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.apple-clone-flame.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004536; classtype:social-engineering; sid:6004536; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp-ui-clone-9uuq.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp-ui-clone-9uuq.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004537; classtype:social-engineering; sid:6004537; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.sjslag.cc/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.sjslag.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004538; classtype:social-engineering; sid:6004538; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mia-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mia-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004539; classtype:social-engineering; sid:6004539; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zbgryj.top/pay?jDw=LJd9T?Zwh=HozFz)"; flow:established,to_server; http.uri; content:"/pay?jDw=LJd9T?Zwh=HozFz"; startswith; fast_pattern; http.host; content:"t-mobile.zbgryj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004540; classtype:social-engineering; sid:6004540; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (barclaysnetfraudhub.com/home/index.php)"; flow:established,to_server; http.uri; content:"/home/index.php"; startswith; fast_pattern; http.host; content:"barclaysnetfraudhub.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004541; classtype:social-engineering; sid:6004541; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.web-hkk-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app.web-hkk-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004542; classtype:social-engineering; sid:6004542; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rklpqvbzn.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.rklpqvbzn.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004543; classtype:social-engineering; sid:6004543; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.nqlkvrpmb.club/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.nqlkvrpmb.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004544; classtype:social-engineering; sid:6004544; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreifnivhbvpt4lmyejgjihpdtdkvcblvdhq6d7bs7zowgmtygobvdvy.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreifnivhbvpt4lmyejgjihpdtdkvcblvdhq6d7bs7zowgmtygobvdvy.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004545; classtype:social-engineering; sid:6004545; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flexnite.world/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"flexnite.world"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004546; classtype:social-engineering; sid:6004546; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.investment.cs-clientlogin.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.investment.cs-clientlogin.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004547; classtype:social-engineering; sid:6004547; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (divasbhandari.com.np/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"divasbhandari.com.np"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004548; classtype:social-engineering; sid:6004548; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jesauvelasecu.info/PL-1466-160526/[email%C2%A0protected])"; flow:established,to_server; http.uri; content:"/PL-1466-160526/[email%C2%A0protected]"; startswith; fast_pattern; http.host; content:"jesauvelasecu.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004549; classtype:social-engineering; sid:6004549; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en-meta.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"en-meta.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004550; classtype:social-engineering; sid:6004550; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ryan-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ryan-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004551; classtype:social-engineering; sid:6004551; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yud1xpin.brandc.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yud1xpin.brandc.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004552; classtype:social-engineering; sid:6004552; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cold-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cold-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004553; classtype:social-engineering; sid:6004553; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (exclusivedsessiondrop4.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"exclusivedsessiondrop4.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004554; classtype:social-engineering; sid:6004554; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (natalie-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"natalie-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004555; classtype:social-engineering; sid:6004555; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.ykplrqvbn.club/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.ykplrqvbn.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004556; classtype:social-engineering; sid:6004556; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedagiodigital-mu.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pedagiodigital-mu.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004557; classtype:social-engineering; sid:6004557; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreif73y3altm73krdreakpmyu73ehkkgv67exp2kssx6wjq7va7li5u.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreif73y3altm73krdreakpmyu73ehkkgv67exp2kssx6wjq7va7li5u.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004558; classtype:social-engineering; sid:6004558; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgrr-liive-downld.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledgrr-liive-downld.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004559; classtype:social-engineering; sid:6004559; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web.wa-cn-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web.wa-cn-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004560; classtype:social-engineering; sid:6004560; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wyflsphj1jdwj.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wyflsphj1jdwj.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004561; classtype:social-engineering; sid:6004561; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.voxera.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.voxera.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004562; classtype:social-engineering; sid:6004562; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cctv-whatsapp.com.cn/wp-admin/customize/class-wp-customize-code-editor-control.php)"; flow:established,to_server; http.uri; content:"/wp-admin/customize/class-wp-customize-code-editor-control.php"; startswith; fast_pattern; http.host; content:"www.cctv-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004563; classtype:social-engineering; sid:6004563; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (michael-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"michael-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004564; classtype:social-engineering; sid:6004564; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apps.ella-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"apps.ella-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004565; classtype:social-engineering; sid:6004565; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (scale.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"scale.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004566; classtype:social-engineering; sid:6004566; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info.avery-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"info.avery-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004567; classtype:social-engineering; sid:6004567; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.url-tracker.com/14ff53/)"; flow:established,to_server; http.uri; content:"/14ff53/"; startswith; fast_pattern; http.host; content:"www.url-tracker.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004568; classtype:social-engineering; sid:6004568; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.yklrpqvbn.club/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.yklrpqvbn.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004569; classtype:social-engineering; sid:6004569; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sdtiiktok.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.sdtiiktok.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004570; classtype:social-engineering; sid:6004570; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vewmic.top/pay?DoA=PaJur?JjY=IPjs9)"; flow:established,to_server; http.uri; content:"/pay?DoA=PaJur?JjY=IPjs9"; startswith; fast_pattern; http.host; content:"t-mobile.vewmic.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004571; classtype:social-engineering; sid:6004571; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (balnavex-biz-pranqelori-hdp18526.netlify.app/guyywl-fdfscx-lkljhjh)"; flow:established,to_server; http.uri; content:"/guyywl-fdfscx-lkljhjh"; startswith; fast_pattern; http.host; content:"balnavex-biz-pranqelori-hdp18526.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004572; classtype:social-engineering; sid:6004572; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wxvayn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wxvayn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004573; classtype:social-engineering; sid:6004573; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zaaex-xxen.github.io/Web-Act/)"; flow:established,to_server; http.uri; content:"/Web-Act/"; startswith; fast_pattern; http.host; content:"zaaex-xxen.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004574; classtype:social-engineering; sid:6004574; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (grace-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"grace-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004575; classtype:social-engineering; sid:6004575; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tutoriales.appmicasita.com/app/)"; flow:established,to_server; http.uri; content:"/app/"; startswith; fast_pattern; http.host; content:"tutoriales.appmicasita.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004576; classtype:social-engineering; sid:6004576; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aroomwithaview.co.za/zxcvbnmnsdfglkmn/robot.html?eta=lanensys@4f5a2307580e99aac4b335d35afe243bf499.org)"; flow:established,to_server; http.uri; content:"/zxcvbnmnsdfglkmn/robot.html?eta=lanensys@4f5a2307580e99aac4b335d35afe243bf499.org"; startswith; fast_pattern; http.host; content:"aroomwithaview.co.za"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004577; classtype:social-engineering; sid:6004577; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.yqjvan.top/pay?ElX=Djcv1?Kyg=fB4lP)"; flow:established,to_server; http.uri; content:"/pay?ElX=Djcv1?Kyg=fB4lP"; startswith; fast_pattern; http.host; content:"t-mobile.yqjvan.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004578; classtype:social-engineering; sid:6004578; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ws-hk-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ws-hk-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004579; classtype:social-engineering; sid:6004579; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (program-resmi27.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"program-resmi27.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004580; classtype:social-engineering; sid:6004580; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-business-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-business-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004581; classtype:social-engineering; sid:6004581; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (masterminddev007.github.io/Netflix-clone)"; flow:established,to_server; http.uri; content:"/Netflix-clone"; startswith; fast_pattern; http.host; content:"masterminddev007.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004582; classtype:social-engineering; sid:6004582; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m9bdlf-ghfi0s-8u3-mx38j-jj2gx.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m9bdlf-ghfi0s-8u3-mx38j-jj2gx.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004583; classtype:social-engineering; sid:6004583; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.gjasju.click/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.gjasju.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004584; classtype:social-engineering; sid:6004584; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jesauvelasecu.info/PL-1466-160526/?u=17C1466&e=belos@e054e1faa8bf6f7025366019611ff7b93538.com&s3=Paulina&s4=Stanaszek&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/PL-1466-160526/?u=17C1466&e=belos@e054e1faa8bf6f7025366019611ff7b93538.com&s3=Paulina&s4=Stanaszek&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"jesauvelasecu.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004585; classtype:social-engineering; sid:6004585; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsssapp.cc/bdced5d3ec/s9d1i2modc)"; flow:established,to_server; http.uri; content:"/bdced5d3ec/s9d1i2modc"; startswith; fast_pattern; http.host; content:"whatsssapp.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004586; classtype:social-engineering; sid:6004586; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.ynkkvm.buzz/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.ynkkvm.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004587; classtype:social-engineering; sid:6004587; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.zqklrpvbn.club/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.zqklrpvbn.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004588; classtype:social-engineering; sid:6004588; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.jotform.com/app/261203194631146)"; flow:established,to_server; http.uri; content:"/app/261203194631146"; startswith; fast_pattern; http.host; content:"www.jotform.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004589; classtype:social-engineering; sid:6004589; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apps.ethan-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"apps.ethan-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004590; classtype:social-engineering; sid:6004590; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebooks.com.vn/Qla4ovQxKCj?a&l)"; flow:established,to_server; http.uri; content:"/Qla4ovQxKCj?a&l"; startswith; fast_pattern; http.host; content:"facebooks.com.vn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004591; classtype:social-engineering; sid:6004591; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apps.michael-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"apps.michael-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004592; classtype:social-engineering; sid:6004592; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-acorn.pages.dev/appeals/submit-appeal-form/return/)"; flow:established,to_server; http.uri; content:"/appeals/submit-appeal-form/return/"; startswith; fast_pattern; http.host; content:"meta-acorn.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004593; classtype:social-engineering; sid:6004593; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apple-clone-flame.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"apple-clone-flame.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004594; classtype:social-engineering; sid:6004594; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xmdnwh.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.xmdnwh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004595; classtype:social-engineering; sid:6004595; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.fnklrpvbn.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.fnklrpvbn.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004596; classtype:social-engineering; sid:6004596; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spotify-clone-project-ashy.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spotify-clone-project-ashy.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004597; classtype:social-engineering; sid:6004597; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.onzntokshopro.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.onzntokshopro.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004598; classtype:social-engineering; sid:6004598; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portail-swiss.com/pages/carte.php)"; flow:established,to_server; http.uri; content:"/pages/carte.php"; startswith; fast_pattern; http.host; content:"portail-swiss.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004599; classtype:social-engineering; sid:6004599; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (joseph-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"joseph-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004600; classtype:social-engineering; sid:6004600; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-kappa-ashen.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-kappa-ashen.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004601; classtype:social-engineering; sid:6004601; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t.securefile.co.uk/xc107251229/164184/7668c6e1-46a1-421f-bebe-95f7f0e997d1)"; flow:established,to_server; http.uri; content:"/xc107251229/164184/7668c6e1-46a1-421f-bebe-95f7f0e997d1"; startswith; fast_pattern; http.host; content:"t.securefile.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004602; classtype:social-engineering; sid:6004602; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dvksjh.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.dvksjh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004603; classtype:social-engineering; sid:6004603; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth-upheld-en.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auth-upheld-en.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004604; classtype:social-engineering; sid:6004604; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.coimwbaswprowlogw.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.coimwbaswprowlogw.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004605; classtype:social-engineering; sid:6004605; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqznwklpta.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.rqznwklpta.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004606; classtype:social-engineering; sid:6004606; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.stt.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.stt.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004607; classtype:social-engineering; sid:6004607; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreib5mrjwebbo6zkl2aobv4ttc77b2uhi3m4p7lammiu6eszfbw7hgi.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreib5mrjwebbo6zkl2aobv4ttc77b2uhi3m4p7lammiu6eszfbw7hgi.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004608; classtype:social-engineering; sid:6004608; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (barclaysnetfraud.com/home/index.php)"; flow:established,to_server; http.uri; content:"/home/index.php"; startswith; fast_pattern; http.host; content:"barclaysnetfraud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004609; classtype:social-engineering; sid:6004609; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (battery-support-ledger-livelogin-e7.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"battery-support-ledger-livelogin-e7.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004610; classtype:social-engineering; sid:6004610; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (revo188.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"revo188.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004611; classtype:social-engineering; sid:6004611; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qevun-naril-biz-helav-siron-nd11kt12.pages.dev/heartily_welcome?id=113021338880750&page_name=Tuttle's%20Trucking%20&%20Recycling%20Inc)"; flow:established,to_server; http.uri; content:"/heartily_welcome?id=113021338880750&page_name=Tuttle's%20Trucking%20&%20Recycling%20Inc"; startswith; fast_pattern; http.host; content:"qevun-naril-biz-helav-siron-nd11kt12.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004612; classtype:social-engineering; sid:6004612; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (andrew-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"andrew-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004613; classtype:social-engineering; sid:6004613; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (viewdocc.com/44/Android/)"; flow:established,to_server; http.uri; content:"/44/Android/"; startswith; fast_pattern; http.host; content:"viewdocc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004614; classtype:social-engineering; sid:6004614; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shporingtfilesasnxmdocsxexaelamdhx.pages.dev/ndex/)"; flow:established,to_server; http.uri; content:"/ndex/"; startswith; fast_pattern; http.host; content:"shporingtfilesasnxmdocsxexaelamdhx.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004615; classtype:social-engineering; sid:6004615; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezorwaallet.github.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezorwaallet.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004616; classtype:social-engineering; sid:6004616; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vedrajmeghwanshi1996-byte.github.io/instagram-clone)"; flow:established,to_server; http.uri; content:"/instagram-clone"; startswith; fast_pattern; http.host; content:"vedrajmeghwanshi1996-byte.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004617; classtype:social-engineering; sid:6004617; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.img-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.img-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004618; classtype:social-engineering; sid:6004618; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (taofangzhe.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"taofangzhe.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004619; classtype:social-engineering; sid:6004619; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xiandianzhineng.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xiandianzhineng.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004620; classtype:social-engineering; sid:6004620; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gridqueue-datapoint.pages.dev/welcome_to_meta_for_business/)"; flow:established,to_server; http.uri; content:"/welcome_to_meta_for_business/"; startswith; fast_pattern; http.host; content:"gridqueue-datapoint.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004621; classtype:social-engineering; sid:6004621; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-login-whatsapp-hl.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-login-whatsapp-hl.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004622; classtype:social-engineering; sid:6004622; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee838.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopee838.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004623; classtype:social-engineering; sid:6004623; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.qx-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.qx-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004624; classtype:social-engineering; sid:6004624; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgerwalletcn.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledgerwalletcn.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004625; classtype:social-engineering; sid:6004625; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (linn-eska.de/tuxk1yh/zgil1jk/ordhig1/jloda/0utFix/Mr_Khan/)"; flow:established,to_server; http.uri; content:"/tuxk1yh/zgil1jk/ordhig1/jloda/0utFix/Mr_Khan/"; startswith; fast_pattern; http.host; content:"linn-eska.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004626; classtype:social-engineering; sid:6004626; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qurnelun-biz-lorqerami-crv13525.netlify.app/guyywl-fdfscx-lkljhjh)"; flow:established,to_server; http.uri; content:"/guyywl-fdfscx-lkljhjh"; startswith; fast_pattern; http.host; content:"qurnelun-biz-lorqerami-crv13525.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004627; classtype:social-engineering; sid:6004627; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-whatsapp-hl.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"info-whatsapp-hl.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004628; classtype:social-engineering; sid:6004628; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coimwbaswprowlogw.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coimwbaswprowlogw.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004629; classtype:social-engineering; sid:6004629; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.insta-react-clone.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.insta-react-clone.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004630; classtype:social-engineering; sid:6004630; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hilfe-meine-dkb.de.ignorelist.com/Login/DE/Meine/dkb/login.php)"; flow:established,to_server; http.uri; content:"/Login/DE/Meine/dkb/login.php"; startswith; fast_pattern; http.host; content:"hilfe-meine-dkb.de.ignorelist.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004631; classtype:social-engineering; sid:6004631; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafybeieoullhdrh7jhqegwvwnyshy5nidikrtbju77pe3ma4cbq5oq3lpm.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafybeieoullhdrh7jhqegwvwnyshy5nidikrtbju77pe3ma4cbq5oq3lpm.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004632; classtype:social-engineering; sid:6004632; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nowayeco.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nowayeco.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004633; classtype:social-engineering; sid:6004633; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee838.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopee838.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004634; classtype:social-engineering; sid:6004634; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oyster-app-gm48s.ondigitalocean.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"oyster-app-gm48s.ondigitalocean.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004635; classtype:social-engineering; sid:6004635; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9-160-8-163.cprapid.com/pl/update.php?7uihi9s6o1gkgyhdujzq)"; flow:established,to_server; http.uri; content:"/pl/update.php?7uihi9s6o1gkgyhdujzq"; startswith; fast_pattern; http.host; content:"9-160-8-163.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004636; classtype:social-engineering; sid:6004636; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.en-meta.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.en-meta.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004637; classtype:social-engineering; sid:6004637; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fish-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fish-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004638; classtype:social-engineering; sid:6004638; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.fxqmvtrpl.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.fxqmvtrpl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004639; classtype:social-engineering; sid:6004639; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mctsqk.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.mctsqk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004640; classtype:social-engineering; sid:6004640; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wdigkx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wdigkx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004641; classtype:social-engineering; sid:6004641; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-jade-eight.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-jade-eight.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004642; classtype:social-engineering; sid:6004642; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-notictv.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-notictv.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004643; classtype:social-engineering; sid:6004643; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iportalcontactus.com/home/index.php)"; flow:established,to_server; http.uri; content:"/home/index.php"; startswith; fast_pattern; http.host; content:"iportalcontactus.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004644; classtype:social-engineering; sid:6004644; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee116.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopee116.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004645; classtype:social-engineering; sid:6004645; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktifkaan-paylatterr.dwfg.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktifkaan-paylatterr.dwfg.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004646; classtype:social-engineering; sid:6004646; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticuw.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-noticuw.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004647; classtype:social-engineering; sid:6004647; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.investment.cs-clientlogin.com/login.php)"; flow:established,to_server; http.uri; content:"/login.php"; startswith; fast_pattern; http.host; content:"www.investment.cs-clientlogin.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004648; classtype:social-engineering; sid:6004648; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamaskwallett.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metamaskwallett.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004649; classtype:social-engineering; sid:6004649; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-hadiah975.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"info-hadiah975.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004650; classtype:social-engineering; sid:6004650; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rahulkrs9142.github.io/Amazon-Clone)"; flow:established,to_server; http.uri; content:"/Amazon-Clone"; startswith; fast_pattern; http.host; content:"rahulkrs9142.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004651; classtype:social-engineering; sid:6004651; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (findmyiphone.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"findmyiphone.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004652; classtype:social-engineering; sid:6004652; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0223656.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"0223656.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004653; classtype:social-engineering; sid:6004653; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bestwesternburnskensgton.spahotel.guru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bestwesternburnskensgton.spahotel.guru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004654; classtype:social-engineering; sid:6004654; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wss.edge-fast-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wss.edge-fast-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004655; classtype:social-engineering; sid:6004655; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ylvscm.top/pay?YoF=tGRXS?SWB=ZBqUu)"; flow:established,to_server; http.uri; content:"/pay?YoF=tGRXS?SWB=ZBqUu"; startswith; fast_pattern; http.host; content:"t-mobile.ylvscm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004656; classtype:social-engineering; sid:6004656; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (glowintl.com/Velify/d0cu3.html?eta=kelos7@2ba5774bcf4caf1c193c9be409dfb6a5b436.com)"; flow:established,to_server; http.uri; content:"/Velify/d0cu3.html?eta=kelos7@2ba5774bcf4caf1c193c9be409dfb6a5b436.com"; startswith; fast_pattern; http.host; content:"glowintl.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004657; classtype:social-engineering; sid:6004657; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dipu-ray.github.io/netflix-clone)"; flow:established,to_server; http.uri; content:"/netflix-clone"; startswith; fast_pattern; http.host; content:"dipu-ray.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004658; classtype:social-engineering; sid:6004658; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info.eleanor-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"info.eleanor-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004659; classtype:social-engineering; sid:6004659; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail.secureinvestingonline.com/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"webmail.secureinvestingonline.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004660; classtype:social-engineering; sid:6004660; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.act-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.act-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004661; classtype:social-engineering; sid:6004661; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (caitlinduffus.com/wp-admin/net/safe.html)"; flow:established,to_server; http.uri; content:"/wp-admin/net/safe.html"; startswith; fast_pattern; http.host; content:"caitlinduffus.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004662; classtype:social-engineering; sid:6004662; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1webmail-free.clients-2.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"1webmail-free.clients-2.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004663; classtype:social-engineering; sid:6004663; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-mercadodeofertastododia.myshopify.com/products/maquina-de-lavar-14kg-essential-care-led14-com-cesto-inox-e-jet-clean-electrolux?utm_source=copyToPasteBoard&\;utm_medium=product-links&\;utm_content=web)"; flow:established,to_server; http.uri; content:"/products/maquina-de-lavar-14kg-essential-care-led14-com-cesto-inox-e-jet-clean-electrolux?utm_source=copyToPasteBoard&|3b|utm_medium=product-links&|3b|utm_content=web"; startswith; fast_pattern; http.host; content:"app-mercadodeofertastododia.myshopify.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004664; classtype:social-engineering; sid:6004664; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (societe-generale.bolt.host/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"societe-generale.bolt.host"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004665; classtype:social-engineering; sid:6004665; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ambitious-expectations-648653.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ambitious-expectations-648653.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004666; classtype:social-engineering; sid:6004666; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (annulation-socgen.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"annulation-socgen.duckdns.org"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004667; classtype:social-engineering; sid:6004667; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kleinanzeigen.lin999.com/561315605488?mail=W1lPVVJd&meta=rlWjMKWwLJ50LJqyVwb1YPWhLJ1yVwbvKUHlAmL0KUIzMGOzVSyiqKVtGJScoTIlVvjvL2uuqS9cMPV6YGRjZQV5Zmt2AGt0ZGDfVaAypaMcL2HvBvWeoTIcozShrzIcM2IhVvjvqUyjMFV6Vz1unJkypy9jpz8vsD==)"; flow:established,to_server; http.uri; content:"/561315605488?mail=W1lPVVJd&meta=rlWjMKWwLJ50LJqyVwb1YPWhLJ1yVwbvKUHlAmL0KUIzMGOzVSyiqKVtGJScoTIlVvjvL2uuqS9cMPV6YGRjZQV5Zmt2AGt0ZGDfVaAypaMcL2HvBvWeoTIcozShrzIcM2IhVvjvqUyjMFV6Vz1unJkypy9jpz8vsD=="; startswith; fast_pattern; http.host; content:"kleinanzeigen.lin999.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004668; classtype:social-engineering; sid:6004668; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gov-lrs.theleaftable.com/irs/)"; flow:established,to_server; http.uri; content:"/irs/"; startswith; fast_pattern; http.host; content:"gov-lrs.theleaftable.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004669; classtype:social-engineering; sid:6004669; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (newcomer-slide-843980.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"newcomer-slide-843980.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004670; classtype:social-engineering; sid:6004670; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kleinanzeigen.lin999.com/547810614774?mail=W0NBVENIXQ%3D%3D&meta=rlWjMKWwLJ50LJqyVwb1YPWhLJ1yVwbvKUHlAzRkKUIzMGOzVRAuqTAbGJHtGJScoTIlVvjvL2uuqS9cMPV6YGRjZQV5BQLkZmt0ZGNfVaAypaMcL2HvBvWeoTIcozShrzIcM2IhVvjvqUyjMFV6VzAuqTAboJIsoJScoPW9)"; flow:established,to_server; http.uri; content:"/547810614774?mail=W0NBVENIXQ%3D%3D&meta=rlWjMKWwLJ50LJqyVwb1YPWhLJ1yVwbvKUHlAzRkKUIzMGOzVRAuqTAbGJHtGJScoTIlVvjvL2uuqS9cMPV6YGRjZQV5BQLkZmt0ZGNfVaAypaMcL2HvBvWeoTIcozShrzIcM2IhVvjvqUyjMFV6VzAuqTAboJIsoJScoPW9"; startswith; fast_pattern; http.host; content:"kleinanzeigen.lin999.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004671; classtype:social-engineering; sid:6004671; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp31443.sitebeat.crazydomains.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp31443.sitebeat.crazydomains.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004672; classtype:social-engineering; sid:6004672; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agreeable-benefits-553922.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"agreeable-benefits-553922.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004673; classtype:social-engineering; sid:6004673; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kleinanzeigen.436kb.com/839022332894?mail=W1lPVVJd&meta=rlWjMKWwLJ50LJqyVwb1YPWhLJ1yVwbvKUHlAmL0KUIzMGOzVSyiqKVtGJScoTIlVvjvL2uuqS9cMPV6YGRjZQV5Zmt2AGt0ZGDfVaAypaMcL2HvBvWeoTIcozShrzIcM2IhVvjvqUyjMFV6Vz1unJkypy9jpz8vsD==)"; flow:established,to_server; http.uri; content:"/839022332894?mail=W1lPVVJd&meta=rlWjMKWwLJ50LJqyVwb1YPWhLJ1yVwbvKUHlAmL0KUIzMGOzVSyiqKVtGJScoTIlVvjvL2uuqS9cMPV6YGRjZQV5Zmt2AGt0ZGDfVaAypaMcL2HvBvWeoTIcozShrzIcM2IhVvjvqUyjMFV6Vz1unJkypy9jpz8vsD=="; startswith; fast_pattern; http.host; content:"kleinanzeigen.436kb.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004674; classtype:social-engineering; sid:6004674; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (protivityy.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"protivityy.framer.website"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004675; classtype:social-engineering; sid:6004675; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (supportmailapp.2bd.net/lignesfr-clients/)"; flow:established,to_server; http.uri; content:"/lignesfr-clients/"; startswith; fast_pattern; http.host; content:"supportmailapp.2bd.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004676; classtype:social-engineering; sid:6004676; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dgfctxrhx324345464.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dgfctxrhx324345464.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004677; classtype:social-engineering; sid:6004677; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (serase-rho.vercel.app/cpf/)"; flow:established,to_server; http.uri; content:"/cpf/"; startswith; fast_pattern; http.host; content:"serase-rho.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004678; classtype:social-engineering; sid:6004678; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suporteparapj.digital/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"suporteparapj.digital"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004679; classtype:social-engineering; sid:6004679; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oettv-test.xttv.at/error/404-file-not-found.html)"; flow:established,to_server; http.uri; content:"/error/404-file-not-found.html"; startswith; fast_pattern; http.host; content:"oettv-test.xttv.at"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004680; classtype:social-engineering; sid:6004680; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (little-diversity-796529.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"little-diversity-796529.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004681; classtype:social-engineering; sid:6004681; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (annulationvirement.duckdns.org/index.php)"; flow:established,to_server; http.uri; content:"/index.php"; startswith; fast_pattern; http.host; content:"annulationvirement.duckdns.org"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004682; classtype:social-engineering; sid:6004682; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (generatorindustriesstatement.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"generatorindustriesstatement.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004683; classtype:social-engineering; sid:6004683; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (braxziloutlo.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"braxziloutlo.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004684; classtype:social-engineering; sid:6004684; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bradescobia.acesso-seguro.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bradescobia.acesso-seguro.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004685; classtype:social-engineering; sid:6004685; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (socgen-annulationvirement.duckdns.org/index.php)"; flow:established,to_server; http.uri; content:"/index.php"; startswith; fast_pattern; http.host; content:"socgen-annulationvirement.duckdns.org"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004686; classtype:social-engineering; sid:6004686; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp132994.sitebeat.crazydomains.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp132994.sitebeat.crazydomains.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004687; classtype:social-engineering; sid:6004687; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sgenerale.bolt.host/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"sgenerale.bolt.host"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004688; classtype:social-engineering; sid:6004688; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support-ufcuaccess.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"support-ufcuaccess.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004689; classtype:social-engineering; sid:6004689; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (formulario-digital-anmkl-2026.cr-web.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"formulario-digital-anmkl-2026.cr-web.workers.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004690; classtype:social-engineering; sid:6004690; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bonailspatra.gr/services/)"; flow:established,to_server; http.uri; content:"/services/"; startswith; fast_pattern; http.host; content:"bonailspatra.gr"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004691; classtype:social-engineering; sid:6004691; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (skt-1601.twil.io/skatdk)"; flow:established,to_server; http.uri; content:"/skatdk"; startswith; fast_pattern; http.host; content:"skt-1601.twil.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004692; classtype:social-engineering; sid:6004692; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ambitious-heart-410388.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ambitious-heart-410388.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004693; classtype:social-engineering; sid:6004693; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verificacionemail2026.github.io/activar)"; flow:established,to_server; http.uri; content:"/activar"; startswith; fast_pattern; http.host; content:"verificacionemail2026.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004694; classtype:social-engineering; sid:6004694; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aerfsertgsrtgsrtghdfghdghd.framer.wiki/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aerfsertgsrtgsrtghdfghdghd.framer.wiki"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004695; classtype:social-engineering; sid:6004695; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pretty-planet-359858.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pretty-planet-359858.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004696; classtype:social-engineering; sid:6004696; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (avanchange.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"avanchange.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004697; classtype:social-engineering; sid:6004697; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (twcbcommncatnwmaltwcbcc.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"twcbcommncatnwmaltwcbcc.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004698; classtype:social-engineering; sid:6004698; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (beige-home-031048.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"beige-home-031048.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004699; classtype:social-engineering; sid:6004699; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-mercadollivreofertas.myshopify.com/products/micro-ondas-electrolux-inox-23l-efficient-me23s?utm_source=organic&\;amp%3Butm_campaign=&\;amp%3Butm_medium=&\;amp%3Butm_content=&\;amp%3Butm_term=)"; flow:established,to_server; http.uri; content:"/products/micro-ondas-electrolux-inox-23l-efficient-me23s?utm_source=organic&|3b|amp%3Butm_campaign=&|3b|amp%3Butm_medium=&|3b|amp%3Butm_content=&|3b|amp%3Butm_term="; startswith; fast_pattern; http.host; content:"app-mercadollivreofertas.myshopify.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004700; classtype:social-engineering; sid:6004700; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (papa-change.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"papa-change.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004701; classtype:social-engineering; sid:6004701; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (domainrenew-notice.com/at-26/)"; flow:established,to_server; http.uri; content:"/at-26/"; startswith; fast_pattern; http.host; content:"domainrenew-notice.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004702; classtype:social-engineering; sid:6004702; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticiq.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticiq.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004703; classtype:social-engineering; sid:6004703; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticir.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticir.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004704; classtype:social-engineering; sid:6004704; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.pl-58917895612.lat/oferta/84532061/gopro-hero-)"; flow:established,to_server; http.uri; content:"/oferta/84532061/gopro-hero-"; startswith; fast_pattern; http.host; content:"allegrolokalnie.pl-58917895612.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004705; classtype:social-engineering; sid:6004705; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (securee-uphlde.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"securee-uphlde.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004706; classtype:social-engineering; sid:6004706; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nice-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nice-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004707; classtype:social-engineering; sid:6004707; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oc-google.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"oc-google.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004708; classtype:social-engineering; sid:6004708; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticya.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticya.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004709; classtype:social-engineering; sid:6004709; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cs-portalhub.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cs-portalhub.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004710; classtype:social-engineering; sid:6004710; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vintagevoltageengineering.com/GrowingContigoLLC/KennethLinares.html)"; flow:established,to_server; http.uri; content:"/GrowingContigoLLC/KennethLinares.html"; startswith; fast_pattern; http.host; content:"vintagevoltageengineering.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004711; classtype:social-engineering; sid:6004711; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xqvnlprkb.ink/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.xqvnlprkb.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004712; classtype:social-engineering; sid:6004712; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (solucionesdigitales-pchincha.zya.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"solucionesdigitales-pchincha.zya.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004713; classtype:social-engineering; sid:6004713; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.xupqcnyt.one/uqjmw)"; flow:established,to_server; http.uri; content:"/uqjmw"; startswith; fast_pattern; http.host; content:"usps.xupqcnyt.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004714; classtype:social-engineering; sid:6004714; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticyu.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticyu.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004715; classtype:social-engineering; sid:6004715; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cdifa.b-cdn.net/all1.html?eta=norishub@b5c6eb47fa7f7e71ff937b47b9732d11f498.com)"; flow:established,to_server; http.uri; content:"/all1.html?eta=norishub@b5c6eb47fa7f7e71ff937b47b9732d11f498.com"; startswith; fast_pattern; http.host; content:"cdifa.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004716; classtype:social-engineering; sid:6004716; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sio.fondsvergleiche.info/?app_vl=ZoRwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=solenpro@0df6a874ff1366ca9fdd1fed2d38c988aaa9.org&sui=%7Bsui%7D&fn=&ln=&p=1&z=PLNONARAW-2005-Dig09)"; flow:established,to_server; http.uri; content:"/?app_vl=ZoRwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=solenpro@0df6a874ff1366ca9fdd1fed2d38c988aaa9.org&sui=%7Bsui%7D&fn=&ln=&p=1&z=PLNONARAW-2005-Dig09"; startswith; fast_pattern; http.host; content:"sio.fondsvergleiche.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004717; classtype:social-engineering; sid:6004717; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.api-edge-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.api-edge-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004718; classtype:social-engineering; sid:6004718; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticyq.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticyq.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004719; classtype:social-engineering; sid:6004719; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (best-for-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"best-for-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004720; classtype:social-engineering; sid:6004720; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.xupqcudw.one/uqjmw)"; flow:established,to_server; http.uri; content:"/uqjmw"; startswith; fast_pattern; http.host; content:"usps.xupqcudw.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004721; classtype:social-engineering; sid:6004721; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (scenario.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"scenario.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004722; classtype:social-engineering; sid:6004722; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.flickapply.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.flickapply.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004723; classtype:social-engineering; sid:6004723; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.enefort.lol/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.enefort.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004724; classtype:social-engineering; sid:6004724; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticys.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticys.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004725; classtype:social-engineering; sid:6004725; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticuj.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticuj.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004726; classtype:social-engineering; sid:6004726; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticyo.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-noticyo.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004727; classtype:social-engineering; sid:6004727; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticys.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticys.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004728; classtype:social-engineering; sid:6004728; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.n0suewqcmn.vx-whatsapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.n0suewqcmn.vx-whatsapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004729; classtype:social-engineering; sid:6004729; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (steamcommunnlty.com/profiles/76526266363628)"; flow:established,to_server; http.uri; content:"/profiles/76526266363628"; startswith; fast_pattern; http.host; content:"steamcommunnlty.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004730; classtype:social-engineering; sid:6004730; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticyt.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticyt.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004731; classtype:social-engineering; sid:6004731; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stceamcommuniity.com/code/34569244)"; flow:established,to_server; http.uri; content:"/code/34569244"; startswith; fast_pattern; http.host; content:"stceamcommuniity.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004732; classtype:social-engineering; sid:6004732; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cdn-b-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cdn-b-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004733; classtype:social-engineering; sid:6004733; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store.communitystartchart.shop/workshop/AK47-EternalDecay/)"; flow:established,to_server; http.uri; content:"/workshop/AK47-EternalDecay/"; startswith; fast_pattern; http.host; content:"store.communitystartchart.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004734; classtype:social-engineering; sid:6004734; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7173123126.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7173123126.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004735; classtype:social-engineering; sid:6004735; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail-onehealth-ca-groupoffice-9o6ir1yhw8.edgeone.cool/?eo_token=238510098ee7cc9b20bc115694c7bfe9&eo_time=1779313563)"; flow:established,to_server; http.uri; content:"/?eo_token=238510098ee7cc9b20bc115694c7bfe9&eo_time=1779313563"; startswith; fast_pattern; http.host; content:"webmail-onehealth-ca-groupoffice-9o6ir1yhw8.edgeone.cool"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004736; classtype:social-engineering; sid:6004736; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.yvlrqnm.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.yvlrqnm.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004737; classtype:social-engineering; sid:6004737; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticus.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticus.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004738; classtype:social-engineering; sid:6004738; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.yvlxnqr.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.yvlxnqr.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004739; classtype:social-engineering; sid:6004739; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (q-r.to/bgoHDU)"; flow:established,to_server; http.uri; content:"/bgoHDU"; startswith; fast_pattern; http.host; content:"q-r.to"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004740; classtype:social-engineering; sid:6004740; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-accc003cda5e4254b1e0228215d6bca5.r2.dev/update/Newserver_index.html?eta=pdgxsywgl@lulwytu.jsj)"; flow:established,to_server; http.uri; content:"/update/Newserver_index.html?eta=pdgxsywgl@lulwytu.jsj"; startswith; fast_pattern; http.host; content:"pub-accc003cda5e4254b1e0228215d6bca5.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004741; classtype:social-engineering; sid:6004741; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (concerned-ways-888011.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"concerned-ways-888011.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004742; classtype:social-engineering; sid:6004742; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (local.inner.website/p0c2bd279q09d74cec089afe3c8o21c5a8fc.html)"; flow:established,to_server; http.uri; content:"/p0c2bd279q09d74cec089afe3c8o21c5a8fc.html"; startswith; fast_pattern; http.host; content:"local.inner.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004743; classtype:social-engineering; sid:6004743; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web.sign-in-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web.sign-in-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004744; classtype:social-engineering; sid:6004744; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dhikolimetr.eu.heke8460.odns.fr/DhhL/)"; flow:established,to_server; http.uri; content:"/DhhL/"; startswith; fast_pattern; http.host; content:"dhikolimetr.eu.heke8460.odns.fr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004745; classtype:social-engineering; sid:6004745; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (u17a.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"u17a.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004746; classtype:social-engineering; sid:6004746; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.xupqdfnn.one/uqjmw/)"; flow:established,to_server; http.uri; content:"/uqjmw/"; startswith; fast_pattern; http.host; content:"usps.xupqdfnn.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004747; classtype:social-engineering; sid:6004747; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticuw.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticuw.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004748; classtype:social-engineering; sid:6004748; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (proud-advocate-494268.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"proud-advocate-494268.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004749; classtype:social-engineering; sid:6004749; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bet365casinoplay.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bet365casinoplay.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004750; classtype:social-engineering; sid:6004750; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-a77375725cbe4ebebbbb725baa062262.r2.dev/aw.html)"; flow:established,to_server; http.uri; content:"/aw.html"; startswith; fast_pattern; http.host; content:"pub-a77375725cbe4ebebbbb725baa062262.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004751; classtype:social-engineering; sid:6004751; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qrcode-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qrcode-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004752; classtype:social-engineering; sid:6004752; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.xupquvv.one/uqjmw)"; flow:established,to_server; http.uri; content:"/uqjmw"; startswith; fast_pattern; http.host; content:"usps.xupquvv.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004753; classtype:social-engineering; sid:6004753; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pro-lesi.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pro-lesi.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004754; classtype:social-engineering; sid:6004754; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gentle-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.gentle-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004755; classtype:social-engineering; sid:6004755; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticuh.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticuh.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004756; classtype:social-engineering; sid:6004756; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pure-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pure-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004757; classtype:social-engineering; sid:6004757; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.xupqouv.one/uqjmw)"; flow:established,to_server; http.uri; content:"/uqjmw"; startswith; fast_pattern; http.host; content:"usps.xupqouv.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004758; classtype:social-engineering; sid:6004758; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (media-network.busines-help-center.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"media-network.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004759; classtype:social-engineering; sid:6004759; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (social-media.busines-help-center.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"social-media.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004760; classtype:social-engineering; sid:6004760; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.qtrpkzn.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.qtrpkzn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004761; classtype:social-engineering; sid:6004761; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (freeus.club/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"freeus.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004762; classtype:social-engineering; sid:6004762; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inventcheker.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"inventcheker.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004763; classtype:social-engineering; sid:6004763; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web.api-cdn-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web.api-cdn-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004764; classtype:social-engineering; sid:6004764; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.onstudies.co.ke/wins.html)"; flow:established,to_server; http.uri; content:"/wins.html"; startswith; fast_pattern; http.host; content:"www.onstudies.co.ke"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004765; classtype:social-engineering; sid:6004765; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ul9ay.kukuwalk.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ul9ay.kukuwalk.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004766; classtype:social-engineering; sid:6004766; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (seunovolimitepreenchido.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"seunovolimitepreenchido.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004767; classtype:social-engineering; sid:6004767; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (desbloqueiototal.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"desbloqueiototal.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004768; classtype:social-engineering; sid:6004768; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (security.refund-meta-manage.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"security.refund-meta-manage.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004769; classtype:social-engineering; sid:6004769; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticyj.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticyj.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004770; classtype:social-engineering; sid:6004770; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticiq.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticiq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004771; classtype:social-engineering; sid:6004771; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (contact-on-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"contact-on-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004772; classtype:social-engineering; sid:6004772; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.yxplqnr.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.yxplqnr.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004773; classtype:social-engineering; sid:6004773; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whats-u-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whats-u-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004774; classtype:social-engineering; sid:6004774; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticyi.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticyi.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004775; classtype:social-engineering; sid:6004775; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (super-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"super-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004776; classtype:social-engineering; sid:6004776; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verificaa.iceiy.com/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"verificaa.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004777; classtype:social-engineering; sid:6004777; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (api.powerups.club/external-share/attachments/KS2PAgSrdyWBT_uB)"; flow:established,to_server; http.uri; content:"/external-share/attachments/KS2PAgSrdyWBT_uB"; startswith; fast_pattern; http.host; content:"api.powerups.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004778; classtype:social-engineering; sid:6004778; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dhikolimetr.eu.heke8460.odns.fr/DhhL/auth/index.php)"; flow:established,to_server; http.uri; content:"/DhhL/auth/index.php"; startswith; fast_pattern; http.host; content:"dhikolimetr.eu.heke8460.odns.fr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004779; classtype:social-engineering; sid:6004779; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.metamaskwallett.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.metamaskwallett.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004780; classtype:social-engineering; sid:6004780; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (q-r.to/bgoniM)"; flow:established,to_server; http.uri; content:"/bgoniM"; startswith; fast_pattern; http.host; content:"q-r.to"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004781; classtype:social-engineering; sid:6004781; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (httpss-www-roblox.co/users/474771747/profile)"; flow:established,to_server; http.uri; content:"/users/474771747/profile"; startswith; fast_pattern; http.host; content:"httpss-www-roblox.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004782; classtype:social-engineering; sid:6004782; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vintagevoltageengineering.com/AssociatedBuildingSupplyInc/AshleyCurtiss.html)"; flow:established,to_server; http.uri; content:"/AssociatedBuildingSupplyInc/AshleyCurtiss.html"; startswith; fast_pattern; http.host; content:"vintagevoltageengineering.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004783; classtype:social-engineering; sid:6004783; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.qvnrkbl.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.qvnrkbl.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004784; classtype:social-engineering; sid:6004784; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (insightfulconsultants.co.uk/ram)"; flow:established,to_server; http.uri; content:"/ram"; startswith; fast_pattern; http.host; content:"insightfulconsultants.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004785; classtype:social-engineering; sid:6004785; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-35312b95baf4482f8dd1d6c35e6943a1.r2.dev/mnbvasd.html)"; flow:established,to_server; http.uri; content:"/mnbvasd.html"; startswith; fast_pattern; http.host; content:"pub-35312b95baf4482f8dd1d6c35e6943a1.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004786; classtype:social-engineering; sid:6004786; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticyq.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticyq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004787; classtype:social-engineering; sid:6004787; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wdu-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wdu-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004788; classtype:social-engineering; sid:6004788; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ufitinema34.github.io/host/)"; flow:established,to_server; http.uri; content:"/host/"; startswith; fast_pattern; http.host; content:"ufitinema34.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004789; classtype:social-engineering; sid:6004789; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (modareysalon.com/springlakegolfclub/Jacqui.html)"; flow:established,to_server; http.uri; content:"/springlakegolfclub/Jacqui.html"; startswith; fast_pattern; http.host; content:"modareysalon.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004790; classtype:social-engineering; sid:6004790; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wordpress-211743-0.cloudclusters.net/UUT5Z/swisspass-sbb/mind/)"; flow:established,to_server; http.uri; content:"/UUT5Z/swisspass-sbb/mind/"; startswith; fast_pattern; http.host; content:"wordpress-211743-0.cloudclusters.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004791; classtype:social-engineering; sid:6004791; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.xupqnqz.one/uqjmw)"; flow:established,to_server; http.uri; content:"/uqjmw"; startswith; fast_pattern; http.host; content:"usps.xupqnqz.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004792; classtype:social-engineering; sid:6004792; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqznplwqtwk.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.rqznplwqtwk.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004793; classtype:social-engineering; sid:6004793; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (casaluna.spahotel.guru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"casaluna.spahotel.guru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004794; classtype:social-engineering; sid:6004794; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (murvux.today/pl/)"; flow:established,to_server; http.uri; content:"/pl/"; startswith; fast_pattern; http.host; content:"murvux.today"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004795; classtype:social-engineering; sid:6004795; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (scenario.wasmer.app/foodkick)"; flow:established,to_server; http.uri; content:"/foodkick"; startswith; fast_pattern; http.host; content:"scenario.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004796; classtype:social-engineering; sid:6004796; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticie.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticie.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004797; classtype:social-engineering; sid:6004797; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e-devlet-portal-giris.haksizfil.cfd/login.php)"; flow:established,to_server; http.uri; content:"/login.php"; startswith; fast_pattern; http.host; content:"e-devlet-portal-giris.haksizfil.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004798; classtype:social-engineering; sid:6004798; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticie.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticie.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004799; classtype:social-engineering; sid:6004799; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kukuwalk.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kukuwalk.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004800; classtype:social-engineering; sid:6004800; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web.static-cdn-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web.static-cdn-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004801; classtype:social-engineering; sid:6004801; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (supportsinstagram.github.io/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"supportsinstagram.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004802; classtype:social-engineering; sid:6004802; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (q-r.to/bgo3cy)"; flow:established,to_server; http.uri; content:"/bgo3cy"; startswith; fast_pattern; http.host; content:"q-r.to"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004803; classtype:social-engineering; sid:6004803; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qpguaxianshiyongzaifukuan.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qpguaxianshiyongzaifukuan.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004804; classtype:social-engineering; sid:6004804; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (binance-trade.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"binance-trade.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004805; classtype:social-engineering; sid:6004805; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (teresaardley.github.io/adobe.comaccess-onedrive-files.html/)"; flow:established,to_server; http.uri; content:"/adobe.comaccess-onedrive-files.html/"; startswith; fast_pattern; http.host; content:"teresaardley.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004806; classtype:social-engineering; sid:6004806; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eezls.kukuwalk.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eezls.kukuwalk.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004807; classtype:social-engineering; sid:6004807; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (emspro.co.za/logs/index%20(4).html)"; flow:established,to_server; http.uri; content:"/logs/index%20(4).html"; startswith; fast_pattern; http.host; content:"emspro.co.za"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004808; classtype:social-engineering; sid:6004808; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hotelredroofinn.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hotelredroofinn.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004809; classtype:social-engineering; sid:6004809; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pro-for-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pro-for-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004810; classtype:social-engineering; sid:6004810; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticux.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticux.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004811; classtype:social-engineering; sid:6004811; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (16405.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"16405.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004812; classtype:social-engineering; sid:6004812; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hub-for-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hub-for-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004813; classtype:social-engineering; sid:6004813; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (classy-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"classy-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004814; classtype:social-engineering; sid:6004814; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whats-hk-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whats-hk-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004815; classtype:social-engineering; sid:6004815; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.global-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.global-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004816; classtype:social-engineering; sid:6004816; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vintagevoltageengineering.com/SeanHummer/modernmethodroofing.html)"; flow:established,to_server; http.uri; content:"/SeanHummer/modernmethodroofing.html"; startswith; fast_pattern; http.host; content:"vintagevoltageengineering.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004817; classtype:social-engineering; sid:6004817; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (check-in-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"check-in-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004818; classtype:social-engineering; sid:6004818; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.yqvknpl.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.yqvknpl.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004819; classtype:social-engineering; sid:6004819; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticuk.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticuk.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004820; classtype:social-engineering; sid:6004820; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (azure-radish-625972.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"azure-radish-625972.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004821; classtype:social-engineering; sid:6004821; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vintagevoltageengineering.com/intercityequitycorp/corilynnlivingstoneopendocaccess.html)"; flow:established,to_server; http.uri; content:"/intercityequitycorp/corilynnlivingstoneopendocaccess.html"; startswith; fast_pattern; http.host; content:"vintagevoltageengineering.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004822; classtype:social-engineering; sid:6004822; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vibrant-help-732270.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vibrant-help-732270.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004823; classtype:social-engineering; sid:6004823; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.lpkzqvfrn.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.lpkzqvfrn.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004824; classtype:social-engineering; sid:6004824; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (on.get-whatsapp-now.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"on.get-whatsapp-now.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004825; classtype:social-engineering; sid:6004825; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-notictx.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-notictx.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004826; classtype:social-engineering; sid:6004826; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (top-for-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"top-for-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004827; classtype:social-engineering; sid:6004827; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (text-on-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"text-on-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004828; classtype:social-engineering; sid:6004828; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticef.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticef.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004829; classtype:social-engineering; sid:6004829; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vintagevoltageengineering.com/garyandrews/websterexpress.html)"; flow:established,to_server; http.uri; content:"/garyandrews/websterexpress.html"; startswith; fast_pattern; http.host; content:"vintagevoltageengineering.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004830; classtype:social-engineering; sid:6004830; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticux.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticux.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004831; classtype:social-engineering; sid:6004831; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verificmail2026.hstn.me/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"verificmail2026.hstn.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004832; classtype:social-engineering; sid:6004832; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoja034.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoja034.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004833; classtype:social-engineering; sid:6004833; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.renewp.cfd/co.uk/)"; flow:established,to_server; http.uri; content:"/co.uk/"; startswith; fast_pattern; http.host; content:"dpd.renewp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004834; classtype:social-engineering; sid:6004834; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticuh.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticuh.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004835; classtype:social-engineering; sid:6004835; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xtrqplm.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.xtrqplm.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004836; classtype:social-engineering; sid:6004836; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (marketing-center.busines-help-center.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"marketing-center.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004837; classtype:social-engineering; sid:6004837; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kraski-schastya.cyou/id=5947221648)"; flow:established,to_server; http.uri; content:"/id=5947221648"; startswith; fast_pattern; http.host; content:"kraski-schastya.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004838; classtype:social-engineering; sid:6004838; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-f7076e6b96664daf90ae8357ef8b9110.r2.dev/DF1.html)"; flow:established,to_server; http.uri; content:"/DF1.html"; startswith; fast_pattern; http.host; content:"pub-f7076e6b96664daf90ae8357ef8b9110.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004839; classtype:social-engineering; sid:6004839; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (link-to-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"link-to-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004840; classtype:social-engineering; sid:6004840; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cottoncandycookie.github.io/netflix_clone2/)"; flow:established,to_server; http.uri; content:"/netflix_clone2/"; startswith; fast_pattern; http.host; content:"cottoncandycookie.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004841; classtype:social-engineering; sid:6004841; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticuy.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticuy.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004842; classtype:social-engineering; sid:6004842; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paiement-boncoin.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paiement-boncoin.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004843; classtype:social-engineering; sid:6004843; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cdn-a-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cdn-a-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004844; classtype:social-engineering; sid:6004844; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticug.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticug.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004845; classtype:social-engineering; sid:6004845; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gitcp7363.github.io/Instagram-login/)"; flow:established,to_server; http.uri; content:"/Instagram-login/"; startswith; fast_pattern; http.host; content:"gitcp7363.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004846; classtype:social-engineering; sid:6004846; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (insightfulconsultants.co.uk/ram/)"; flow:established,to_server; http.uri; content:"/ram/"; startswith; fast_pattern; http.host; content:"insightfulconsultants.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004847; classtype:social-engineering; sid:6004847; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (n0suewqcmn.vx-whatsapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"n0suewqcmn.vx-whatsapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004848; classtype:social-engineering; sid:6004848; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticie.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticie.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004849; classtype:social-engineering; sid:6004849; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (great-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"great-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004850; classtype:social-engineering; sid:6004850; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ou-iqiyi.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ou-iqiyi.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004851; classtype:social-engineering; sid:6004851; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (16378.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"16378.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004852; classtype:social-engineering; sid:6004852; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-8c1c14c3b0d64d0099312bb4670f2e23.r2.dev/hjokedd.html)"; flow:established,to_server; http.uri; content:"/hjokedd.html"; startswith; fast_pattern; http.host; content:"pub-8c1c14c3b0d64d0099312bb4670f2e23.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004853; classtype:social-engineering; sid:6004853; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dgfctxrhx324345464.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.dgfctxrhx324345464.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004854; classtype:social-engineering; sid:6004854; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentosobremedida.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentosobremedida.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004855; classtype:social-engineering; sid:6004855; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticub.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticub.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004856; classtype:social-engineering; sid:6004856; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rajsoull.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"rajsoull.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004857; classtype:social-engineering; sid:6004857; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (santander-7180.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"santander-7180.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004858; classtype:social-engineering; sid:6004858; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member224.business-manage-invite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member224.business-manage-invite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004859; classtype:social-engineering; sid:6004859; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (share-on-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"share-on-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004860; classtype:social-engineering; sid:6004860; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.xupqunr.one/uqjmw)"; flow:established,to_server; http.uri; content:"/uqjmw"; startswith; fast_pattern; http.host; content:"usps.xupqunr.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004861; classtype:social-engineering; sid:6004861; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ingresarsecurity.fwh.is/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ingresarsecurity.fwh.is"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004862; classtype:social-engineering; sid:6004862; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.crispy-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.crispy-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004863; classtype:social-engineering; sid:6004863; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (social-growth.busines-help-center.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"social-growth.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004864; classtype:social-engineering; sid:6004864; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (skinmed.com.pe/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"skinmed.com.pe"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004865; classtype:social-engineering; sid:6004865; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticux.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticux.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004866; classtype:social-engineering; sid:6004866; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticuy.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticuy.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004867; classtype:social-engineering; sid:6004867; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sontungmtpmaidinhnhe.pages.dev/2606:4700:310c::ac42:2d2a/)"; flow:established,to_server; http.uri; content:"/2606:4700:310c::ac42:2d2a/"; startswith; fast_pattern; http.host; content:"sontungmtpmaidinhnhe.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004868; classtype:social-engineering; sid:6004868; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portserv.s-drc2.cloud.gcore.lu/dct/dct/NE1wnww.html)"; flow:established,to_server; http.uri; content:"/dct/dct/NE1wnww.html"; startswith; fast_pattern; http.host; content:"portserv.s-drc2.cloud.gcore.lu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004869; classtype:social-engineering; sid:6004869; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (binance-spotify.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"binance-spotify.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004870; classtype:social-engineering; sid:6004870; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (indonesiaax-dananews.fascist.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"indonesiaax-dananews.fascist.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004871; classtype:social-engineering; sid:6004871; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ahmedold111.github.io/Gagw/index.html)"; flow:established,to_server; http.uri; content:"/Gagw/index.html"; startswith; fast_pattern; http.host; content:"ahmedold111.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004872; classtype:social-engineering; sid:6004872; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1qtyuiokhbdge678ueyehe89364649hfgb.s3.us-east-1.amazonaws.com/scan60320383a19bd865hewuw/Scan-Doc-file-details-893636363.html)"; flow:established,to_server; http.uri; content:"/scan60320383a19bd865hewuw/Scan-Doc-file-details-893636363.html"; startswith; fast_pattern; http.host; content:"1qtyuiokhbdge678ueyehe89364649hfgb.s3.us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004873; classtype:social-engineering; sid:6004873; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jinridapanyc.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jinridapanyc.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004874; classtype:social-engineering; sid:6004874; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (new-for-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"new-for-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004875; classtype:social-engineering; sid:6004875; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticus.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticus.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004876; classtype:social-engineering; sid:6004876; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cs-portalhub.com/login.php)"; flow:established,to_server; http.uri; content:"/login.php"; startswith; fast_pattern; http.host; content:"cs-portalhub.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004877; classtype:social-engineering; sid:6004877; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-notictc.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-notictc.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004878; classtype:social-engineering; sid:6004878; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticym.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticym.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004879; classtype:social-engineering; sid:6004879; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bellloginebill.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bellloginebill.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004880; classtype:social-engineering; sid:6004880; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticya.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticya.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004881; classtype:social-engineering; sid:6004881; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web.mobile-cdn-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web.mobile-cdn-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004882; classtype:social-engineering; sid:6004882; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (service534.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"service534.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004883; classtype:social-engineering; sid:6004883; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticuj.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticuj.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004884; classtype:social-engineering; sid:6004884; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (danyousen.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"danyousen.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004885; classtype:social-engineering; sid:6004885; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hengyitong.com.cn/prointro.asp)"; flow:established,to_server; http.uri; content:"/prointro.asp"; startswith; fast_pattern; http.host; content:"hengyitong.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004886; classtype:social-engineering; sid:6004886; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticua.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticua.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004887; classtype:social-engineering; sid:6004887; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (16479.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"16479.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004888; classtype:social-engineering; sid:6004888; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticei.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticei.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004889; classtype:social-engineering; sid:6004889; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (binance-guanwang.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"binance-guanwang.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004890; classtype:social-engineering; sid:6004890; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticup.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticup.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004891; classtype:social-engineering; sid:6004891; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web.check-in-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web.check-in-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004892; classtype:social-engineering; sid:6004892; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-notictc.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-notictc.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004893; classtype:social-engineering; sid:6004893; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gov-lrs.numero123.com/irs/data/index.html)"; flow:established,to_server; http.uri; content:"/irs/data/index.html"; startswith; fast_pattern; http.host; content:"gov-lrs.numero123.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004894; classtype:social-engineering; sid:6004894; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-notictj.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-notictj.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004895; classtype:social-engineering; sid:6004895; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whats-au-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whats-au-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004896; classtype:social-engineering; sid:6004896; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.renewp.cfd/co.uk)"; flow:established,to_server; http.uri; content:"/co.uk"; startswith; fast_pattern; http.host; content:"dpd.renewp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004897; classtype:social-engineering; sid:6004897; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticua.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticua.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004898; classtype:social-engineering; sid:6004898; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebooksocialpage.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebooksocialpage.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004899; classtype:social-engineering; sid:6004899; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticyh.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticyh.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004900; classtype:social-engineering; sid:6004900; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cdn-y-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cdn-y-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004901; classtype:social-engineering; sid:6004901; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xtrqvbn.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.xtrqvbn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004902; classtype:social-engineering; sid:6004902; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (crese-con-pichincha.rf.gd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"crese-con-pichincha.rf.gd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004903; classtype:social-engineering; sid:6004903; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticyj.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticyj.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004904; classtype:social-engineering; sid:6004904; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.lapreespaciodeportivo.com/SRPINKERTON/)"; flow:established,to_server; http.uri; content:"/SRPINKERTON/"; startswith; fast_pattern; http.host; content:"www.lapreespaciodeportivo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004905; classtype:social-engineering; sid:6004905; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hljs.hyddc.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hljs.hyddc.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004906; classtype:social-engineering; sid:6004906; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web.text-on-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web.text-on-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004907; classtype:social-engineering; sid:6004907; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (componentesegurancasicred.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"componentesegurancasicred.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004908; classtype:social-engineering; sid:6004908; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cctv-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cctv-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004909; classtype:social-engineering; sid:6004909; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bmvxtrqpllf.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.bmvxtrqpllf.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004910; classtype:social-engineering; sid:6004910; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (teresaardley.github.io/adobe.comaccess-onedrive-files.html)"; flow:established,to_server; http.uri; content:"/adobe.comaccess-onedrive-files.html"; startswith; fast_pattern; http.host; content:"teresaardley.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004911; classtype:social-engineering; sid:6004911; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vintagevoltageengineering.com/qdiinc/Mathieucarri%C3%A8reopendocaccess.html)"; flow:established,to_server; http.uri; content:"/qdiinc/Mathieucarri%C3%A8reopendocaccess.html"; startswith; fast_pattern; http.host; content:"vintagevoltageengineering.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004912; classtype:social-engineering; sid:6004912; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tap-to-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tap-to-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004913; classtype:social-engineering; sid:6004913; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cosmic-raindrop-2e0f38.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cosmic-raindrop-2e0f38.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004914; classtype:social-engineering; sid:6004914; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sesionolinenmsn.iceiy.com/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"sesionolinenmsn.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004915; classtype:social-engineering; sid:6004915; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (online-marketing.busines-help-center.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"online-marketing.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004916; classtype:social-engineering; sid:6004916; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dev-osankit.github.io/Login-Instagram)"; flow:established,to_server; http.uri; content:"/Login-Instagram"; startswith; fast_pattern; http.host; content:"dev-osankit.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004917; classtype:social-engineering; sid:6004917; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (message-on-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"message-on-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004918; classtype:social-engineering; sid:6004918; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hey-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hey-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004919; classtype:social-engineering; sid:6004919; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticir.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticir.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004920; classtype:social-engineering; sid:6004920; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-notictb.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-notictb.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004921; classtype:social-engineering; sid:6004921; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (quzixitizc.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"quzixitizc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004922; classtype:social-engineering; sid:6004922; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vintagevoltageengineering.com/gailturner/fairfoodnetwork.html)"; flow:established,to_server; http.uri; content:"/gailturner/fairfoodnetwork.html"; startswith; fast_pattern; http.host; content:"vintagevoltageengineering.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004923; classtype:social-engineering; sid:6004923; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (l.ead.me/bgoa8d)"; flow:established,to_server; http.uri; content:"/bgoa8d"; startswith; fast_pattern; http.host; content:"l.ead.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004924; classtype:social-engineering; sid:6004924; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticuq.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticuq.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004925; classtype:social-engineering; sid:6004925; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (html.whatsappweblogin.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"html.whatsappweblogin.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004926; classtype:social-engineering; sid:6004926; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web.prod-cdn-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web.prod-cdn-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004927; classtype:social-engineering; sid:6004927; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (marketing-network.busines-help-center.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"marketing-network.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004928; classtype:social-engineering; sid:6004928; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticup.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticup.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004929; classtype:social-engineering; sid:6004929; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortalyze.one/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortalyze.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004930; classtype:social-engineering; sid:6004930; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticiq.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticiq.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004931; classtype:social-engineering; sid:6004931; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mobile-sync-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mobile-sync-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004932; classtype:social-engineering; sid:6004932; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lnlclo-sesl0n-linea-2026.hstn.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lnlclo-sesl0n-linea-2026.hstn.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004933; classtype:social-engineering; sid:6004933; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticyt.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticyt.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004934; classtype:social-engineering; sid:6004934; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (real-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"real-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004935; classtype:social-engineering; sid:6004935; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (click-to-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"click-to-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004936; classtype:social-engineering; sid:6004936; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.xupqgbcv.one/uqjmw)"; flow:established,to_server; http.uri; content:"/uqjmw"; startswith; fast_pattern; http.host; content:"usps.xupqgbcv.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004937; classtype:social-engineering; sid:6004937; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.yvlnqrb.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.yvlnqrb.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004938; classtype:social-engineering; sid:6004938; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whats-vn-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whats-vn-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004939; classtype:social-engineering; sid:6004939; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bpkin.art/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bpkin.art"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004940; classtype:social-engineering; sid:6004940; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticuq.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticuq.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004941; classtype:social-engineering; sid:6004941; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (l.ead.me/bgoniM)"; flow:established,to_server; http.uri; content:"/bgoniM"; startswith; fast_pattern; http.host; content:"l.ead.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004942; classtype:social-engineering; sid:6004942; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.xupqwru.one/uqjmw)"; flow:established,to_server; http.uri; content:"/uqjmw"; startswith; fast_pattern; http.host; content:"usps.xupqwru.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004943; classtype:social-engineering; sid:6004943; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (marketing-digital.busines-help-center.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"marketing-digital.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004944; classtype:social-engineering; sid:6004944; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (09j876543a2s4rty-tiiwjptkpk.edgeone.dev/english.html)"; flow:established,to_server; http.uri; content:"/english.html"; startswith; fast_pattern; http.host; content:"09j876543a2s4rty-tiiwjptkpk.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004945; classtype:social-engineering; sid:6004945; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-d69c77ba755745888f5f3bae287f77ec.r2.dev/qzindex.html)"; flow:established,to_server; http.uri; content:"/qzindex.html"; startswith; fast_pattern; http.host; content:"pub-d69c77ba755745888f5f3bae287f77ec.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004946; classtype:social-engineering; sid:6004946; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gov-lrs.numero123.com/irs)"; flow:established,to_server; http.uri; content:"/irs"; startswith; fast_pattern; http.host; content:"gov-lrs.numero123.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004947; classtype:social-engineering; sid:6004947; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticub.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticub.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004948; classtype:social-engineering; sid:6004948; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ws-whatapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ws-whatapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004949; classtype:social-engineering; sid:6004949; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.xupqclv.one/uqjmw)"; flow:established,to_server; http.uri; content:"/uqjmw"; startswith; fast_pattern; http.host; content:"usps.xupqclv.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004950; classtype:social-engineering; sid:6004950; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rajsoull.github.io/Netflix-India/)"; flow:established,to_server; http.uri; content:"/Netflix-India/"; startswith; fast_pattern; http.host; content:"rajsoull.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004951; classtype:social-engineering; sid:6004951; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (marketing-solutions.busines-help-center.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"marketing-solutions.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004952; classtype:social-engineering; sid:6004952; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bpkin.art/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&dsh=S2115075654%3A1779390968469560&followup=https%3A%2F%2Faccounts.google.com%2F&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&ifkv=AWa2PatWro8DJuWfJiRkXdU1lyH0kr2bXz9jJXrFNl8oPAkvUE5vV-dJkHVz7vJ6GY0m6M1qgtkhWA)"; flow:established,to_server; http.uri; content:"/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&dsh=S2115075654%3A1779390968469560&followup=https%3A%2F%2Faccounts.google.com%2F&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&ifkv=AWa2PatWro8DJuWfJiRkXdU1lyH0kr2bXz9jJXrFNl8oPAkvUE5vV-dJkHVz7vJ6GY0m6M1qgtkhWA"; startswith; fast_pattern; http.host; content:"bpkin.art"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004953; classtype:social-engineering; sid:6004953; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.zh-cn-hk-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app.zh-cn-hk-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004954; classtype:social-engineering; sid:6004954; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ca-canva.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ca-canva.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004955; classtype:social-engineering; sid:6004955; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (truea1dcvrefdvdfvfsgcfvdsffvdc-b0bfaudma0addubb.z03.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"truea1dcvrefdvdfvfsgcfvdsffvdc-b0bfaudma0addubb.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004956; classtype:social-engineering; sid:6004956; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (admin.flexcontrol.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"admin.flexcontrol.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004957; classtype:social-engineering; sid:6004957; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.king-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.king-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004958; classtype:social-engineering; sid:6004958; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (log-in-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"log-in-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004959; classtype:social-engineering; sid:6004959; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4acharyaevents.com/index.html.php)"; flow:established,to_server; http.uri; content:"/index.html.php"; startswith; fast_pattern; http.host; content:"4acharyaevents.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004960; classtype:social-engineering; sid:6004960; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bihgnc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bihgnc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004961; classtype:social-engineering; sid:6004961; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xvlrnqb.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.xvlrnqb.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004962; classtype:social-engineering; sid:6004962; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vintagevoltageengineering.com/chikamingtownship/parksdirectoropendocaccess.html)"; flow:established,to_server; http.uri; content:"/chikamingtownship/parksdirectoropendocaccess.html"; startswith; fast_pattern; http.host; content:"vintagevoltageengineering.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004963; classtype:social-engineering; sid:6004963; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-notictx.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-notictx.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004964; classtype:social-engineering; sid:6004964; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.oily-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.oily-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004965; classtype:social-engineering; sid:6004965; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticys.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticys.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004966; classtype:social-engineering; sid:6004966; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chat-on-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"chat-on-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004967; classtype:social-engineering; sid:6004967; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iimap.b-cdn.net/11a.html?eta=coronhub@a36516c6a73aa9a8a8ebaebe3efff94204e4.org)"; flow:established,to_server; http.uri; content:"/11a.html?eta=coronhub@a36516c6a73aa9a8a8ebaebe3efff94204e4.org"; startswith; fast_pattern; http.host; content:"iimap.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004968; classtype:social-engineering; sid:6004968; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticyi.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticyi.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004969; classtype:social-engineering; sid:6004969; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (w1ts.pt/cgi-sys/suspendedpage.cgi)"; flow:established,to_server; http.uri; content:"/cgi-sys/suspendedpage.cgi"; startswith; fast_pattern; http.host; content:"w1ts.pt"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004970; classtype:social-engineering; sid:6004970; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uncgportals.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uncgportals.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004971; classtype:social-engineering; sid:6004971; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alexandre.sg-app-52.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"alexandre.sg-app-52.info"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004972; classtype:social-engineering; sid:6004972; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bhdcontrado2026.iceiy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bhdcontrado2026.iceiy.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004973; classtype:social-engineering; sid:6004973; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2025-zlmbra.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2025-zlmbra.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004974; classtype:social-engineering; sid:6004974; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bngitc.cc/cr)"; flow:established,to_server; http.uri; content:"/cr"; startswith; fast_pattern; http.host; content:"bngitc.cc"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004975; classtype:social-engineering; sid:6004975; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (glowing-square-620488.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"glowing-square-620488.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004976; classtype:social-engineering; sid:6004976; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticum.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticum.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004977; classtype:social-engineering; sid:6004977; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticyp.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticyp.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004978; classtype:social-engineering; sid:6004978; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticyn.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticyn.cyou"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004979; classtype:social-engineering; sid:6004979; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticyq.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticyq.cyou"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004980; classtype:social-engineering; sid:6004980; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiauldv5bljehrubjngbk2p7y4zxdf72gu7ldenbqegsec4htw5s4a.ipfs.inbrowser.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiauldv5bljehrubjngbk2p7y4zxdf72gu7ldenbqegsec4htw5s4a.ipfs.inbrowser.link"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004981; classtype:social-engineering; sid:6004981; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticit.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticit.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004982; classtype:social-engineering; sid:6004982; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (client.portal-jbsecure.com/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"client.portal-jbsecure.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004983; classtype:social-engineering; sid:6004983; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wordpress-211683-0.cloudclusters.net/91997399289/)"; flow:established,to_server; http.uri; content:"/91997399289/"; startswith; fast_pattern; http.host; content:"wordpress-211683-0.cloudclusters.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004984; classtype:social-engineering; sid:6004984; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticuo.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticuo.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004985; classtype:social-engineering; sid:6004985; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hu.service-client-portal.es/hu/pages/)"; flow:established,to_server; http.uri; content:"/hu/pages/"; startswith; fast_pattern; http.host; content:"hu.service-client-portal.es"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004986; classtype:social-engineering; sid:6004986; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticum.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticum.cyou"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004987; classtype:social-engineering; sid:6004987; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticyr.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-noticyr.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004988; classtype:social-engineering; sid:6004988; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-notictn.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-notictn.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004989; classtype:social-engineering; sid:6004989; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-notictv.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-notictv.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004990; classtype:social-engineering; sid:6004990; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticud.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-noticud.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004991; classtype:social-engineering; sid:6004991; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticut.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticut.cyou"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004992; classtype:social-engineering; sid:6004992; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticen.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-noticen.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004993; classtype:social-engineering; sid:6004993; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (indexmxhwnvfiu4wu2106429vfm4odq2fqwt6pnfzup3iwdwxy.restaurantedugandolfo.com.br/authenticationtokenDeyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9yJvcmlnaW5hbFVybCI6Imh0dHBzOi8vbWFpbGVyLWkxZHh4dGE3aWJvbHoweG5lbXVpZms3d2dieGI1YjN5bXQzZG5lbXVpZms3d2/)"; flow:established,to_server; http.uri; content:"/authenticationtokenDeyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9yJvcmlnaW5hbFVybCI6Imh0dHBzOi8vbWFpbGVyLWkxZHh4dGE3aWJvbHoweG5lbXVpZms3d2dieGI1YjN5bXQzZG5lbXVpZms3d2/"; startswith; fast_pattern; http.host; content:"indexmxhwnvfiu4wu2106429vfm4odq2fqwt6pnfzup3iwdwxy.restaurantedugandolfo.com.br"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004994; classtype:social-engineering; sid:6004994; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticit.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticit.cyou"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004995; classtype:social-engineering; sid:6004995; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lavilifescience.com/uuuu.html)"; flow:established,to_server; http.uri; content:"/uuuu.html"; startswith; fast_pattern; http.host; content:"lavilifescience.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004996; classtype:social-engineering; sid:6004996; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (holtermanpraxi.com/home/5440145/570757/dssdfsfezflu/)"; flow:established,to_server; http.uri; content:"/home/5440145/570757/dssdfsfezflu/"; startswith; fast_pattern; http.host; content:"holtermanpraxi.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004997; classtype:social-engineering; sid:6004997; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticye.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-noticye.cyou"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004998; classtype:social-engineering; sid:6004998; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-notictb.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-notictb.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004999; classtype:social-engineering; sid:6004999; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-notictk.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-notictk.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005000; classtype:social-engineering; sid:6005000; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticye.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-noticye.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005001; classtype:social-engineering; sid:6005001; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalinie.pl-4892749284924.shop/oferta/smartfon-samsung-galaxy-s26-ultra-czarny-kolor-1tb-pami%C4%99ci-nowy-gwarancja-2-lata-paragon-media-expert-fabrycznie-spakowany-olsztyn-7b5e4a4f)"; flow:established,to_server; http.uri; content:"/oferta/smartfon-samsung-galaxy-s26-ultra-czarny-kolor-1tb-pami%C4%99ci-nowy-gwarancja-2-lata-paragon-media-expert-fabrycznie-spakowany-olsztyn-7b5e4a4f"; startswith; fast_pattern; http.host; content:"allegrolokalinie.pl-4892749284924.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005002; classtype:social-engineering; sid:6005002; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticyp.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticyp.cyou"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005003; classtype:social-engineering; sid:6005003; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticuv.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticuv.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005004; classtype:social-engineering; sid:6005004; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure.controllers.world/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure.controllers.world"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005005; classtype:social-engineering; sid:6005005; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticur.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-noticur.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005006; classtype:social-engineering; sid:6005006; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gove.lat/si)"; flow:established,to_server; http.uri; content:"/si"; startswith; fast_pattern; http.host; content:"gove.lat"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005007; classtype:social-engineering; sid:6005007; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticec.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-noticec.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005008; classtype:social-engineering; sid:6005008; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.yajugs.com/?7GTDq79PrytM&\;type=vpoint)"; flow:established,to_server; http.uri; content:"/?7GTDq79PrytM&|3b|type=vpoint"; startswith; fast_pattern; http.host; content:"www.yajugs.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005009; classtype:social-engineering; sid:6005009; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticud.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-noticud.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005010; classtype:social-engineering; sid:6005010; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticum.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticum.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005011; classtype:social-engineering; sid:6005011; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticiw.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticiw.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005012; classtype:social-engineering; sid:6005012; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gkdtanhuamu.com/?eqUEW1dsxhhT&\;type=vpoint)"; flow:established,to_server; http.uri; content:"/?eqUEW1dsxhhT&|3b|type=vpoint"; startswith; fast_pattern; http.host; content:"www.gkdtanhuamu.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005013; classtype:social-engineering; sid:6005013; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (govk.lat/si)"; flow:established,to_server; http.uri; content:"/si"; startswith; fast_pattern; http.host; content:"govk.lat"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005014; classtype:social-engineering; sid:6005014; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticek.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-noticek.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005015; classtype:social-engineering; sid:6005015; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.yongqingxiang.cn/home)"; flow:established,to_server; http.uri; content:"/home"; startswith; fast_pattern; http.host; content:"www.yongqingxiang.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005016; classtype:social-engineering; sid:6005016; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticyj.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticyj.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005017; classtype:social-engineering; sid:6005017; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticiw.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticiw.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005018; classtype:social-engineering; sid:6005018; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticyn.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-noticyn.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005019; classtype:social-engineering; sid:6005019; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (autenticacaogov-cmd.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"autenticacaogov-cmd.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005020; classtype:social-engineering; sid:6005020; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (govl.lat/si/)"; flow:established,to_server; http.uri; content:"/si/"; startswith; fast_pattern; http.host; content:"govl.lat"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005021; classtype:social-engineering; sid:6005021; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (strategic-tulip-117151.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"strategic-tulip-117151.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005022; classtype:social-engineering; sid:6005022; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (govj.lat/si)"; flow:established,to_server; http.uri; content:"/si"; startswith; fast_pattern; http.host; content:"govj.lat"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005023; classtype:social-engineering; sid:6005023; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticyn.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-noticyn.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005024; classtype:social-engineering; sid:6005024; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticya.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticya.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005025; classtype:social-engineering; sid:6005025; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yellowcloverconsulting.co.za/js/Dir/index.html)"; flow:established,to_server; http.uri; content:"/js/Dir/index.html"; startswith; fast_pattern; http.host; content:"yellowcloverconsulting.co.za"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005026; classtype:social-engineering; sid:6005026; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (govn.lat/si)"; flow:established,to_server; http.uri; content:"/si"; startswith; fast_pattern; http.host; content:"govn.lat"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005027; classtype:social-engineering; sid:6005027; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticyr.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-noticyr.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005028; classtype:social-engineering; sid:6005028; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticye.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-noticye.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005029; classtype:social-engineering; sid:6005029; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qr-codes.io/3On36z)"; flow:established,to_server; http.uri; content:"/3On36z"; startswith; fast_pattern; http.host; content:"qr-codes.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005030; classtype:social-engineering; sid:6005030; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-notictl.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-notictl.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005031; classtype:social-engineering; sid:6005031; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-notictz.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-notictz.cyou"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005032; classtype:social-engineering; sid:6005032; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.zsyjfs.com/?eJTBKE7YJKA6&\;type=vpoint)"; flow:established,to_server; http.uri; content:"/?eJTBKE7YJKA6&|3b|type=vpoint"; startswith; fast_pattern; http.host; content:"login.zsyjfs.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005033; classtype:social-engineering; sid:6005033; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adwaidsolutions.com/vcn.html)"; flow:established,to_server; http.uri; content:"/vcn.html"; startswith; fast_pattern; http.host; content:"adwaidsolutions.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005034; classtype:social-engineering; sid:6005034; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agoda-ddubai.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"agoda-ddubai.webflow.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005035; classtype:social-engineering; sid:6005035; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.h5-shoumizhibo.com/arewaenen/)"; flow:established,to_server; http.uri; content:"/arewaenen/"; startswith; fast_pattern; http.host; content:"www.h5-shoumizhibo.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005036; classtype:social-engineering; sid:6005036; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (signreviewauthaoergaierfovgbakermkmb.drnathhome.com/?jrthbasertb)"; flow:established,to_server; http.uri; content:"/?jrthbasertb"; startswith; fast_pattern; http.host; content:"signreviewauthaoergaierfovgbakermkmb.drnathhome.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005037; classtype:social-engineering; sid:6005037; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7213455123465813475836354.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"7213455123465813475836354.blogspot.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005038; classtype:social-engineering; sid:6005038; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7213455123465813475836354.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7213455123465813475836354.blogspot.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005039; classtype:social-engineering; sid:6005039; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coytopix.com/natural-wonders-of-the-world/?utm_source=shorten.ee.o-fmF&utm_medium=referral&utm_campaign=lnnf)"; flow:established,to_server; http.uri; content:"/natural-wonders-of-the-world/?utm_source=shorten.ee.o-fmF&utm_medium=referral&utm_campaign=lnnf"; startswith; fast_pattern; http.host; content:"coytopix.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005040; classtype:social-engineering; sid:6005040; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (firebasestorage.googleapis.com/v0/b/thtnwallnwdmn11.appspot.com/o/R1-mmmnneuusuumm.html?alt=media&token=cfc51f89-70e9-4bd8-9687-ac00c985f612)"; flow:established,to_server; http.uri; content:"/v0/b/thtnwallnwdmn11.appspot.com/o/R1-mmmnneuusuumm.html?alt=media&token=cfc51f89-70e9-4bd8-9687-ac00c985f612"; startswith; fast_pattern; http.host; content:"firebasestorage.googleapis.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005041; classtype:social-engineering; sid:6005041; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.account-aplem.com/web/)"; flow:established,to_server; http.uri; content:"/web/"; startswith; fast_pattern; http.host; content:"www.account-aplem.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005042; classtype:social-engineering; sid:6005042; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.qavnative.com/arewaenen/)"; flow:established,to_server; http.uri; content:"/arewaenen/"; startswith; fast_pattern; http.host; content:"www.qavnative.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005043; classtype:social-engineering; sid:6005043; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (marketplace-item-556314385.hstn.me/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"marketplace-item-556314385.hstn.me"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005044; classtype:social-engineering; sid:6005044; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (servicepeagefrance.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"servicepeagefrance.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005045; classtype:social-engineering; sid:6005045; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ethanprojects.co.za/postfinances/)"; flow:established,to_server; http.uri; content:"/postfinances/"; startswith; fast_pattern; http.host; content:"ethanprojects.co.za"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005046; classtype:social-engineering; sid:6005046; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (seasolutions.com/cgi-sys/suspendedpage.cgi)"; flow:established,to_server; http.uri; content:"/cgi-sys/suspendedpage.cgi"; startswith; fast_pattern; http.host; content:"seasolutions.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005047; classtype:social-engineering; sid:6005047; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amaz0n.pikfgk.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amaz0n.pikfgk.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005048; classtype:social-engineering; sid:6005048; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2454352567345245262433464343.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2454352567345245262433464343.blogspot.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005049; classtype:social-engineering; sid:6005049; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (livraisontransportch.com/login_up.php)"; flow:established,to_server; http.uri; content:"/login_up.php"; startswith; fast_pattern; http.host; content:"livraisontransportch.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005050; classtype:social-engineering; sid:6005050; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nuoewpjc.formester.com/f/7SMdnVig4)"; flow:established,to_server; http.uri; content:"/f/7SMdnVig4"; startswith; fast_pattern; http.host; content:"nuoewpjc.formester.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005051; classtype:social-engineering; sid:6005051; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.pl655383454.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalnie.pl655383454.click"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005052; classtype:social-engineering; sid:6005052; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.servicepeagefrance.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.servicepeagefrance.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005053; classtype:social-engineering; sid:6005053; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ingresocancelsegjgtutgalfoficivirtu.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ingresocancelsegjgtutgalfoficivirtu.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005054; classtype:social-engineering; sid:6005054; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.amazon-clone-kappa-ashen.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazon-clone-kappa-ashen.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005055; classtype:social-engineering; sid:6005055; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wap.whatsapp.hj.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wap.whatsapp.hj.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005056; classtype:social-engineering; sid:6005056; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox.com.bi/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"roblox.com.bi"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005057; classtype:social-engineering; sid:6005057; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (phi-go.com/v3/signin/identifier)"; flow:established,to_server; http.uri; content:"/v3/signin/identifier"; startswith; fast_pattern; http.host; content:"phi-go.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005058; classtype:social-engineering; sid:6005058; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.m-galabet1077.com/tr/)"; flow:established,to_server; http.uri; content:"/tr/"; startswith; fast_pattern; http.host; content:"www.m-galabet1077.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005059; classtype:social-engineering; sid:6005059; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.whatsapp.hj.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app.whatsapp.hj.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005060; classtype:social-engineering; sid:6005060; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ephemeral-halva-2f9538.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ephemeral-halva-2f9538.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005061; classtype:social-engineering; sid:6005061; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flocker.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"flocker.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005062; classtype:social-engineering; sid:6005062; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bagyalakshmi-velu.github.io/amazon)"; flow:established,to_server; http.uri; content:"/amazon"; startswith; fast_pattern; http.host; content:"bagyalakshmi-velu.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005063; classtype:social-engineering; sid:6005063; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mada.jdevcloud.com/mu/sa/fi/corr.php)"; flow:established,to_server; http.uri; content:"/mu/sa/fi/corr.php"; startswith; fast_pattern; http.host; content:"mada.jdevcloud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005064; classtype:social-engineering; sid:6005064; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (asistenciam4il2026.github.io/Support/)"; flow:established,to_server; http.uri; content:"/Support/"; startswith; fast_pattern; http.host; content:"asistenciam4il2026.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005065; classtype:social-engineering; sid:6005065; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hot-desactivar.hstn.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hot-desactivar.hstn.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005066; classtype:social-engineering; sid:6005066; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (recnunmain.wasmer.app/linkdotnet)"; flow:established,to_server; http.uri; content:"/linkdotnet"; startswith; fast_pattern; http.host; content:"recnunmain.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005067; classtype:social-engineering; sid:6005067; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.viytzd.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.viytzd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005068; classtype:social-engineering; sid:6005068; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ibpvlc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ibpvlc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005069; classtype:social-engineering; sid:6005069; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spencerlloydphoto.com/r1uxmvi/vczdnup/qjegsxl/da?/235858)"; flow:established,to_server; http.uri; content:"/r1uxmvi/vczdnup/qjegsxl/da?/235858"; startswith; fast_pattern; http.host; content:"spencerlloydphoto.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005070; classtype:social-engineering; sid:6005070; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-five-lyart-84.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-five-lyart-84.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005071; classtype:social-engineering; sid:6005071; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xegida.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xegida.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005072; classtype:social-engineering; sid:6005072; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ljzegq.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.ljzegq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005073; classtype:social-engineering; sid:6005073; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.driegang.nl/new-fr-societegenerale/sg/login/fr/login.php)"; flow:established,to_server; http.uri; content:"/new-fr-societegenerale/sg/login/fr/login.php"; startswith; fast_pattern; http.host; content:"www.driegang.nl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005074; classtype:social-engineering; sid:6005074; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web.great-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web.great-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005075; classtype:social-engineering; sid:6005075; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whats-chi-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whats-chi-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005076; classtype:social-engineering; sid:6005076; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iz-wps.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"iz-wps.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005077; classtype:social-engineering; sid:6005077; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chrome-chrome-chrome-cn.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"chrome-chrome-chrome-cn.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005078; classtype:social-engineering; sid:6005078; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticuo.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-noticuo.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005079; classtype:social-engineering; sid:6005079; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (protracted.wasmer.app/humanresourcesconsultants)"; flow:established,to_server; http.uri; content:"/humanresourcesconsultants"; startswith; fast_pattern; http.host; content:"protracted.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005080; classtype:social-engineering; sid:6005080; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.plzmrx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.plzmrx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005081; classtype:social-engineering; sid:6005081; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pzjckq.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.pzjckq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005082; classtype:social-engineering; sid:6005082; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lvnsxe.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.lvnsxe.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005083; classtype:social-engineering; sid:6005083; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aqsxwaru457.t.mydomain.zone/my/m/login.php)"; flow:established,to_server; http.uri; content:"/my/m/login.php"; startswith; fast_pattern; http.host; content:"aqsxwaru457.t.mydomain.zone"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005084; classtype:social-engineering; sid:6005084; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dnrhze.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.dnrhze.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005085; classtype:social-engineering; sid:6005085; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (link-dana-250000.darksr.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"link-dana-250000.darksr.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005086; classtype:social-engineering; sid:6005086; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.cahjev.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.cahjev.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005087; classtype:social-engineering; sid:6005087; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-nepal.github.io/Neapli-funHUB/)"; flow:established,to_server; http.uri; content:"/Neapli-funHUB/"; startswith; fast_pattern; http.host; content:"instagram-nepal.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005088; classtype:social-engineering; sid:6005088; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web.wdu-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web.wdu-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005089; classtype:social-engineering; sid:6005089; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whatsapp.hj.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whatsapp.hj.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005090; classtype:social-engineering; sid:6005090; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wbtcia.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wbtcia.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005091; classtype:social-engineering; sid:6005091; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.jfm-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.jfm-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005092; classtype:social-engineering; sid:6005092; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (195iiii195.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"195iiii195.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005093; classtype:social-engineering; sid:6005093; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tfpngl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tfpngl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005094; classtype:social-engineering; sid:6005094; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adorable-gelato-921c2a.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"adorable-gelato-921c2a.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005095; classtype:social-engineering; sid:6005095; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kuzogx.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.kuzogx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005096; classtype:social-engineering; sid:6005096; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth.dbsbank.digital/sign-in)"; flow:established,to_server; http.uri; content:"/sign-in"; startswith; fast_pattern; http.host; content:"auth.dbsbank.digital"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005097; classtype:social-engineering; sid:6005097; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (betlink34.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"betlink34.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005098; classtype:social-engineering; sid:6005098; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkinga.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkinga.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005099; classtype:social-engineering; sid:6005099; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cookie-8ck.pages.dev/help/contact/33208460219450)"; flow:established,to_server; http.uri; content:"/help/contact/33208460219450"; startswith; fast_pattern; http.host; content:"cookie-8ck.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005100; classtype:social-engineering; sid:6005100; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkinga.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkinga.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005101; classtype:social-engineering; sid:6005101; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ultrajaumento5.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"ultrajaumento5.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005102; classtype:social-engineering; sid:6005102; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zvfrxh.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zvfrxh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005103; classtype:social-engineering; sid:6005103; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xvkzwp.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xvkzwp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005104; classtype:social-engineering; sid:6005104; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bundaumamtomsiungon.pages.dev/help/contact/26752055131504)"; flow:established,to_server; http.uri; content:"/help/contact/26752055131504"; startswith; fast_pattern; http.host; content:"bundaumamtomsiungon.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005105; classtype:social-engineering; sid:6005105; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-notictk.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-notictk.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005106; classtype:social-engineering; sid:6005106; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rainbow-peony-982782.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rainbow-peony-982782.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005107; classtype:social-engineering; sid:6005107; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xbmwij.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.xbmwij.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005108; classtype:social-engineering; sid:6005108; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fljces.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.fljces.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005109; classtype:social-engineering; sid:6005109; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spanihnomain.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spanihnomain.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005110; classtype:social-engineering; sid:6005110; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kltrioiomex-heruioomeswq.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kltrioiomex-heruioomeswq.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005111; classtype:social-engineering; sid:6005111; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-notictm.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-notictm.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005112; classtype:social-engineering; sid:6005112; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bet83034.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bet83034.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005113; classtype:social-engineering; sid:6005113; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gcawzo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gcawzo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005114; classtype:social-engineering; sid:6005114; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tpowsd.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.tpowsd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005115; classtype:social-engineering; sid:6005115; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.gzsbyo.cc/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.gzsbyo.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005116; classtype:social-engineering; sid:6005116; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mitamassk-looggin.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mitamassk-looggin.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005117; classtype:social-engineering; sid:6005117; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (recnunmain.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"recnunmain.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005118; classtype:social-engineering; sid:6005118; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tetracm.com/tetrastyle/fonts/assets/)"; flow:established,to_server; http.uri; content:"/tetrastyle/fonts/assets/"; startswith; fast_pattern; http.host; content:"tetracm.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005119; classtype:social-engineering; sid:6005119; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gt330011.qy0566.com/bet-ph/)"; flow:established,to_server; http.uri; content:"/bet-ph/"; startswith; fast_pattern; http.host; content:"gt330011.qy0566.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005120; classtype:social-engineering; sid:6005120; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.2121-sport.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.2121-sport.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005121; classtype:social-engineering; sid:6005121; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nhnarticle.cafe/view/315692?ref=116559146394517)"; flow:established,to_server; http.uri; content:"/view/315692?ref=116559146394517"; startswith; fast_pattern; http.host; content:"nhnarticle.cafe"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005122; classtype:social-engineering; sid:6005122; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp.hj.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp.hj.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005123; classtype:social-engineering; sid:6005123; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bwvjxi.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bwvjxi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005124; classtype:social-engineering; sid:6005124; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingd.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingd.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005125; classtype:social-engineering; sid:6005125; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (news-google-chrome.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"news-google-chrome.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005126; classtype:social-engineering; sid:6005126; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (global-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"global-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005127; classtype:social-engineering; sid:6005127; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.goemwi.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.goemwi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005128; classtype:social-engineering; sid:6005128; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-networks.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-networks.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005129; classtype:social-engineering; sid:6005129; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kanuri-2006.github.io/Task-4-UI-Clone-Challenge/)"; flow:established,to_server; http.uri; content:"/Task-4-UI-Clone-Challenge/"; startswith; fast_pattern; http.host; content:"kanuri-2006.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005130; classtype:social-engineering; sid:6005130; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jaliniteaqui.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"jaliniteaqui.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005131; classtype:social-engineering; sid:6005131; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pjhemi.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pjhemi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005132; classtype:social-engineering; sid:6005132; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fplcqo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.fplcqo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005133; classtype:social-engineering; sid:6005133; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticit.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-noticit.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005134; classtype:social-engineering; sid:6005134; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (getmysocial.com/61sr168r1et61ht67)"; flow:established,to_server; http.uri; content:"/61sr168r1et61ht67"; startswith; fast_pattern; http.host; content:"getmysocial.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005135; classtype:social-engineering; sid:6005135; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whats-ae-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whats-ae-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005136; classtype:social-engineering; sid:6005136; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ol-rizx.wasmer.app/bankwest-sd)"; flow:established,to_server; http.uri; content:"/bankwest-sd"; startswith; fast_pattern; http.host; content:"ol-rizx.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005137; classtype:social-engineering; sid:6005137; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wps1-zh.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wps1-zh.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005138; classtype:social-engineering; sid:6005138; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kxoalu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kxoalu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005139; classtype:social-engineering; sid:6005139; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nzlbrs.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nzlbrs.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005140; classtype:social-engineering; sid:6005140; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vmbxeo.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.vmbxeo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005141; classtype:social-engineering; sid:6005141; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.web.wdu-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.web.wdu-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005142; classtype:social-engineering; sid:6005142; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tbwmlq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tbwmlq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005143; classtype:social-engineering; sid:6005143; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.exclusivedsessiondrop4.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.exclusivedsessiondrop4.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005144; classtype:social-engineering; sid:6005144; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.cdeaoz.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.cdeaoz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005145; classtype:social-engineering; sid:6005145; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.whatsapp.hj.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.whatsapp.hj.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005146; classtype:social-engineering; sid:6005146; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (survey-admin.adjust.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"survey-admin.adjust.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005147; classtype:social-engineering; sid:6005147; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-clone-alpha-eight.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-clone-alpha-eight.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005148; classtype:social-engineering; sid:6005148; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xhlzvb.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xhlzvb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005149; classtype:social-engineering; sid:6005149; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.securreways.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.securreways.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005150; classtype:social-engineering; sid:6005150; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web.star-message-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web.star-message-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005151; classtype:social-engineering; sid:6005151; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezors.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezors.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005152; classtype:social-engineering; sid:6005152; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.diwpmk.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.diwpmk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005153; classtype:social-engineering; sid:6005153; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-one-week--onlyesu.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-one-week--onlyesu.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005154; classtype:social-engineering; sid:6005154; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2m.ma/ar)"; flow:established,to_server; http.uri; content:"/ar"; startswith; fast_pattern; http.host; content:"2m.ma"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005155; classtype:social-engineering; sid:6005155; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mmthusretromain.wasmer.app/api/tracking/click)"; flow:established,to_server; http.uri; content:"/api/tracking/click"; startswith; fast_pattern; http.host; content:"mmthusretromain.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005156; classtype:social-engineering; sid:6005156; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.uihryp.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.uihryp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005157; classtype:social-engineering; sid:6005157; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tokenpocketr.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tokenpocketr.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005158; classtype:social-engineering; sid:6005158; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web.app-for-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web.app-for-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005159; classtype:social-engineering; sid:6005159; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nwrspa.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nwrspa.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005160; classtype:social-engineering; sid:6005160; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-clone-five-lyart-84.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-five-lyart-84.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005161; classtype:social-engineering; sid:6005161; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.multipropositolosandes.com/GillesPelletier/afmq.html)"; flow:established,to_server; http.uri; content:"/GillesPelletier/afmq.html"; startswith; fast_pattern; http.host; content:"www.multipropositolosandes.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005162; classtype:social-engineering; sid:6005162; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.con.signalstacktrend.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.con.signalstacktrend.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005163; classtype:social-engineering; sid:6005163; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.apps-offiice-wps.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.apps-offiice-wps.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005164; classtype:social-engineering; sid:6005164; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.cwgsmn.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.cwgsmn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005165; classtype:social-engineering; sid:6005165; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (datrucsmain.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"datrucsmain.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005166; classtype:social-engineering; sid:6005166; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticiy.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticiy.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005167; classtype:social-engineering; sid:6005167; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imtuken.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"imtuken.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005168; classtype:social-engineering; sid:6005168; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ojyvms.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ojyvms.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005169; classtype:social-engineering; sid:6005169; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mispies.cl/newproject/portal.html)"; flow:established,to_server; http.uri; content:"/newproject/portal.html"; startswith; fast_pattern; http.host; content:"www.mispies.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005170; classtype:social-engineering; sid:6005170; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whats-mx-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whats-mx-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005171; classtype:social-engineering; sid:6005171; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ucpmserver.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ucpmserver.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005172; classtype:social-engineering; sid:6005172; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.google-chrrome-cn.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.google-chrrome-cn.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005173; classtype:social-engineering; sid:6005173; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (freeeus.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"freeeus.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005174; classtype:social-engineering; sid:6005174; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (resmi.galabt-galaofical.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"resmi.galabt-galaofical.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005175; classtype:social-engineering; sid:6005175; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jdgexp.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.jdgexp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005176; classtype:social-engineering; sid:6005176; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portal-okoo.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"portal-okoo.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005177; classtype:social-engineering; sid:6005177; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lfizcd.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.lfizcd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005178; classtype:social-engineering; sid:6005178; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lqzred.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lqzred.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005179; classtype:social-engineering; sid:6005179; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jqocfk.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.jqocfk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005180; classtype:social-engineering; sid:6005180; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticir.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-noticir.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005181; classtype:social-engineering; sid:6005181; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticub.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticub.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005182; classtype:social-engineering; sid:6005182; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hwpgsd.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.hwpgsd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005183; classtype:social-engineering; sid:6005183; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wxoupl.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.wxoupl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005184; classtype:social-engineering; sid:6005184; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fakeflix-lemon-six.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fakeflix-lemon-six.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005185; classtype:social-engineering; sid:6005185; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jfxqml.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jfxqml.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005186; classtype:social-engineering; sid:6005186; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vinaydevloper.github.io/amazon-landing-clone/)"; flow:established,to_server; http.uri; content:"/amazon-landing-clone/"; startswith; fast_pattern; http.host; content:"vinaydevloper.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005187; classtype:social-engineering; sid:6005187; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.feiji-tgwe.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.feiji-tgwe.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005188; classtype:social-engineering; sid:6005188; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bwvjxi.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.bwvjxi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005189; classtype:social-engineering; sid:6005189; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.offfiice-wps.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.offfiice-wps.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005190; classtype:social-engineering; sid:6005190; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.cnwqsl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.cnwqsl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005191; classtype:social-engineering; sid:6005191; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingd.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005192; classtype:social-engineering; sid:6005192; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (farhaannalam.github.io/Amazon)"; flow:established,to_server; http.uri; content:"/Amazon"; startswith; fast_pattern; http.host; content:"farhaannalam.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005193; classtype:social-engineering; sid:6005193; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-git-05-20-featwebshowread-onlytokeninfoforex-4642a4-uniswap.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-git-05-20-featwebshowread-onlytokeninfoforex-4642a4-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005194; classtype:social-engineering; sid:6005194; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (layanan-undian11.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"layanan-undian11.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005195; classtype:social-engineering; sid:6005195; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ximvtl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ximvtl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005196; classtype:social-engineering; sid:6005196; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.oiicxs.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.oiicxs.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005197; classtype:social-engineering; sid:6005197; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qelpnm.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.qelpnm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005198; classtype:social-engineering; sid:6005198; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticuc.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticuc.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005199; classtype:social-engineering; sid:6005199; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-static-host--trena1snfmaz.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-static-host--trena1snfmaz.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005200; classtype:social-engineering; sid:6005200; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ultrajaumento4.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"ultrajaumento4.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005201; classtype:social-engineering; sid:6005201; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verificacionde-informacion-email2026.zya.me/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"verificacionde-informacion-email2026.zya.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005202; classtype:social-engineering; sid:6005202; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.zoc-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.zoc-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005203; classtype:social-engineering; sid:6005203; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.chwsdp.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.chwsdp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005204; classtype:social-engineering; sid:6005204; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ciwqmt.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.ciwqmt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005205; classtype:social-engineering; sid:6005205; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pgkyen.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.pgkyen.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005206; classtype:social-engineering; sid:6005206; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (swiftglobalpay.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"swiftglobalpay.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005207; classtype:social-engineering; sid:6005207; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticue.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticue.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005208; classtype:social-engineering; sid:6005208; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.galalbet1088.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.galalbet1088.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005209; classtype:social-engineering; sid:6005209; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j57k.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j57k.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005210; classtype:social-engineering; sid:6005210; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (daideogilamtkealmcoosae.pages.dev/help/contact/331845480657547/)"; flow:established,to_server; http.uri; content:"/help/contact/331845480657547/"; startswith; fast_pattern; http.host; content:"daideogilamtkealmcoosae.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005211; classtype:social-engineering; sid:6005211; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web.whatsapp.hj.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web.whatsapp.hj.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005212; classtype:social-engineering; sid:6005212; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ulejsn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ulejsn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005213; classtype:social-engineering; sid:6005213; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lazbey.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lazbey.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005214; classtype:social-engineering; sid:6005214; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tianqi-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tianqi-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005215; classtype:social-engineering; sid:6005215; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (juyi-wl.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"juyi-wl.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005216; classtype:social-engineering; sid:6005216; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rkyfhv.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.rkyfhv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005217; classtype:social-engineering; sid:6005217; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kuaiinilian.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kuaiinilian.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005218; classtype:social-engineering; sid:6005218; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticiy.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticiy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005219; classtype:social-engineering; sid:6005219; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.sjavqh.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.sjavqh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005220; classtype:social-engineering; sid:6005220; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.juyi-wl.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.juyi-wl.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005221; classtype:social-engineering; sid:6005221; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazonaws-assets-secure-node-aws-views.s3.us-east-1.amazonaws.com/confirm?e=belorx@e3a52135c2ab3eae0161a3bb87466c084aa1.com)"; flow:established,to_server; http.uri; content:"/confirm?e=belorx@e3a52135c2ab3eae0161a3bb87466c084aa1.com"; startswith; fast_pattern; http.host; content:"amazonaws-assets-secure-node-aws-views.s3.us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005222; classtype:social-engineering; sid:6005222; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s22j.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"s22j.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005223; classtype:social-engineering; sid:6005223; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kanqiubanbabisai.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kanqiubanbabisai.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005224; classtype:social-engineering; sid:6005224; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.oiicfg.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.oiicfg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005225; classtype:social-engineering; sid:6005225; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (protracted.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"protracted.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005226; classtype:social-engineering; sid:6005226; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mvnosb.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mvnosb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005227; classtype:social-engineering; sid:6005227; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whats-kr-whatsapp.com.cnwww.whats-kr-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whats-kr-whatsapp.com.cnwww.whats-kr-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005228; classtype:social-engineering; sid:6005228; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mk-stadium.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mk-stadium.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005229; classtype:social-engineering; sid:6005229; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (140aba.senes.at/bncearn/incnb.php)"; flow:established,to_server; http.uri; content:"/bncearn/incnb.php"; startswith; fast_pattern; http.host; content:"140aba.senes.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005230; classtype:social-engineering; sid:6005230; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rxgnye.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.rxgnye.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005231; classtype:social-engineering; sid:6005231; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ma-gate.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ma-gate.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005232; classtype:social-engineering; sid:6005232; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vodic.uy/fr/NickelTru/home/virtual/rosyorange/www/tls/xd/zd/clients/login.php)"; flow:established,to_server; http.uri; content:"/fr/NickelTru/home/virtual/rosyorange/www/tls/xd/zd/clients/login.php"; startswith; fast_pattern; http.host; content:"vodic.uy"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005233; classtype:social-engineering; sid:6005233; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ultrajaumento3.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"ultrajaumento3.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005234; classtype:social-engineering; sid:6005234; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zxidey.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.zxidey.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005235; classtype:social-engineering; sid:6005235; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ol-rizx.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ol-rizx.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005236; classtype:social-engineering; sid:6005236; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.haisof.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.haisof.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005237; classtype:social-engineering; sid:6005237; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hnemqu.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.hnemqu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005238; classtype:social-engineering; sid:6005238; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jgiqhu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jgiqhu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005239; classtype:social-engineering; sid:6005239; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web.super-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web.super-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005240; classtype:social-engineering; sid:6005240; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.msolku.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.msolku.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005241; classtype:social-engineering; sid:6005241; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lawsrz.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.lawsrz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005242; classtype:social-engineering; sid:6005242; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (insightadvice.co.za/wp-admin/gif/web/add.php)"; flow:established,to_server; http.uri; content:"/wp-admin/gif/web/add.php"; startswith; fast_pattern; http.host; content:"insightadvice.co.za"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005243; classtype:social-engineering; sid:6005243; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (php-9ce3d.wasmer.app/login.php)"; flow:established,to_server; http.uri; content:"/login.php"; startswith; fast_pattern; http.host; content:"php-9ce3d.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005244; classtype:social-engineering; sid:6005244; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (officemodels.have-fun.gr/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"officemodels.have-fun.gr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005245; classtype:social-engineering; sid:6005245; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (am.fgoffw.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"am.fgoffw.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005246; classtype:social-engineering; sid:6005246; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bundaumamtomsiungon.pages.dev/help/contact/508448533301679)"; flow:established,to_server; http.uri; content:"/help/contact/508448533301679"; startswith; fast_pattern; http.host; content:"bundaumamtomsiungon.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005247; classtype:social-engineering; sid:6005247; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-clone-alpha-eight.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-clone-alpha-eight.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005248; classtype:social-engineering; sid:6005248; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cookie-8ck.pages.dev/help/contact/644693907328391)"; flow:established,to_server; http.uri; content:"/help/contact/644693907328391"; startswith; fast_pattern; http.host; content:"cookie-8ck.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005249; classtype:social-engineering; sid:6005249; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticiy.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-noticiy.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005250; classtype:social-engineering; sid:6005250; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-notictn.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-notictn.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005251; classtype:social-engineering; sid:6005251; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.flkdav.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.flkdav.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005252; classtype:social-engineering; sid:6005252; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nwrspa.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.nwrspa.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005253; classtype:social-engineering; sid:6005253; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my-smbc-jp.com/sso/login/8ce2e418-677a-43a7-ba7d-66eace99dc36)"; flow:established,to_server; http.uri; content:"/sso/login/8ce2e418-677a-43a7-ba7d-66eace99dc36"; startswith; fast_pattern; http.host; content:"my-smbc-jp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005254; classtype:social-engineering; sid:6005254; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.galabett.cam/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.galabett.cam"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005255; classtype:social-engineering; sid:6005255; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (upheld-desk.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"upheld-desk.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005256; classtype:social-engineering; sid:6005256; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wendy.mystagingwebsite.com/wp-content/plugins/sincous/public/index.php)"; flow:established,to_server; http.uri; content:"/wp-content/plugins/sincous/public/index.php"; startswith; fast_pattern; http.host; content:"wendy.mystagingwebsite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005257; classtype:social-engineering; sid:6005257; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ymodtc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ymodtc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005258; classtype:social-engineering; sid:6005258; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (official-youdao.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"official-youdao.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005259; classtype:social-engineering; sid:6005259; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kicucoimnlogxnio.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kicucoimnlogxnio.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005260; classtype:social-engineering; sid:6005260; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.azinfw.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.azinfw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005261; classtype:social-engineering; sid:6005261; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-networks.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-networks.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005262; classtype:social-engineering; sid:6005262; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.twamej.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.twamej.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005263; classtype:social-engineering; sid:6005263; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zwpfbk.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.zwpfbk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005264; classtype:social-engineering; sid:6005264; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bankofamerica-three.vercel.app/login.html)"; flow:established,to_server; http.uri; content:"/login.html"; startswith; fast_pattern; http.host; content:"bankofamerica-three.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005265; classtype:social-engineering; sid:6005265; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kallemmanasa07.github.io/UI-Clone-Challenge/)"; flow:established,to_server; http.uri; content:"/UI-Clone-Challenge/"; startswith; fast_pattern; http.host; content:"kallemmanasa07.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005266; classtype:social-engineering; sid:6005266; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pjidyr.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.pjidyr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005267; classtype:social-engineering; sid:6005267; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (officemodels.gr/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"officemodels.gr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005268; classtype:social-engineering; sid:6005268; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.guoixn.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.guoixn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005269; classtype:social-engineering; sid:6005269; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.aiuokr.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.aiuokr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005270; classtype:social-engineering; sid:6005270; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16382.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16382.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005271; classtype:social-engineering; sid:6005271; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dumpgi.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dumpgi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005272; classtype:social-engineering; sid:6005272; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ingresamenteverifithewor.free.nf/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ingresamenteverifithewor.free.nf"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005273; classtype:social-engineering; sid:6005273; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (att.foxmarksolutions.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"att.foxmarksolutions.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005274; classtype:social-engineering; sid:6005274; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (leisutiyuzhibopingtai.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"leisutiyuzhibopingtai.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005275; classtype:social-engineering; sid:6005275; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toketpocket.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"toketpocket.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005276; classtype:social-engineering; sid:6005276; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m-facebooks.vn/httpswwwfacebookcomdovanduc2020?a)"; flow:established,to_server; http.uri; content:"/httpswwwfacebookcomdovanduc2020?a"; startswith; fast_pattern; http.host; content:"m-facebooks.vn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005277; classtype:social-engineering; sid:6005277; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentocontrolado.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentocontrolado.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005278; classtype:social-engineering; sid:6005278; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kuaiinllian.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kuaiinllian.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005279; classtype:social-engineering; sid:6005279; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whats-par-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whats-par-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005280; classtype:social-engineering; sid:6005280; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qblwet.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qblwet.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005281; classtype:social-engineering; sid:6005281; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bahissiteleri43.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bahissiteleri43.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005282; classtype:social-engineering; sid:6005282; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-for-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app-for-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005283; classtype:social-engineering; sid:6005283; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.evyrhi.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.evyrhi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005284; classtype:social-engineering; sid:6005284; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pnc-nine.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pnc-nine.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005285; classtype:social-engineering; sid:6005285; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pjidgh.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.pjidgh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005286; classtype:social-engineering; sid:6005286; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jauryn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jauryn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005287; classtype:social-engineering; sid:6005287; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fvhams.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.fvhams.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005288; classtype:social-engineering; sid:6005288; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ctdhqj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ctdhqj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005289; classtype:social-engineering; sid:6005289; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zed12.com/5-21-2026-EXCH032/)"; flow:established,to_server; http.uri; content:"/5-21-2026-EXCH032/"; startswith; fast_pattern; http.host; content:"zed12.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005290; classtype:social-engineering; sid:6005290; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.findmyiphone.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.findmyiphone.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005291; classtype:social-engineering; sid:6005291; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.layanan-undian11.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.layanan-undian11.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005292; classtype:social-engineering; sid:6005292; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gamerrm18.github.io/instagram-verification)"; flow:established,to_server; http.uri; content:"/instagram-verification"; startswith; fast_pattern; http.host; content:"gamerrm18.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005293; classtype:social-engineering; sid:6005293; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hwvcta.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.hwvcta.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005294; classtype:social-engineering; sid:6005294; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (logosconsultoria.net.br/11641888854444/auth/login.php)"; flow:established,to_server; http.uri; content:"/11641888854444/auth/login.php"; startswith; fast_pattern; http.host; content:"logosconsultoria.net.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005295; classtype:social-engineering; sid:6005295; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hqicku.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hqicku.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005296; classtype:social-engineering; sid:6005296; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cn.binancne.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cn.binancne.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005297; classtype:social-engineering; sid:6005297; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nwovem.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.nwovem.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005298; classtype:social-engineering; sid:6005298; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.civjgr.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.civjgr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005299; classtype:social-engineering; sid:6005299; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vzchyp.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.vzchyp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005300; classtype:social-engineering; sid:6005300; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (195b195.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"195b195.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005301; classtype:social-engineering; sid:6005301; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (utppaacun.ucoz.club/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"utppaacun.ucoz.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005302; classtype:social-engineering; sid:6005302; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.skvtac.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.skvtac.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005303; classtype:social-engineering; sid:6005303; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ti.sangfor.com.cn/analysis-platform?lang=EN-US)"; flow:established,to_server; http.uri; content:"/analysis-platform?lang=EN-US"; startswith; fast_pattern; http.host; content:"ti.sangfor.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005304; classtype:social-engineering; sid:6005304; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qioweh.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qioweh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005305; classtype:social-engineering; sid:6005305; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.filesusr.com/html/a209ed_7a9f663e25335332a5a37ee7f09fccd5.html)"; flow:established,to_server; http.uri; content:"/html/a209ed_7a9f663e25335332a5a37ee7f09fccd5.html"; startswith; fast_pattern; http.host; content:"www.filesusr.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005306; classtype:social-engineering; sid:6005306; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiclpm47nycdhv7rwo47ynjy7z6i56vkmty2rm77ns4ocfqa7czuoe.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiclpm47nycdhv7rwo47ynjy7z6i56vkmty2rm77ns4ocfqa7czuoe.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005307; classtype:social-engineering; sid:6005307; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.meialt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.meialt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005308; classtype:social-engineering; sid:6005308; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ciwqtv.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.ciwqtv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005309; classtype:social-engineering; sid:6005309; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qingqingdao.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qingqingdao.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005310; classtype:social-engineering; sid:6005310; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meine-secureeline-login.91-218-65-223.plesk.page/intel/)"; flow:established,to_server; http.uri; content:"/intel/"; startswith; fast_pattern; http.host; content:"meine-secureeline-login.91-218-65-223.plesk.page"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005311; classtype:social-engineering; sid:6005311; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ncafe-article.media/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ncafe-article.media"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005312; classtype:social-engineering; sid:6005312; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (free-webmail.clients-2.com/cgi-sys/suspendedpage.cgi)"; flow:established,to_server; http.uri; content:"/cgi-sys/suspendedpage.cgi"; startswith; fast_pattern; http.host; content:"free-webmail.clients-2.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005313; classtype:social-engineering; sid:6005313; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (charles.grv5718513.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"charles.grv5718513.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005314; classtype:social-engineering; sid:6005314; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eng-desktop-ldger.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"eng-desktop-ldger.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005315; classtype:social-engineering; sid:6005315; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.rochestercontemporary.org/events/panel-discussion-encaustic-art-today/?Drhst=1#HSFDDSDFGSDFHSDFFGDFSFGERGHSDGFSDGSD)"; flow:established,to_server; http.uri; content:"/events/panel-discussion-encaustic-art-today/?Drhst=1#HSFDDSDFGSDFHSDFFGDFSFGERGHSDGFSDGSD"; startswith; fast_pattern; http.host; content:"www.rochestercontemporary.org"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005316; classtype:social-engineering; sid:6005316; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3duzy5sgifg2i.kimi.place/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3duzy5sgifg2i.kimi.place"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005317; classtype:social-engineering; sid:6005317; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dageyuan.cn/home)"; flow:established,to_server; http.uri; content:"/home"; startswith; fast_pattern; http.host; content:"www.dageyuan.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005318; classtype:social-engineering; sid:6005318; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klelnanzeigen-deutch.voicie.cc/receive/order/JoitlV_wzK_?r=0x15&__cf_chl_rt_tk=ig.7kpGpCYynJ1qrdEVeFV9QEFPnsW76FdHj7EGR2aw-1779448487-1.0.1.1-VMhzd2mtLFUtiQ8U3GSjIDRh1mydMesa_tSC6_gBxK4)"; flow:established,to_server; http.uri; content:"/receive/order/JoitlV_wzK_?r=0x15&__cf_chl_rt_tk=ig.7kpGpCYynJ1qrdEVeFV9QEFPnsW76FdHj7EGR2aw-1779448487-1.0.1.1-VMhzd2mtLFUtiQ8U3GSjIDRh1mydMesa_tSC6_gBxK4"; startswith; fast_pattern; http.host; content:"klelnanzeigen-deutch.voicie.cc"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005319; classtype:social-engineering; sid:6005319; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nassabi.grv5718513.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nassabi.grv5718513.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005320; classtype:social-engineering; sid:6005320; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (centre-index-edfrance.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"centre-index-edfrance.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005321; classtype:social-engineering; sid:6005321; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (projects-bridges.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"projects-bridges.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005322; classtype:social-engineering; sid:6005322; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (desk-suiteapps.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"desk-suiteapps.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005323; classtype:social-engineering; sid:6005323; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bcr-lngresoweb.lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bcr-lngresoweb.lat"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005324; classtype:social-engineering; sid:6005324; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (naileditcakes.co.za/skafs)"; flow:established,to_server; http.uri; content:"/skafs"; startswith; fast_pattern; http.host; content:"naileditcakes.co.za"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005325; classtype:social-engineering; sid:6005325; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgro-liveapp.wixstudio.com/live)"; flow:established,to_server; http.uri; content:"/live"; startswith; fast_pattern; http.host; content:"ledgro-liveapp.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005326; classtype:social-engineering; sid:6005326; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kleinanzeigen.096gz.com/782823666570?mail=W1lPVVJd&meta=rlWjMKWwLJ50LJqyVwb1YPWhLJ1yVwbvKUHlAmL0KUIzMGOzVSyiqKVtGJScoTIlVvjvL2uuqS9cMPV6YGRjZQV5Zmt2AGt0ZGDfVaAypaMcL2HvBvWeoTIcozShrzIcM2IhVvjvqUyjMFV6Vz1unJkypy9jpz8vsD%3D%3D)"; flow:established,to_server; http.uri; content:"/782823666570?mail=W1lPVVJd&meta=rlWjMKWwLJ50LJqyVwb1YPWhLJ1yVwbvKUHlAmL0KUIzMGOzVSyiqKVtGJScoTIlVvjvL2uuqS9cMPV6YGRjZQV5Zmt2AGt0ZGDfVaAypaMcL2HvBvWeoTIcozShrzIcM2IhVvjvqUyjMFV6Vz1unJkypy9jpz8vsD%3D%3D"; startswith; fast_pattern; http.host; content:"kleinanzeigen.096gz.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005327; classtype:social-engineering; sid:6005327; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paddlefish-kbg4.squarespace.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paddlefish-kbg4.squarespace.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005328; classtype:social-engineering; sid:6005328; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (started-bridge-trezr.wixstudio.com/auths)"; flow:established,to_server; http.uri; content:"/auths"; startswith; fast_pattern; http.host; content:"started-bridge-trezr.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005329; classtype:social-engineering; sid:6005329; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p0nt-bra-fidelis1.dynv6.net/B8420266/755498457442026/mobile/index.php?hash=15867159226a0fa9f35152d2.36982946)"; flow:established,to_server; http.uri; content:"/B8420266/755498457442026/mobile/index.php?hash=15867159226a0fa9f35152d2.36982946"; startswith; fast_pattern; http.host; content:"p0nt-bra-fidelis1.dynv6.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005330; classtype:social-engineering; sid:6005330; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (access-desktopapps.wixstudio.com/my-site)"; flow:established,to_server; http.uri; content:"/my-site"; startswith; fast_pattern; http.host; content:"access-desktopapps.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005331; classtype:social-engineering; sid:6005331; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.laikexingqiu.cn/home)"; flow:established,to_server; http.uri; content:"/home"; startswith; fast_pattern; http.host; content:"www.laikexingqiu.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005332; classtype:social-engineering; sid:6005332; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vxdse.myfreesites.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vxdse.myfreesites.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005333; classtype:social-engineering; sid:6005333; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amina.grv5718513.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amina.grv5718513.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005334; classtype:social-engineering; sid:6005334; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sabine.grv5718513.pro/captcha.php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"sabine.grv5718513.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005335; classtype:social-engineering; sid:6005335; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.grv5718513.pro/captcha.php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"www.grv5718513.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005336; classtype:social-engineering; sid:6005336; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (annulation-s.duckdns.org/index.php)"; flow:established,to_server; http.uri; content:"/index.php"; startswith; fast_pattern; http.host; content:"annulation-s.duckdns.org"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005337; classtype:social-engineering; sid:6005337; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amina.grv5718513.pro/captcha.php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"amina.grv5718513.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005338; classtype:social-engineering; sid:6005338; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tttttttttoifheoidfhdiodvhiudhvidf.cfolks.pl/cy/ks/)"; flow:established,to_server; http.uri; content:"/cy/ks/"; startswith; fast_pattern; http.host; content:"tttttttttoifheoidfhdiodvhiudhvidf.cfolks.pl"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005339; classtype:social-engineering; sid:6005339; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (confirmatrion-remboursse.github.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"confirmatrion-remboursse.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005340; classtype:social-engineering; sid:6005340; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-i-liv.zapier.app/web-us-1)"; flow:established,to_server; http.uri; content:"/web-us-1"; startswith; fast_pattern; http.host; content:"ledger-i-liv.zapier.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005341; classtype:social-engineering; sid:6005341; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (red-local.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"red-local.click"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005342; classtype:social-engineering; sid:6005342; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpln-guides.com/anomalie-des-neravok/quete/tutorial/)"; flow:established,to_server; http.uri; content:"/anomalie-des-neravok/quete/tutorial/"; startswith; fast_pattern; http.host; content:"dpln-guides.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005343; classtype:social-engineering; sid:6005343; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (risu.io/VOnqb)"; flow:established,to_server; http.uri; content:"/VOnqb"; startswith; fast_pattern; http.host; content:"risu.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005344; classtype:social-engineering; sid:6005344; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (desktop-server.wixstudio.com/desktop)"; flow:established,to_server; http.uri; content:"/desktop"; startswith; fast_pattern; http.host; content:"desktop-server.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005345; classtype:social-engineering; sid:6005345; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (outlook.office365.com/mail/)"; flow:established,to_server; http.uri; content:"/mail/"; startswith; fast_pattern; http.host; content:"outlook.office365.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005346; classtype:social-engineering; sid:6005346; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (triglhadinw.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"triglhadinw.blogspot.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005347; classtype:social-engineering; sid:6005347; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (geroplmertunerd.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"geroplmertunerd.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005348; classtype:social-engineering; sid:6005348; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bellservice8778767.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bellservice8778767.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005349; classtype:social-engineering; sid:6005349; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (registro-digital-ambh-2026.cr-web.workers.dev/servicios)"; flow:established,to_server; http.uri; content:"/servicios"; startswith; fast_pattern; http.host; content:"registro-digital-ambh-2026.cr-web.workers.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005350; classtype:social-engineering; sid:6005350; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (join.wwfindia.org/nature-warrior.php?source=%22%2F%3E%3Cimg%20src%3D%22https%3A%2F%2Fgoogle.com%2FwyFp7fKX3WVRb.jpg%22%20onerror%3D%22window.location%3DdecodeURIComponent%28atob%28%27Njg3NDc0NzA3MzNhMmYyZjc2NmI2OTYxNzI2OTZjMmU2MzYxMzY2MTM4NjIzNzM0MmQzMzMyNjE2MzJkMzQzNTY1NjEyZDM4MzQ2NjMwMmQ2NjYyMzYzMDM3NjIzODM3MzgzOTYxNjIyZTYzNmM2OTYzNmIyZjM2MzQ2MzY0NjUzMDM0MzAyZDMyMzIzMzM1MmQzNDM1NjI2NTJkNjEzMzY2MzYyZDM0NjQ2MzY0MzY2MzM4MzgzNjY0NjI2NTJlNzA2ODcw%27%29.replace%28%2F%28..%29%2Fg%2C%20%27%25%241%27%29%29%3B%22%3E)"; flow:established,to_server; http.uri; content:"/nature-warrior.php?source=%22%2F%3E%3Cimg%20src%3D%22https%3A%2F%2Fgoogle.com%2FwyFp7fKX3WVRb.jpg%22%20onerror%3D%22window.location%3DdecodeURIComponent%28atob%28%27Njg3NDc0NzA3MzNhMmYyZjc2NmI2OTYxNzI2OTZjMmU2MzYxMzY2MTM4NjIzNzM0MmQzMzMyNjE2MzJkMzQzNTY1NjEyZDM4MzQ2NjMwMmQ2NjYyMzYzMDM3NjIzODM3MzgzOTYxNjIyZTYzNmM2OTYzNmIyZjM2MzQ2MzY0NjUzMDM0MzAyZDMyMzIzMzM1MmQzNDM1NjI2NTJkNjEzMzY2MzYyZDM0NjQ2MzY0MzY2MzM4MzgzNjY0NjI2NTJlNzA2ODcw%27%29.replace%28%2F%28..%29%2Fg%2C%20%27%25%241%27%29%29%3B%22%3E"; startswith; fast_pattern; http.host; content:"join.wwfindia.org"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005351; classtype:social-engineering; sid:6005351; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whimsical.com/valerie-gueret-dehee-XaXNjrmkdbtBG2G7NyskVK)"; flow:established,to_server; http.uri; content:"/valerie-gueret-dehee-XaXNjrmkdbtBG2G7NyskVK"; startswith; fast_pattern; http.host; content:"whimsical.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005352; classtype:social-engineering; sid:6005352; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netempresa.novaagencia.digital/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netempresa.novaagencia.digital"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005353; classtype:social-engineering; sid:6005353; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dupest.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dupest.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005354; classtype:social-engineering; sid:6005354; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (formulario-digital-citas-ajyh-2026.cr-web.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"formulario-digital-citas-ajyh-2026.cr-web.workers.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005355; classtype:social-engineering; sid:6005355; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.france-peageinfo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.france-peageinfo.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005356; classtype:social-engineering; sid:6005356; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (airmileswebmailupdateapp.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"airmileswebmailupdateapp.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005357; classtype:social-engineering; sid:6005357; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (elshadaydigital.online/provincia/)"; flow:established,to_server; http.uri; content:"/provincia/"; startswith; fast_pattern; http.host; content:"elshadaydigital.online"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005358; classtype:social-engineering; sid:6005358; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bhd-leon-2026-rd.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bhd-leon-2026-rd.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005359; classtype:social-engineering; sid:6005359; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (certificado.cidconsultoria.es/RAIOLANETWORKSES/?839GH120LK=78QWErT)"; flow:established,to_server; http.uri; content:"/RAIOLANETWORKSES/?839GH120LK=78QWErT"; startswith; fast_pattern; http.host; content:"certificado.cidconsultoria.es"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005360; classtype:social-engineering; sid:6005360; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hydrogen-raindrop.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hydrogen-raindrop.netlify.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005361; classtype:social-engineering; sid:6005361; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (frtiiips.sviluppo.host/serafi/page/index.php)"; flow:established,to_server; http.uri; content:"/serafi/page/index.php"; startswith; fast_pattern; http.host; content:"frtiiips.sviluppo.host"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005362; classtype:social-engineering; sid:6005362; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (airmilesrewardprogramteam.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"airmilesrewardprogramteam.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005363; classtype:social-engineering; sid:6005363; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blingcompte0029-dot-yamm-track.appspot.com/2JbvZRzHIGWotWNKzj49MrBC6i1FvTe5EOb_-8DSsgVphHsw_ngEO_LrYorCQ9UFc-5l7zDleO7c0uBsfb5LP4abzfvAXr9UII0XOcmCD0JTWwd8KZoUhFh-Ex8sFZjxfEtXB7Z6MCwdJt4bptycgEg2D1AOBQkqIJJ29XnFWukDWIPHHbV5kEbRtls0)"; flow:established,to_server; http.uri; content:"/2JbvZRzHIGWotWNKzj49MrBC6i1FvTe5EOb_-8DSsgVphHsw_ngEO_LrYorCQ9UFc-5l7zDleO7c0uBsfb5LP4abzfvAXr9UII0XOcmCD0JTWwd8KZoUhFh-Ex8sFZjxfEtXB7Z6MCwdJt4bptycgEg2D1AOBQkqIJJ29XnFWukDWIPHHbV5kEbRtls0"; startswith; fast_pattern; http.host; content:"blingcompte0029-dot-yamm-track.appspot.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005364; classtype:social-engineering; sid:6005364; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (socgen-annulation.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"socgen-annulation.duckdns.org"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005365; classtype:social-engineering; sid:6005365; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xn--portaildemisejouradmin-q2b.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xn--portaildemisejouradmin-q2b.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005366; classtype:social-engineering; sid:6005366; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lnlcl0-sesi0n-llean.xo.je/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lnlcl0-sesi0n-llean.xo.je"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005367; classtype:social-engineering; sid:6005367; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dop-cancele-compra-bhd-aqui-dom.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dop-cancele-compra-bhd-aqui-dom.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005368; classtype:social-engineering; sid:6005368; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rediffmaildatabase.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rediffmaildatabase.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005369; classtype:social-engineering; sid:6005369; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (malaysiaupdateforalludate.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"malaysiaupdateforalludate.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005370; classtype:social-engineering; sid:6005370; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (linkin.bio/punktumsolution/)"; flow:established,to_server; http.uri; content:"/punktumsolution/"; startswith; fast_pattern; http.host; content:"linkin.bio"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005371; classtype:social-engineering; sid:6005371; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (superlogin-pchincha.zya.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"superlogin-pchincha.zya.me"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005372; classtype:social-engineering; sid:6005372; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abvvbgg.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"abvvbgg.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005373; classtype:social-engineering; sid:6005373; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (france-peageinfo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"france-peageinfo.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005374; classtype:social-engineering; sid:6005374; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (33947294-da73-4a53-8b06-a9c421bc016c-00-3p4ufgg4h88di.riker.replit.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"33947294-da73-4a53-8b06-a9c421bc016c-00-3p4ufgg4h88di.riker.replit.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005375; classtype:social-engineering; sid:6005375; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ogifudytrhjyu.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ogifudytrhjyu.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005376; classtype:social-engineering; sid:6005376; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gvtcpages.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gvtcpages.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005377; classtype:social-engineering; sid:6005377; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bnp-paribas-line-com-69ym.bolt.host/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bnp-paribas-line-com-69ym.bolt.host"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005378; classtype:social-engineering; sid:6005378; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bnp-paribas-line-com-69ym.bolt.host/index.php)"; flow:established,to_server; http.uri; content:"/index.php"; startswith; fast_pattern; http.host; content:"bnp-paribas-line-com-69ym.bolt.host"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005379; classtype:social-engineering; sid:6005379; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gestionsecuritybac.iceiy.com/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"gestionsecuritybac.iceiy.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005380; classtype:social-engineering; sid:6005380; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bt-trustbank.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bt-trustbank.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005381; classtype:social-engineering; sid:6005381; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (procesosfalabellavirtual-ilxo.onrender.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"procesosfalabellavirtual-ilxo.onrender.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005382; classtype:social-engineering; sid:6005382; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (airmilesvalidatsaaps.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"airmilesvalidatsaaps.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005383; classtype:social-engineering; sid:6005383; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (annamicheli.it/aa)"; flow:established,to_server; http.uri; content:"/aa"; startswith; fast_pattern; http.host; content:"annamicheli.it"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005384; classtype:social-engineering; sid:6005384; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (220824799531836837.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"220824799531836837.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005385; classtype:social-engineering; sid:6005385; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nhy6678.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nhy6678.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005386; classtype:social-engineering; sid:6005386; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anweshpawar.github.io/netflix-clone-responsive)"; flow:established,to_server; http.uri; content:"/netflix-clone-responsive"; startswith; fast_pattern; http.host; content:"anweshpawar.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005387; classtype:social-engineering; sid:6005387; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.zh-keringcenter.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.zh-keringcenter.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005388; classtype:social-engineering; sid:6005388; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5513333.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"5513333.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005389; classtype:social-engineering; sid:6005389; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bet3658888.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bet3658888.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005390; classtype:social-engineering; sid:6005390; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shejiao-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shejiao-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005391; classtype:social-engineering; sid:6005391; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lakshminarayana-241.github.io/Airbnbwebsite)"; flow:established,to_server; http.uri; content:"/Airbnbwebsite"; startswith; fast_pattern; http.host; content:"lakshminarayana-241.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005392; classtype:social-engineering; sid:6005392; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nbufvh.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nbufvh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005393; classtype:social-engineering; sid:6005393; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.converselqrdw.help/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.converselqrdw.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005394; classtype:social-engineering; sid:6005394; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoportunidade.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoportunidade.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005395; classtype:social-engineering; sid:6005395; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hassanraza039.github.io/Amazon-Clone-Website/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone-Website/"; startswith; fast_pattern; http.host; content:"hassanraza039.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005396; classtype:social-engineering; sid:6005396; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (electoral-plum-x813sremvw.edgeone.app/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"electoral-plum-x813sremvw.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005397; classtype:social-engineering; sid:6005397; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ayaankhan224.github.io/amazom/)"; flow:established,to_server; http.uri; content:"/amazom/"; startswith; fast_pattern; http.host; content:"ayaankhan224.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005398; classtype:social-engineering; sid:6005398; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web.binancne.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web.binancne.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005399; classtype:social-engineering; sid:6005399; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (heklservnic.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"heklservnic.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005400; classtype:social-engineering; sid:6005400; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.crafty-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.crafty-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005401; classtype:social-engineering; sid:6005401; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.converselhkcs.help/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.converselhkcs.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005402; classtype:social-engineering; sid:6005402; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (groougrdfhbsjfr.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"groougrdfhbsjfr.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005403; classtype:social-engineering; sid:6005403; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.conversexbyr.help/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.conversexbyr.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005404; classtype:social-engineering; sid:6005404; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qpuzxh.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qpuzxh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005405; classtype:social-engineering; sid:6005405; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (16320.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"16320.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005406; classtype:social-engineering; sid:6005406; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ajwivn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ajwivn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005407; classtype:social-engineering; sid:6005407; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.azctkg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.azctkg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005408; classtype:social-engineering; sid:6005408; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (samiarshad2715-tech.github.io/AmazonClone)"; flow:established,to_server; http.uri; content:"/AmazonClone"; startswith; fast_pattern; http.host; content:"samiarshad2715-tech.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005409; classtype:social-engineering; sid:6005409; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopeetbk9557.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopeetbk9557.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005410; classtype:social-engineering; sid:6005410; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.9555365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.9555365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005411; classtype:social-engineering; sid:6005411; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cpcontacts.98-70-36-140.cprapid.com/art?c_ds_na=4Vm8sLB0Ukz40CCymJClIl4HaYlIDGvYxgUVy03Xjs&c_ds_no=%2A%2F%2A)"; flow:established,to_server; http.uri; content:"/art?c_ds_na=4Vm8sLB0Ukz40CCymJClIl4HaYlIDGvYxgUVy03Xjs&c_ds_no=%2A%2F%2A"; startswith; fast_pattern; http.host; content:"cpcontacts.98-70-36-140.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005412; classtype:social-engineering; sid:6005412; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.code-paste-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.code-paste-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005413; classtype:social-engineering; sid:6005413; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ydslpb.top/pay/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.ydslpb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005414; classtype:social-engineering; sid:6005414; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xkyghb.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xkyghb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005415; classtype:social-engineering; sid:6005415; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-cam.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-cam.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005416; classtype:social-engineering; sid:6005416; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (multipropositolosandes.com/DavidGarcelon/accor.html)"; flow:established,to_server; http.uri; content:"/DavidGarcelon/accor.html"; startswith; fast_pattern; http.host; content:"multipropositolosandes.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005417; classtype:social-engineering; sid:6005417; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tokelpocket.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.tokelpocket.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005418; classtype:social-engineering; sid:6005418; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vrodyg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vrodyg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005419; classtype:social-engineering; sid:6005419; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kp8990.github.io/streaming_platform_ui/)"; flow:established,to_server; http.uri; content:"/streaming_platform_ui/"; startswith; fast_pattern; http.host; content:"kp8990.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005420; classtype:social-engineering; sid:6005420; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (microcix.com/tmp/dkb/dkb/Login/)"; flow:established,to_server; http.uri; content:"/tmp/dkb/dkb/Login/"; startswith; fast_pattern; http.host; content:"microcix.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005421; classtype:social-engineering; sid:6005421; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ai-canva.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ai-canva.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005422; classtype:social-engineering; sid:6005422; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.prkzqnm.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.prkzqnm.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005423; classtype:social-engineering; sid:6005423; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.yzqpkmr.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.yzqpkmr.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005424; classtype:social-engineering; sid:6005424; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-live-downllad.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-live-downllad.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005425; classtype:social-engineering; sid:6005425; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lomrbz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lomrbz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005426; classtype:social-engineering; sid:6005426; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appspace-1778830427133.staticrun.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"appspace-1778830427133.staticrun.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005427; classtype:social-engineering; sid:6005427; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rkczov.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rkczov.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005428; classtype:social-engineering; sid:6005428; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7nz4mw.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7nz4mw.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005429; classtype:social-engineering; sid:6005429; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.meihuo-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.meihuo-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005430; classtype:social-engineering; sid:6005430; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pharmnet.com.cn/dir/go.cgi)"; flow:established,to_server; http.uri; content:"/dir/go.cgi"; startswith; fast_pattern; http.host; content:"www.pharmnet.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005431; classtype:social-engineering; sid:6005431; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.yorvexan.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.yorvexan.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005432; classtype:social-engineering; sid:6005432; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docs-hardware-trezor.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"docs-hardware-trezor.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005433; classtype:social-engineering; sid:6005433; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.swxgjp.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.swxgjp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005434; classtype:social-engineering; sid:6005434; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (step.zeitschriftenhandel.org/PL-1466-160526/?u=81C1466&e=falossys@611e7223a361b1b7d454f56c011383aa8dfb.com&s3=Marek&s4=Stru00f3u017c&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/PL-1466-160526/?u=81C1466&e=falossys@611e7223a361b1b7d454f56c011383aa8dfb.com&s3=Marek&s4=Stru00f3u017c&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"step.zeitschriftenhandel.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005435; classtype:social-engineering; sid:6005435; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeeleaz.com/pt-BR)"; flow:established,to_server; http.uri; content:"/pt-BR"; startswith; fast_pattern; http.host; content:"shopeeleaz.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005436; classtype:social-engineering; sid:6005436; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (w8n1q5.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"w8n1q5.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005437; classtype:social-engineering; sid:6005437; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clearshaven.com/scwq7rrD)"; flow:established,to_server; http.uri; content:"/scwq7rrD"; startswith; fast_pattern; http.host; content:"clearshaven.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005438; classtype:social-engineering; sid:6005438; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fngg.skin/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fngg.skin"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005439; classtype:social-engineering; sid:6005439; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jyfolg.top/pay/a_shop.html)"; flow:established,to_server; http.uri; content:"/pay/a_shop.html"; startswith; fast_pattern; http.host; content:"t-mobile.jyfolg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005440; classtype:social-engineering; sid:6005440; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.edgefinancialportal.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.edgefinancialportal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005441; classtype:social-engineering; sid:6005441; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.converselktvm.help/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.converselktvm.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005442; classtype:social-engineering; sid:6005442; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth4cgdnb-556-38dhdee-authorize-response.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auth4cgdnb-556-38dhdee-authorize-response.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005443; classtype:social-engineering; sid:6005443; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.jiankang-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.jiankang-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005444; classtype:social-engineering; sid:6005444; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sfke-cahmcjf3b4fagvat.z03.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sfke-cahmcjf3b4fagvat.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005445; classtype:social-engineering; sid:6005445; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.converselfpnv.help/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.converselfpnv.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005446; classtype:social-engineering; sid:6005446; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anweshpawar.github.io/netflix-clone-responsive-v2)"; flow:established,to_server; http.uri; content:"/netflix-clone-responsive-v2"; startswith; fast_pattern; http.host; content:"anweshpawar.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005447; classtype:social-engineering; sid:6005447; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pcwcc-ooooooooooooooooooooooooooooooooooooo.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pcwcc-ooooooooooooooooooooooooooooooooooooo.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005448; classtype:social-engineering; sid:6005448; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.converselqnrk.help/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.converselqnrk.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005449; classtype:social-engineering; sid:6005449; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cxivwiqhtovajfk3stvuvqfmfwlkt6a3opjmf5kxwkdzpanw3jrq.arweave.net/FdFbIgebqgSVW5TrSsCsLZap-Btz0sL1V7KHl4G22mM)"; flow:established,to_server; http.uri; content:"/FdFbIgebqgSVW5TrSsCsLZap-Btz0sL1V7KHl4G22mM"; startswith; fast_pattern; http.host; content:"cxivwiqhtovajfk3stvuvqfmfwlkt6a3opjmf5kxwkdzpanw3jrq.arweave.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005450; classtype:social-engineering; sid:6005450; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sharepoiint.shop/?email=Asalal@87aae532b12d8c9af93b7d265858975919df.com)"; flow:established,to_server; http.uri; content:"/?email=Asalal@87aae532b12d8c9af93b7d265858975919df.com"; startswith; fast_pattern; http.host; content:"sharepoiint.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005451; classtype:social-engineering; sid:6005451; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (growth-agency.busines-help-center.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"growth-agency.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005452; classtype:social-engineering; sid:6005452; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support-instagram.github.io/login/)"; flow:established,to_server; http.uri; content:"/login/"; startswith; fast_pattern; http.host; content:"support-instagram.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005453; classtype:social-engineering; sid:6005453; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.yvlxqrm.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.yvlxqrm.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005454; classtype:social-engineering; sid:6005454; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.xupqaunzd.one/uqjmw/)"; flow:established,to_server; http.uri; content:"/uqjmw/"; startswith; fast_pattern; http.host; content:"usps.xupqaunzd.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005455; classtype:social-engineering; sid:6005455; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ct-freeman-daveon.pages.dev/help/contact/477345561091946/)"; flow:established,to_server; http.uri; content:"/help/contact/477345561091946/"; startswith; fast_pattern; http.host; content:"ct-freeman-daveon.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005456; classtype:social-engineering; sid:6005456; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-1ogin.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-1ogin.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005457; classtype:social-engineering; sid:6005457; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sportscars.if1.us/styl/rock/)"; flow:established,to_server; http.uri; content:"/styl/rock/"; startswith; fast_pattern; http.host; content:"sportscars.if1.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005458; classtype:social-engineering; sid:6005458; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rwesay.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rwesay.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005459; classtype:social-engineering; sid:6005459; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.osgrlx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.osgrlx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005460; classtype:social-engineering; sid:6005460; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (canva-kh.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"canva-kh.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005461; classtype:social-engineering; sid:6005461; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tqvwzc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tqvwzc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005462; classtype:social-engineering; sid:6005462; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingk.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005463; classtype:social-engineering; sid:6005463; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clearshaven.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"clearshaven.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005464; classtype:social-engineering; sid:6005464; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jyfolg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jyfolg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005465; classtype:social-engineering; sid:6005465; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.oqivux.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.oqivux.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005466; classtype:social-engineering; sid:6005466; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.converselfleu.help/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.converselfleu.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005467; classtype:social-engineering; sid:6005467; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.yonghu-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.yonghu-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005468; classtype:social-engineering; sid:6005468; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.converseoaur.help/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.converseoaur.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005469; classtype:social-engineering; sid:6005469; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (breezy-onion-695203.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"breezy-onion-695203.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005470; classtype:social-engineering; sid:6005470; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticuc.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticuc.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005471; classtype:social-engineering; sid:6005471; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fast-secure-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fast-secure-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005472; classtype:social-engineering; sid:6005472; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (multipropositolosandes.com/ThePlanningCenter/LexyWellot.html)"; flow:established,to_server; http.uri; content:"/ThePlanningCenter/LexyWellot.html"; startswith; fast_pattern; http.host; content:"multipropositolosandes.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005473; classtype:social-engineering; sid:6005473; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (772davron.github.io/instagram/)"; flow:established,to_server; http.uri; content:"/instagram/"; startswith; fast_pattern; http.host; content:"772davron.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005474; classtype:social-engineering; sid:6005474; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mhusgd.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mhusgd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005475; classtype:social-engineering; sid:6005475; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (warasuto.com/a/b)"; flow:established,to_server; http.uri; content:"/a/b"; startswith; fast_pattern; http.host; content:"warasuto.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005476; classtype:social-engineering; sid:6005476; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (789789365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"789789365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005477; classtype:social-engineering; sid:6005477; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ziwqor.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ziwqor.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005478; classtype:social-engineering; sid:6005478; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (85f6622c.candy-se354df.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"85f6622c.candy-se354df.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005479; classtype:social-engineering; sid:6005479; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (arweave.net/FdFbIgebqgSVW5TrSsCsLZap-Btz0sL1V7KHl4G22mM)"; flow:established,to_server; http.uri; content:"/FdFbIgebqgSVW5TrSsCsLZap-Btz0sL1V7KHl4G22mM"; startswith; fast_pattern; http.host; content:"arweave.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005480; classtype:social-engineering; sid:6005480; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (multipropositolosandes.com/AngelCividanes/servusgroup.html)"; flow:established,to_server; http.uri; content:"/AngelCividanes/servusgroup.html"; startswith; fast_pattern; http.host; content:"multipropositolosandes.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005481; classtype:social-engineering; sid:6005481; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (djmikekelly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"djmikekelly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005482; classtype:social-engineering; sid:6005482; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1555365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1555365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005483; classtype:social-engineering; sid:6005483; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vip.freeeus.us/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vip.freeeus.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005484; classtype:social-engineering; sid:6005484; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fncost.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fncost.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005485; classtype:social-engineering; sid:6005485; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gtmfrancez.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gtmfrancez.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005486; classtype:social-engineering; sid:6005486; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.yvlnqrm.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.yvlnqrm.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005487; classtype:social-engineering; sid:6005487; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ultrajaaumento7.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"ultrajaaumento7.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005488; classtype:social-engineering; sid:6005488; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.yvlnqbm.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.yvlnqbm.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005489; classtype:social-engineering; sid:6005489; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abdullah-2r.github.io/project_netflix)"; flow:established,to_server; http.uri; content:"/project_netflix"; startswith; fast_pattern; http.host; content:"abdullah-2r.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005490; classtype:social-engineering; sid:6005490; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wishoped.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wishoped.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005491; classtype:social-engineering; sid:6005491; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hkmxwc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hkmxwc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005492; classtype:social-engineering; sid:6005492; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1320365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1320365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005493; classtype:social-engineering; sid:6005493; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (office365spaines.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"office365spaines.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005494; classtype:social-engineering; sid:6005494; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pcdsok.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pcdsok.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005495; classtype:social-engineering; sid:6005495; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (btinternetdgfhgh-100706.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"btinternetdgfhgh-100706.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005496; classtype:social-engineering; sid:6005496; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.zhencheng-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.zhencheng-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005497; classtype:social-engineering; sid:6005497; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamsk-logei--org.gitbook.io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"metamsk-logei--org.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005498; classtype:social-engineering; sid:6005498; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.diagnosticsplus.ph/sbmg/fund.html)"; flow:established,to_server; http.uri; content:"/sbmg/fund.html"; startswith; fast_pattern; http.host; content:"www.diagnosticsplus.ph"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005499; classtype:social-engineering; sid:6005499; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mdsadik110032.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"mdsadik110032.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005500; classtype:social-engineering; sid:6005500; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (briivradev.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"briivradev.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005501; classtype:social-engineering; sid:6005501; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.conversesgzo.help/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.conversesgzo.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005502; classtype:social-engineering; sid:6005502; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (66365365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"66365365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005503; classtype:social-engineering; sid:6005503; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.duwjvp.top/pay/d_sms.html)"; flow:established,to_server; http.uri; content:"/pay/d_sms.html"; startswith; fast_pattern; http.host; content:"t-mobile.duwjvp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005504; classtype:social-engineering; sid:6005504; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.converseljwfc.help/pay/a_shop.html)"; flow:established,to_server; http.uri; content:"/pay/a_shop.html"; startswith; fast_pattern; http.host; content:"t-mobile.converseljwfc.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005505; classtype:social-engineering; sid:6005505; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortscore.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortscore.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005506; classtype:social-engineering; sid:6005506; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pdf-online-sundae-e445e5.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pdf-online-sundae-e445e5.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005507; classtype:social-engineering; sid:6005507; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hrtasn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hrtasn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005508; classtype:social-engineering; sid:6005508; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.bycang.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.bycang.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005509; classtype:social-engineering; sid:6005509; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeetbk9557.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopeetbk9557.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005510; classtype:social-engineering; sid:6005510; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ogrkpy.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ogrkpy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005511; classtype:social-engineering; sid:6005511; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp-qww.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp-qww.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005512; classtype:social-engineering; sid:6005512; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sacp.algoma.it/hub)"; flow:established,to_server; http.uri; content:"/hub"; startswith; fast_pattern; http.host; content:"sacp.algoma.it"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005513; classtype:social-engineering; sid:6005513; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingh.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005514; classtype:social-engineering; sid:6005514; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (laynnandnaaxcicil.fascist.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"laynnandnaaxcicil.fascist.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005515; classtype:social-engineering; sid:6005515; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ebayusa.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ebayusa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005516; classtype:social-engineering; sid:6005516; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.smzkgx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.smzkgx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005517; classtype:social-engineering; sid:6005517; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.converselxhoq.help/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.converselxhoq.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005518; classtype:social-engineering; sid:6005518; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (feijitlg.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"feijitlg.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005519; classtype:social-engineering; sid:6005519; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ultrajaaumento6.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"ultrajaaumento6.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005520; classtype:social-engineering; sid:6005520; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bjpnom.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bjpnom.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005521; classtype:social-engineering; sid:6005521; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.converselrqmc.help/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.converselrqmc.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005522; classtype:social-engineering; sid:6005522; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.orfwms.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.orfwms.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005523; classtype:social-engineering; sid:6005523; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (r.oblox.com.et/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"r.oblox.com.et"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005524; classtype:social-engineering; sid:6005524; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tvslmz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tvslmz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005525; classtype:social-engineering; sid:6005525; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f1nancier.com/?r=f242b45c-7411-4c59-879a-08bcb52b386d)"; flow:established,to_server; http.uri; content:"/?r=f242b45c-7411-4c59-879a-08bcb52b386d"; startswith; fast_pattern; http.host; content:"f1nancier.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005526; classtype:social-engineering; sid:6005526; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.9268365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.9268365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005527; classtype:social-engineering; sid:6005527; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gpqjia.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gpqjia.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005528; classtype:social-engineering; sid:6005528; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ngvdui.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ngvdui.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005529; classtype:social-engineering; sid:6005529; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tough-biscuits-004851.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tough-biscuits-004851.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005530; classtype:social-engineering; sid:6005530; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spectrumtalentsearch-5tn.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spectrumtalentsearch-5tn.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005531; classtype:social-engineering; sid:6005531; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.npmejl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.npmejl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005532; classtype:social-engineering; sid:6005532; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abuscadamelhorasempre.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"abuscadamelhorasempre.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005533; classtype:social-engineering; sid:6005533; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (max-biz-oooooooooooo.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"max-biz-oooooooooooo.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005534; classtype:social-engineering; sid:6005534; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.xupqartk.shop/uqjmw/)"; flow:established,to_server; http.uri; content:"/uqjmw/"; startswith; fast_pattern; http.host; content:"usps.xupqartk.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005535; classtype:social-engineering; sid:6005535; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hbamwx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hbamwx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005536; classtype:social-engineering; sid:6005536; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (access-pichncha009.free.nf/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"access-pichncha009.free.nf"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005537; classtype:social-engineering; sid:6005537; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-1ogin.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-1ogin.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005538; classtype:social-engineering; sid:6005538; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (link.freeeus.us/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"link.freeeus.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005539; classtype:social-engineering; sid:6005539; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shop.freeeus.us/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shop.freeeus.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005540; classtype:social-engineering; sid:6005540; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ct-freeman-daveon.pages.dev/help/contact/572907777980684/)"; flow:established,to_server; http.uri; content:"/help/contact/572907777980684/"; startswith; fast_pattern; http.host; content:"ct-freeman-daveon.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005541; classtype:social-engineering; sid:6005541; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.htonve.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.htonve.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005542; classtype:social-engineering; sid:6005542; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.conversellkyj.help/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.conversellkyj.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005543; classtype:social-engineering; sid:6005543; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hskiq.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hskiq.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005544; classtype:social-engineering; sid:6005544; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robiox.com.gr/communities/4807680766/TayslidePlayss)"; flow:established,to_server; http.uri; content:"/communities/4807680766/TayslidePlayss"; startswith; fast_pattern; http.host; content:"robiox.com.gr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005545; classtype:social-engineering; sid:6005545; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.iovncq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.iovncq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005546; classtype:social-engineering; sid:6005546; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.freeeus.us/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.freeeus.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005547; classtype:social-engineering; sid:6005547; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.emyzbc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.emyzbc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005548; classtype:social-engineering; sid:6005548; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (scale-agency.busines-help-center.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"scale-agency.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005549; classtype:social-engineering; sid:6005549; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1330365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1330365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005550; classtype:social-engineering; sid:6005550; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticiw.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.pcn-noticiw.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005551; classtype:social-engineering; sid:6005551; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lmcoif.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lmcoif.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005552; classtype:social-engineering; sid:6005552; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-scotasist-cl-production.moklabs.com/users/sign_in)"; flow:established,to_server; http.uri; content:"/users/sign_in"; startswith; fast_pattern; http.host; content:"sso-scotasist-cl-production.moklabs.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005553; classtype:social-engineering; sid:6005553; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ct-freeman-daveon.pages.dev/help/contact/613233487492591/)"; flow:established,to_server; http.uri; content:"/help/contact/613233487492591/"; startswith; fast_pattern; http.host; content:"ct-freeman-daveon.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005554; classtype:social-engineering; sid:6005554; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fnpsji.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.fnpsji.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005555; classtype:social-engineering; sid:6005555; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lipszb.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lipszb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005556; classtype:social-engineering; sid:6005556; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bxdnyw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bxdnyw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005557; classtype:social-engineering; sid:6005557; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ouvedk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ouvedk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005558; classtype:social-engineering; sid:6005558; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-mi.info/help?qmw)"; flow:established,to_server; http.uri; content:"/help?qmw"; startswith; fast_pattern; http.host; content:"account-mi.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005559; classtype:social-engineering; sid:6005559; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rt-s-c4fef.web.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rt-s-c4fef.web.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005560; classtype:social-engineering; sid:6005560; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ls-labsolutions.de/Dawkins)"; flow:established,to_server; http.uri; content:"/Dawkins"; startswith; fast_pattern; http.host; content:"www.ls-labsolutions.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005561; classtype:social-engineering; sid:6005561; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hardciderman.com/?MnxAS1S)"; flow:established,to_server; http.uri; content:"/?MnxAS1S"; startswith; fast_pattern; http.host; content:"hardciderman.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005562; classtype:social-engineering; sid:6005562; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kakefot735bezill.crabdance.com/NBJGUHY-SBDGFCVDF/LHKJOUI-CQDSEZXA/VFGTHY-PMOLKJU/)"; flow:established,to_server; http.uri; content:"/NBJGUHY-SBDGFCVDF/LHKJOUI-CQDSEZXA/VFGTHY-PMOLKJU/"; startswith; fast_pattern; http.host; content:"kakefot735bezill.crabdance.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005563; classtype:social-engineering; sid:6005563; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qzdugx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qzdugx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005564; classtype:social-engineering; sid:6005564; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (com.cnwww.whats-kr-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"com.cnwww.whats-kr-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005565; classtype:social-engineering; sid:6005565; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (id.milestonelogin.com/4321ea88-b4d3-4729-a8db-e18baa8c6f30/oauth2/v2.0/authorize/)"; flow:established,to_server; http.uri; content:"/4321ea88-b4d3-4729-a8db-e18baa8c6f30/oauth2/v2.0/authorize/"; startswith; fast_pattern; http.host; content:"id.milestonelogin.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005566; classtype:social-engineering; sid:6005566; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (candy-se354df.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"candy-se354df.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005567; classtype:social-engineering; sid:6005567; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.esmoip.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.esmoip.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005568; classtype:social-engineering; sid:6005568; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spandana-shivraj.github.io/webtask4/)"; flow:established,to_server; http.uri; content:"/webtask4/"; startswith; fast_pattern; http.host; content:"spandana-shivraj.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005569; classtype:social-engineering; sid:6005569; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chcn-ouyisports.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"chcn-ouyisports.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005570; classtype:social-engineering; sid:6005570; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoimpoderado.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoimpoderado.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005571; classtype:social-engineering; sid:6005571; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xoilwz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xoilwz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005572; classtype:social-engineering; sid:6005572; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shipin-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shipin-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005573; classtype:social-engineering; sid:6005573; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qnlbev.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qnlbev.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005574; classtype:social-engineering; sid:6005574; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qigdky.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qigdky.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005575; classtype:social-engineering; sid:6005575; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.amazonvipp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazonvipp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005576; classtype:social-engineering; sid:6005576; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (darshan-38.github.io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"darshan-38.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005577; classtype:social-engineering; sid:6005577; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jzuhgn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jzuhgn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005578; classtype:social-engineering; sid:6005578; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.htufgk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.htufgk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005579; classtype:social-engineering; sid:6005579; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wxvcby.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wxvcby.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005580; classtype:social-engineering; sid:6005580; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.9238365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.9238365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005581; classtype:social-engineering; sid:6005581; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.daxing-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.daxing-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005582; classtype:social-engineering; sid:6005582; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.divapo.top/pay/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.divapo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005583; classtype:social-engineering; sid:6005583; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2345665432.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2345665432.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005584; classtype:social-engineering; sid:6005584; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcn-noticyb.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.pcn-noticyb.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005585; classtype:social-engineering; sid:6005585; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (g12p.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"g12p.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005586; classtype:social-engineering; sid:6005586; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (svip-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"svip-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005587; classtype:social-engineering; sid:6005587; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (parvathinelli703-rgb.github.io/netflix_webpage/)"; flow:established,to_server; http.uri; content:"/netflix_webpage/"; startswith; fast_pattern; http.host; content:"parvathinelli703-rgb.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005588; classtype:social-engineering; sid:6005588; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qp-tbsports.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qp-tbsports.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005589; classtype:social-engineering; sid:6005589; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ngvaws.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ngvaws.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005590; classtype:social-engineering; sid:6005590; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-mi.info/qmw)"; flow:established,to_server; http.uri; content:"/qmw"; startswith; fast_pattern; http.host; content:"account-mi.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005591; classtype:social-engineering; sid:6005591; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zrr.kr/o1sfDh)"; flow:established,to_server; http.uri; content:"/o1sfDh"; startswith; fast_pattern; http.host; content:"zrr.kr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005592; classtype:social-engineering; sid:6005592; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamsakwallct.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metamsakwallct.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005593; classtype:social-engineering; sid:6005593; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (novacart.ro/po/pages/login.php)"; flow:established,to_server; http.uri; content:"/po/pages/login.php"; startswith; fast_pattern; http.host; content:"novacart.ro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005594; classtype:social-engineering; sid:6005594; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kumnhr.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kumnhr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005595; classtype:social-engineering; sid:6005595; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myshop-711-com-tw.szvans.link/ht/kefu.php?ClickID=151&amount=0.00)"; flow:established,to_server; http.uri; content:"/ht/kefu.php?ClickID=151&amount=0.00"; startswith; fast_pattern; http.host; content:"myshop-711-com-tw.szvans.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005596; classtype:social-engineering; sid:6005596; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myshop-711-com-tw.szvans.link/ht/index.php?te=1&ClickID=151)"; flow:established,to_server; http.uri; content:"/ht/index.php?te=1&ClickID=151"; startswith; fast_pattern; http.host; content:"myshop-711-com-tw.szvans.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005597; classtype:social-engineering; sid:6005597; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (your-personalactivity.help/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"your-personalactivity.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005598; classtype:social-engineering; sid:6005598; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web.m-ouyisport.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web.m-ouyisport.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005599; classtype:social-engineering; sid:6005599; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paninticktscol.site/recargas/transaction/b-34f4)"; flow:established,to_server; http.uri; content:"/recargas/transaction/b-34f4"; startswith; fast_pattern; http.host; content:"paninticktscol.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005600; classtype:social-engineering; sid:6005600; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wmzruo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wmzruo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005601; classtype:social-engineering; sid:6005601; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (soporcoabepmx-01--sopoortcobaepmx.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"soporcoabepmx-01--sopoortcobaepmx.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005602; classtype:social-engineering; sid:6005602; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (microtv.ma/wp-includes/style/p/app/k/kj/hispeed/hispeed/ail.html)"; flow:established,to_server; http.uri; content:"/wp-includes/style/p/app/k/kj/hispeed/hispeed/ail.html"; startswith; fast_pattern; http.host; content:"microtv.ma"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005603; classtype:social-engineering; sid:6005603; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (primary-violet-2gtrhxcgtq.edgeone.app/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"primary-violet-2gtrhxcgtq.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005604; classtype:social-engineering; sid:6005604; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.oqnabi.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.oqnabi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005605; classtype:social-engineering; sid:6005605; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.postailedger.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.postailedger.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005606; classtype:social-engineering; sid:6005606; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wpczoj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wpczoj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005607; classtype:social-engineering; sid:6005607; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jacazzi-antiquites.com/sfd/grf/grfg/89/)"; flow:established,to_server; http.uri; content:"/sfd/grf/grfg/89/"; startswith; fast_pattern; http.host; content:"jacazzi-antiquites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005608; classtype:social-engineering; sid:6005608; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zh-canva.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zh-canva.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005609; classtype:social-engineering; sid:6005609; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yahooobcbb.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yahooobcbb.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005610; classtype:social-engineering; sid:6005610; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nongli168.hyddc.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nongli168.hyddc.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005611; classtype:social-engineering; sid:6005611; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.exajpc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.exajpc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005612; classtype:social-engineering; sid:6005612; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ruanjian-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ruanjian-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005613; classtype:social-engineering; sid:6005613; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xbjrtmq.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xbjrtmq.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005614; classtype:social-engineering; sid:6005614; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (htyd.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"htyd.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005615; classtype:social-engineering; sid:6005615; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mxqblrv.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.mxqblrv.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005616; classtype:social-engineering; sid:6005616; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (saldonuturbinado.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"saldonuturbinado.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005617; classtype:social-engineering; sid:6005617; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (feijicz.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"feijicz.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005618; classtype:social-engineering; sid:6005618; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2111365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2111365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005619; classtype:social-engineering; sid:6005619; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pklyqghwcuhgxaabfiwevxigsmsc.freemyip.com/bisvgqiqvzbcu/)"; flow:established,to_server; http.uri; content:"/bisvgqiqvzbcu/"; startswith; fast_pattern; http.host; content:"pklyqghwcuhgxaabfiwevxigsmsc.freemyip.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005620; classtype:social-engineering; sid:6005620; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (canva-pc.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"canva-pc.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005621; classtype:social-engineering; sid:6005621; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telegramom.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"telegramom.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005622; classtype:social-engineering; sid:6005622; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamsakwallct.gitbook.io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"metamsakwallct.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005623; classtype:social-engineering; sid:6005623; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (binancne.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"binancne.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005624; classtype:social-engineering; sid:6005624; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.robiox.co.in/users/40021847/profile)"; flow:established,to_server; http.uri; content:"/users/40021847/profile"; startswith; fast_pattern; http.host; content:"www.robiox.co.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005625; classtype:social-engineering; sid:6005625; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.lmxcoin.co/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app.lmxcoin.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005626; classtype:social-engineering; sid:6005626; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (php-76150sbbvaluchpass.wasmer.app/login.php)"; flow:established,to_server; http.uri; content:"/login.php"; startswith; fast_pattern; http.host; content:"php-76150sbbvaluchpass.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005627; classtype:social-engineering; sid:6005627; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (basic-9yousports.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"basic-9yousports.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005628; classtype:social-engineering; sid:6005628; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tqplvkb.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.tqplvkb.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005629; classtype:social-engineering; sid:6005629; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loginbellnetebill.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"loginbellnetebill.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005630; classtype:social-engineering; sid:6005630; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comlimiteja.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"comlimiteja.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005631; classtype:social-engineering; sid:6005631; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.heqkac.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.heqkac.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005632; classtype:social-engineering; sid:6005632; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (solroll.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"solroll.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005633; classtype:social-engineering; sid:6005633; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nbyplt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nbyplt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005634; classtype:social-engineering; sid:6005634; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cpcontacts.98-70-36-140.cprapid.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cpcontacts.98-70-36-140.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005635; classtype:social-engineering; sid:6005635; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.2345665432.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.2345665432.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005636; classtype:social-engineering; sid:6005636; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.converselidom.help/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.converselidom.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005637; classtype:social-engineering; sid:6005637; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.maxig.cl/xinfini/)"; flow:established,to_server; http.uri; content:"/xinfini/"; startswith; fast_pattern; http.host; content:"www.maxig.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005638; classtype:social-engineering; sid:6005638; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkinga.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkinga.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005639; classtype:social-engineering; sid:6005639; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web.archive-chat-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web.archive-chat-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005640; classtype:social-engineering; sid:6005640; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp-awo.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp-awo.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005641; classtype:social-engineering; sid:6005641; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.updwnm.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.updwnm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005642; classtype:social-engineering; sid:6005642; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wvwlistgtsfrsdrtosthts.fwh.is/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wvwlistgtsfrsdrtosthts.fwh.is"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005643; classtype:social-engineering; sid:6005643; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kcuyjo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kcuyjo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005644; classtype:social-engineering; sid:6005644; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.converselfpyc.help/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.converselfpyc.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005645; classtype:social-engineering; sid:6005645; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (600590.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"600590.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005646; classtype:social-engineering; sid:6005646; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamsk-logei--org.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metamsk-logei--org.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005647; classtype:social-engineering; sid:6005647; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ff.ffmodpro.in/panel-arrival/)"; flow:established,to_server; http.uri; content:"/panel-arrival/"; startswith; fast_pattern; http.host; content:"ff.ffmodpro.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005648; classtype:social-engineering; sid:6005648; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pinjamandenv2.inextart.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pinjamandenv2.inextart.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005649; classtype:social-engineering; sid:6005649; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (denisuco808.github.io/csstry/)"; flow:established,to_server; http.uri; content:"/csstry/"; startswith; fast_pattern; http.host; content:"denisuco808.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005650; classtype:social-engineering; sid:6005650; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wfpvjt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wfpvjt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005651; classtype:social-engineering; sid:6005651; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (denisuco808.github.io/Roblox.com)"; flow:established,to_server; http.uri; content:"/Roblox.com"; startswith; fast_pattern; http.host; content:"denisuco808.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005652; classtype:social-engineering; sid:6005652; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.conversellnpu.help/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.conversellnpu.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005653; classtype:social-engineering; sid:6005653; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.feyams.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.feyams.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005654; classtype:social-engineering; sid:6005654; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bqlvfj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bqlvfj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005655; classtype:social-engineering; sid:6005655; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mx8.freeeus.us/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mx8.freeeus.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005656; classtype:social-engineering; sid:6005656; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.195xxx195.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.195xxx195.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005657; classtype:social-engineering; sid:6005657; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingx.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingx.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005658; classtype:social-engineering; sid:6005658; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-reels-fofocajds-id72h.github.io/L)"; flow:established,to_server; http.uri; content:"/L"; startswith; fast_pattern; http.host; content:"instagram-reels-fofocajds-id72h.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005659; classtype:social-engineering; sid:6005659; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kwzvti.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kwzvti.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005660; classtype:social-engineering; sid:6005660; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.letnie-okazje642544.cyou/oferta/Meble-tarasowe---ogrodowe-Nowoczesny-gruby-profil-Aluminium-Dostawa-Gratis-xngfl4)"; flow:established,to_server; http.uri; content:"/oferta/Meble-tarasowe---ogrodowe-Nowoczesny-gruby-profil-Aluminium-Dostawa-Gratis-xngfl4"; startswith; fast_pattern; http.host; content:"allegrolokalnie.letnie-okazje642544.cyou"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005661; classtype:social-engineering; sid:6005661; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gerard.info-9726105.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gerard.info-9726105.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005662; classtype:social-engineering; sid:6005662; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cqddswpwncsxrqfcdxffyvvetxjbdc.s3.us-west-1.amazonaws.com/xnhjqmzmjauxoqrkwlosthfpycmmcq/zgxugzganxrqgjqrmitjauxh.html)"; flow:established,to_server; http.uri; content:"/xnhjqmzmjauxoqrkwlosthfpycmmcq/zgxugzganxrqgjqrmitjauxh.html"; startswith; fast_pattern; http.host; content:"cqddswpwncsxrqfcdxffyvvetxjbdc.s3.us-west-1.amazonaws.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005663; classtype:social-engineering; sid:6005663; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1aueb-gr.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1aueb-gr.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005664; classtype:social-engineering; sid:6005664; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (homestart-ldjercdn.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"homestart-ldjercdn.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005665; classtype:social-engineering; sid:6005665; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kjytdtruyukufjdhjck.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kjytdtruyukufjdhjck.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005666; classtype:social-engineering; sid:6005666; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (multi-factor.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"multi-factor.webflow.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005667; classtype:social-engineering; sid:6005667; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3242329-gwdg.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3242329-gwdg.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005668; classtype:social-engineering; sid:6005668; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (baccredomaticaccesoi.help/pa)"; flow:established,to_server; http.uri; content:"/pa"; startswith; fast_pattern; http.host; content:"baccredomaticaccesoi.help"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005669; classtype:social-engineering; sid:6005669; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loginbac.help/pa)"; flow:established,to_server; http.uri; content:"/pa"; startswith; fast_pattern; http.host; content:"loginbac.help"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005670; classtype:social-engineering; sid:6005670; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vrfeverwise.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vrfeverwise.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005671; classtype:social-engineering; sid:6005671; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brilliant-artboard-531043.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"brilliant-artboard-531043.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005672; classtype:social-engineering; sid:6005672; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fatima.urge5718504.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fatima.urge5718504.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005673; classtype:social-engineering; sid:6005673; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paul.info-9726105.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paul.info-9726105.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005674; classtype:social-engineering; sid:6005674; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (edyuyu7oikop.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"edyuyu7oikop.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005675; classtype:social-engineering; sid:6005675; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gregory.urge5718504.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gregory.urge5718504.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005676; classtype:social-engineering; sid:6005676; rev:1; metadata: signature_severity Major, created_et 2026_05_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (io-coinledgar-apps.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"io-coinledgar-apps.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005677; classtype:social-engineering; sid:6005677; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (entrarbac.help/pa)"; flow:established,to_server; http.uri; content:"/pa"; startswith; fast_pattern; http.host; content:"entrarbac.help"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005678; classtype:social-engineering; sid:6005678; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ourrwtime.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ourrwtime.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005679; classtype:social-engineering; sid:6005679; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jeremie.info-9726105.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jeremie.info-9726105.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005680; classtype:social-engineering; sid:6005680; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bellsouth-att-sign-in-6d37a8.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bellsouth-att-sign-in-6d37a8.webflow.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005681; classtype:social-engineering; sid:6005681; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wrightttpattcu.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wrightttpattcu.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005682; classtype:social-engineering; sid:6005682; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bacentrar.help/pa)"; flow:established,to_server; http.uri; content:"/pa"; startswith; fast_pattern; http.host; content:"bacentrar.help"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005683; classtype:social-engineering; sid:6005683; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (weber.urge5718504.pro/captcha.php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"weber.urge5718504.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005684; classtype:social-engineering; sid:6005684; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (assault-fire-free-guns-and-avatars-2016.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"assault-fire-free-guns-and-avatars-2016.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005685; classtype:social-engineering; sid:6005685; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webservicemail2.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webservicemail2.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005686; classtype:social-engineering; sid:6005686; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iotrzrrstart.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"iotrzrrstart.zapier.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005687; classtype:social-engineering; sid:6005687; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (expert-velodrome.wixstudio.com/enus)"; flow:established,to_server; http.uri; content:"/enus"; startswith; fast_pattern; http.host; content:"expert-velodrome.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005688; classtype:social-engineering; sid:6005688; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.oferta38557637.lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalnie.oferta38557637.lat"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005689; classtype:social-engineering; sid:6005689; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (82db346f-64aa-4d0b-92cf-f635f34a330c-00-2gve7ebk35g2h.worf.replit.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"82db346f-64aa-4d0b-92cf-f635f34a330c-00-2gve7ebk35g2h.worf.replit.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005690; classtype:social-engineering; sid:6005690; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pnc-nine.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pnc-nine.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005691; classtype:social-engineering; sid:6005691; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (estaciorequestcancellation.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"estaciorequestcancellation.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005692; classtype:social-engineering; sid:6005692; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.urge5718504.pro/captcha.php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"www.urge5718504.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005693; classtype:social-engineering; sid:6005693; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bacportal.help/pa)"; flow:established,to_server; http.uri; content:"/pa"; startswith; fast_pattern; http.host; content:"bacportal.help"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005694; classtype:social-engineering; sid:6005694; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (baccredomaticaccesoc.help/pa)"; flow:established,to_server; http.uri; content:"/pa"; startswith; fast_pattern; http.host; content:"baccredomaticaccesoc.help"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005695; classtype:social-engineering; sid:6005695; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amisnetsi.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amisnetsi.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005696; classtype:social-engineering; sid:6005696; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-iomoonpy.wixstudio.com/en-nav)"; flow:established,to_server; http.uri; content:"/en-nav"; startswith; fast_pattern; http.host; content:"secure-iomoonpy.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005697; classtype:social-engineering; sid:6005697; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bradesco.gerenciadorpj.digital/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bradesco.gerenciadorpj.digital"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005698; classtype:social-engineering; sid:6005698; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gastroenterologie-erlangen.de/?utm_source=1skooiv2a)"; flow:established,to_server; http.uri; content:"/?utm_source=1skooiv2a"; startswith; fast_pattern; http.host; content:"gastroenterologie-erlangen.de"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005699; classtype:social-engineering; sid:6005699; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vh464.timeweb.ru/parking/?ref=cr012918-wordpress-vt52s.tw1.ru)"; flow:established,to_server; http.uri; content:"/parking/?ref=cr012918-wordpress-vt52s.tw1.ru"; startswith; fast_pattern; http.host; content:"vh464.timeweb.ru"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005700; classtype:social-engineering; sid:6005700; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (io-moonpayapps.wixstudio.com/enus)"; flow:established,to_server; http.uri; content:"/enus"; startswith; fast_pattern; http.host; content:"io-moonpayapps.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005701; classtype:social-engineering; sid:6005701; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (baccredomaticaccesoe.help/pa)"; flow:established,to_server; http.uri; content:"/pa"; startswith; fast_pattern; http.host; content:"baccredomaticaccesoe.help"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005702; classtype:social-engineering; sid:6005702; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmailitecalgovn.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webmailitecalgovn.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005703; classtype:social-engineering; sid:6005703; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (micuentabac.help/pa)"; flow:established,to_server; http.uri; content:"/pa"; startswith; fast_pattern; http.host; content:"micuentabac.help"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005704; classtype:social-engineering; sid:6005704; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iniciarsesionbac.help/pa)"; flow:established,to_server; http.uri; content:"/pa"; startswith; fast_pattern; http.host; content:"iniciarsesionbac.help"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005705; classtype:social-engineering; sid:6005705; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kjghfxdfgchjk26msgs.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kjghfxdfgchjk26msgs.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005706; classtype:social-engineering; sid:6005706; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rogersmembercentetrlogin.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rogersmembercentetrlogin.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005707; classtype:social-engineering; sid:6005707; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (olivier.info-9726105.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"olivier.info-9726105.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005708; classtype:social-engineering; sid:6005708; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (activatepass58895.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"activatepass58895.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005709; classtype:social-engineering; sid:6005709; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail-midco-support.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mail-midco-support.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005710; classtype:social-engineering; sid:6005710; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accesocbac.help/pa)"; flow:established,to_server; http.uri; content:"/pa"; startswith; fast_pattern; http.host; content:"accesocbac.help"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005711; classtype:social-engineering; sid:6005711; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anadolu-edu-tr.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"anadolu-edu-tr.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005712; classtype:social-engineering; sid:6005712; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (plucky-group-224183.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"plucky-group-224183.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005713; classtype:social-engineering; sid:6005713; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anulsocg-gmps.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"anulsocg-gmps.duckdns.org"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005714; classtype:social-engineering; sid:6005714; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accesoabac.help/pa)"; flow:established,to_server; http.uri; content:"/pa"; startswith; fast_pattern; http.host; content:"accesoabac.help"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005715; classtype:social-engineering; sid:6005715; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (invisible-path-670355.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"invisible-path-670355.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005716; classtype:social-engineering; sid:6005716; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portalbac.help/pa)"; flow:established,to_server; http.uri; content:"/pa"; startswith; fast_pattern; http.host; content:"portalbac.help"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005717; classtype:social-engineering; sid:6005717; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.163725v3.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.163725v3.click"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005718; classtype:social-engineering; sid:6005718; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accesosbac.help/pa)"; flow:established,to_server; http.uri; content:"/pa"; startswith; fast_pattern; http.host; content:"accesosbac.help"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005719; classtype:social-engineering; sid:6005719; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accessbac.help/pa)"; flow:established,to_server; http.uri; content:"/pa"; startswith; fast_pattern; http.host; content:"accessbac.help"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005720; classtype:social-engineering; sid:6005720; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cointrackr-apps.wixstudio.com/usen)"; flow:established,to_server; http.uri; content:"/usen"; startswith; fast_pattern; http.host; content:"cointrackr-apps.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005721; classtype:social-engineering; sid:6005721; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trustworthy-technology-839760.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trustworthy-technology-839760.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005722; classtype:social-engineering; sid:6005722; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinitycomccastt.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinitycomccastt.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005723; classtype:social-engineering; sid:6005723; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (decisive-concept-891331.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"decisive-concept-891331.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005724; classtype:social-engineering; sid:6005724; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (networkiingtelekom.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"networkiingtelekom.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005725; classtype:social-engineering; sid:6005725; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hlmdrnserv.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hlmdrnserv.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005726; classtype:social-engineering; sid:6005726; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (multi-factorauth.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"multi-factorauth.webflow.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005727; classtype:social-engineering; sid:6005727; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dutrkqs.mmtofz.cn/fkhghticg/lub-iu_loui/)"; flow:established,to_server; http.uri; content:"/fkhghticg/lub-iu_loui/"; startswith; fast_pattern; http.host; content:"dutrkqs.mmtofz.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005728; classtype:social-engineering; sid:6005728; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accesorbac.help/pa)"; flow:established,to_server; http.uri; content:"/pa"; startswith; fast_pattern; http.host; content:"accesorbac.help"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005729; classtype:social-engineering; sid:6005729; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (onlinecourrielwebca.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"onlinecourrielwebca.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005730; classtype:social-engineering; sid:6005730; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalinie.pl-478892.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalinie.pl-478892.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005731; classtype:social-engineering; sid:6005731; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mailservice0973.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mailservice0973.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005732; classtype:social-engineering; sid:6005732; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8navupdte67fffs.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8navupdte67fffs.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005733; classtype:social-engineering; sid:6005733; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oduiddoikd.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"oduiddoikd.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005734; classtype:social-engineering; sid:6005734; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (votrepeageulys.com/index.php)"; flow:established,to_server; http.uri; content:"/index.php"; startswith; fast_pattern; http.host; content:"votrepeageulys.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005735; classtype:social-engineering; sid:6005735; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wordpress-211839-0.cloudclusters.net/wp-content/uploads/2026/05/bla/login.php)"; flow:established,to_server; http.uri; content:"/wp-content/uploads/2026/05/bla/login.php"; startswith; fast_pattern; http.host; content:"wordpress-211839-0.cloudclusters.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005736; classtype:social-engineering; sid:6005736; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ameli-mescompte.com/?useremail=)"; flow:established,to_server; http.uri; content:"/?useremail="; startswith; fast_pattern; http.host; content:"ameli-mescompte.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005737; classtype:social-engineering; sid:6005737; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shorturl.asia/8iEGW)"; flow:established,to_server; http.uri; content:"/8iEGW"; startswith; fast_pattern; http.host; content:"shorturl.asia"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005738; classtype:social-engineering; sid:6005738; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (schaengold.com/cgi-sys/suspendedpage.cgi)"; flow:established,to_server; http.uri; content:"/cgi-sys/suspendedpage.cgi"; startswith; fast_pattern; http.host; content:"schaengold.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005739; classtype:social-engineering; sid:6005739; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (searchdestatus.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"searchdestatus.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005740; classtype:social-engineering; sid:6005740; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ameli-mescompte.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ameli-mescompte.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005741; classtype:social-engineering; sid:6005741; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yellowbirddd.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yellowbirddd.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005742; classtype:social-engineering; sid:6005742; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zh-login-whatsapp-hl.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zh-login-whatsapp-hl.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005743; classtype:social-engineering; sid:6005743; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.lvqzkpn.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.lvqzkpn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005744; classtype:social-engineering; sid:6005744; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zhirongqianbao.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zhirongqianbao.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005745; classtype:social-engineering; sid:6005745; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.corelaxi.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.corelaxi.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005746; classtype:social-engineering; sid:6005746; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.hvqmtr.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.hvqmtr.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005747; classtype:social-engineering; sid:6005747; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.renewr.cfd/co.uk/)"; flow:established,to_server; http.uri; content:"/co.uk/"; startswith; fast_pattern; http.host; content:"dpd.renewr.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005748; classtype:social-engineering; sid:6005748; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.dexmorali.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.dexmorali.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005749; classtype:social-engineering; sid:6005749; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (folcepri.info/?app_vl=ZoFwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=falen1@0a7d648fdf2b5c3791bb4d6903c97b4fefd3.net&sui=%7Bsui%7D&fn=adrianna&ln=sobieralska&p=&z=PLNAMECL-2105-con2)"; flow:established,to_server; http.uri; content:"/?app_vl=ZoFwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=falen1@0a7d648fdf2b5c3791bb4d6903c97b4fefd3.net&sui=%7Bsui%7D&fn=adrianna&ln=sobieralska&p=&z=PLNAMECL-2105-con2"; startswith; fast_pattern; http.host; content:"folcepri.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005750; classtype:social-engineering; sid:6005750; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kdpayqianbaoguanwangxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kdpayqianbaoguanwangxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005751; classtype:social-engineering; sid:6005751; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bianqianbaogw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bianqianbaogw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005752; classtype:social-engineering; sid:6005752; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login-face.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"login-face.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005753; classtype:social-engineering; sid:6005753; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (srramumksh.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"srramumksh.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005754; classtype:social-engineering; sid:6005754; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (program-resmi163.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"program-resmi163.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005755; classtype:social-engineering; sid:6005755; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xlayananm-indonewz.shineeni.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xlayananm-indonewz.shineeni.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005756; classtype:social-engineering; sid:6005756; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ru-fairpay.shop/checkSb210466646/)"; flow:established,to_server; http.uri; content:"/checkSb210466646/"; startswith; fast_pattern; http.host; content:"www.ru-fairpay.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005757; classtype:social-engineering; sid:6005757; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cainbasaproddgiu.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cainbasaproddgiu.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005758; classtype:social-engineering; sid:6005758; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (808qianbaoappguanwangrukougw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"808qianbaoappguanwangrukougw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005759; classtype:social-engineering; sid:6005759; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kdouqianbaoxiazaianzhuobangw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kdouqianbaoxiazaianzhuobangw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005760; classtype:social-engineering; sid:6005760; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (okpayqianbaoguanwangxiazaianzhuogw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"okpayqianbaoguanwangxiazaianzhuogw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005761; classtype:social-engineering; sid:6005761; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (supportmapsarg.info/expire/)"; flow:established,to_server; http.uri; content:"/expire/"; startswith; fast_pattern; http.host; content:"supportmapsarg.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005762; classtype:social-engineering; sid:6005762; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (goubaoqianbaoguanwangxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"goubaoqianbaoguanwangxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005763; classtype:social-engineering; sid:6005763; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (topayanzhuobanxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"topayanzhuobanxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005764; classtype:social-engineering; sid:6005764; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-git-mp-tdp-sticky-header-uniswap.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-git-mp-tdp-sticky-header-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005765; classtype:social-engineering; sid:6005765; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oyi-oyi.com.cn/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"oyi-oyi.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005766; classtype:social-engineering; sid:6005766; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.czplwr.club/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.czplwr.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005767; classtype:social-engineering; sid:6005767; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.fqplznrvtge.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.fqplznrvtge.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005768; classtype:social-engineering; sid:6005768; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (noqianbaoxiazaiappgw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"noqianbaoxiazaiappgw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005769; classtype:social-engineering; sid:6005769; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.lxqpkmr.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.lxqpkmr.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005770; classtype:social-engineering; sid:6005770; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.investflowx.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.investflowx.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005771; classtype:social-engineering; sid:6005771; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (beylikduzun.com/ISjpHRqDIIknTSqNEy1O.html)"; flow:established,to_server; http.uri; content:"/ISjpHRqDIIknTSqNEy1O.html"; startswith; fast_pattern; http.host; content:"beylikduzun.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005772; classtype:social-engineering; sid:6005772; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeetbk823.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopeetbk823.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005773; classtype:social-engineering; sid:6005773; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (helpcloud-location-map.com/aU4VXCP6/)"; flow:established,to_server; http.uri; content:"/aU4VXCP6/"; startswith; fast_pattern; http.host; content:"helpcloud-location-map.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005774; classtype:social-engineering; sid:6005774; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.lihuda.click/secure-it)"; flow:established,to_server; http.uri; content:"/secure-it"; startswith; fast_pattern; http.host; content:"brt.lihuda.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005775; classtype:social-engineering; sid:6005775; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qiannengqianbaoappshoujibangw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qiannengqianbaoappshoujibangw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005776; classtype:social-engineering; sid:6005776; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-net4-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-net4-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005777; classtype:social-engineering; sid:6005777; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.galvexor.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.galvexor.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005778; classtype:social-engineering; sid:6005778; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortog.top/id/login)"; flow:established,to_server; http.uri; content:"/id/login"; startswith; fast_pattern; http.host; content:"fortog.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005779; classtype:social-engineering; sid:6005779; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (okqianbaoxiazaianzhuo.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"okqianbaoxiazaianzhuo.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005780; classtype:social-engineering; sid:6005780; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www-robloxk.com/users/14085142931/profile)"; flow:established,to_server; http.uri; content:"/users/14085142931/profile"; startswith; fast_pattern; http.host; content:"www-robloxk.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005781; classtype:social-engineering; sid:6005781; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sgintese.osc-fr1.scalingo.io/infospage.php)"; flow:established,to_server; http.uri; content:"/infospage.php"; startswith; fast_pattern; http.host; content:"sgintese.osc-fr1.scalingo.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005782; classtype:social-engineering; sid:6005782; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iforget-account-ubic.click/aU4VXCP6)"; flow:established,to_server; http.uri; content:"/aU4VXCP6"; startswith; fast_pattern; http.host; content:"iforget-account-ubic.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005783; classtype:social-engineering; sid:6005783; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (okpayqianbaoanzhuobanxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"okpayqianbaoanzhuobanxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005784; classtype:social-engineering; sid:6005784; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rubenhuddlugennn.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rubenhuddlugennn.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005785; classtype:social-engineering; sid:6005785; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (988qianbaoanzhuobanxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"988qianbaoanzhuobanxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005786; classtype:social-engineering; sid:6005786; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagramusicabrasilinstagram.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagramusicabrasilinstagram.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005787; classtype:social-engineering; sid:6005787; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kdouqianbaoxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kdouqianbaoxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005788; classtype:social-engineering; sid:6005788; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (okpayguanwanggw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"okpayguanwanggw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005789; classtype:social-engineering; sid:6005789; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-homepage-ui.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-homepage-ui.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005790; classtype:social-engineering; sid:6005790; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kdouqianbaozuixinxiazaidizhigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kdouqianbaozuixinxiazaidizhigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005791; classtype:social-engineering; sid:6005791; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.dynelaxi.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.dynelaxi.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005792; classtype:social-engineering; sid:6005792; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xiaoqianbaoguanwanggw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xiaoqianbaoguanwanggw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005793; classtype:social-engineering; sid:6005793; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telegramann.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"telegramann.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005794; classtype:social-engineering; sid:6005794; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aibopayqianbaozuixinbanben.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aibopayqianbaozuixinbanben.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005795; classtype:social-engineering; sid:6005795; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365qianbaoanzhuoxiazaianzhuanggw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"365qianbaoanzhuoxiazaianzhuanggw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005796; classtype:social-engineering; sid:6005796; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kplzoyvri.ink/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.kplzoyvri.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005797; classtype:social-engineering; sid:6005797; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (122.imtoken-hk2.top/im)"; flow:established,to_server; http.uri; content:"/im"; startswith; fast_pattern; http.host; content:"122.imtoken-hk2.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005798; classtype:social-engineering; sid:6005798; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.fxvtqm.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.fxvtqm.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005799; classtype:social-engineering; sid:6005799; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ubisupport.live/aU4VXCP6)"; flow:established,to_server; http.uri; content:"/aU4VXCP6"; startswith; fast_pattern; http.host; content:"ubisupport.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005800; classtype:social-engineering; sid:6005800; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kdouqianbaoguanwanggw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kdouqianbaoguanwanggw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005801; classtype:social-engineering; sid:6005801; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.cranketio.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.cranketio.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005802; classtype:social-engineering; sid:6005802; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qiannengqianbaoappzuixinban.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qiannengqianbaoappzuixinban.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005803; classtype:social-engineering; sid:6005803; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (988payqianbaoxiazaidizhigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"988payqianbaoxiazaidizhigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005804; classtype:social-engineering; sid:6005804; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sumandeep2004.github.io/Amazon-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-clone/"; startswith; fast_pattern; http.host; content:"sumandeep2004.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005805; classtype:social-engineering; sid:6005805; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-web3-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app-web3-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005806; classtype:social-engineering; sid:6005806; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.earnhub.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.earnhub.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005807; classtype:social-engineering; sid:6005807; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ccbqianbaoappxiazaianzhuanggw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ccbqianbaoappxiazaianzhuanggw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005808; classtype:social-engineering; sid:6005808; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (txdmv.org-ars.shop/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"txdmv.org-ars.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005809; classtype:social-engineering; sid:6005809; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (808qianbaopingguoxiazai.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"808qianbaopingguoxiazai.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005810; classtype:social-engineering; sid:6005810; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kqvprxlyjt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kqvprxlyjt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005811; classtype:social-engineering; sid:6005811; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bankofamerica-three.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bankofamerica-three.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005812; classtype:social-engineering; sid:6005812; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (okpayqianbaoxiazaipingguoban.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"okpayqianbaoxiazaipingguoban.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005813; classtype:social-engineering; sid:6005813; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365qianbaoappguanfangxiazaianzhuang.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"365qianbaoappguanfangxiazaianzhuang.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005814; classtype:social-engineering; sid:6005814; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sb-19-hub.github.io/Amazon-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-clone/"; startswith; fast_pattern; http.host; content:"sb-19-hub.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005815; classtype:social-engineering; sid:6005815; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-nextjs-sooty.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-nextjs-sooty.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005816; classtype:social-engineering; sid:6005816; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ubisupport.live/expire/)"; flow:established,to_server; http.uri; content:"/expire/"; startswith; fast_pattern; http.host; content:"ubisupport.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005817; classtype:social-engineering; sid:6005817; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (988payqianbaoanzhuobangw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"988payqianbaoanzhuobangw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005818; classtype:social-engineering; sid:6005818; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (808qianbaoappdakaiguanwang.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"808qianbaoappdakaiguanwang.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005819; classtype:social-engineering; sid:6005819; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abpayqianbaoappxiazaiguanwanggw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"abpayqianbaoappxiazaiguanwanggw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005820; classtype:social-engineering; sid:6005820; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.cxtrmq.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.cxtrmq.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005821; classtype:social-engineering; sid:6005821; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.briivradev.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.briivradev.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005822; classtype:social-engineering; sid:6005822; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.garmelino.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.garmelino.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005823; classtype:social-engineering; sid:6005823; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kdoupayqianbao.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kdoupayqianbao.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005824; classtype:social-engineering; sid:6005824; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (808payqianbaoappguanwangrukou.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"808payqianbaoappguanwangrukou.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005825; classtype:social-engineering; sid:6005825; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abhinav962173.github.io/Spotify-clone)"; flow:established,to_server; http.uri; content:"/Spotify-clone"; startswith; fast_pattern; http.host; content:"abhinav962173.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005826; classtype:social-engineering; sid:6005826; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (98qianbaoappxiazaiguanwanggw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"98qianbaoappxiazaiguanwanggw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005827; classtype:social-engineering; sid:6005827; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reggaepaz.com/nl)"; flow:established,to_server; http.uri; content:"/nl"; startswith; fast_pattern; http.host; content:"reggaepaz.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005828; classtype:social-engineering; sid:6005828; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kdpayqianbaoxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kdpayqianbaoxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005829; classtype:social-engineering; sid:6005829; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fangxinqianbaoappxiazai.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fangxinqianbaoappxiazai.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005830; classtype:social-engineering; sid:6005830; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xiazai988qianbaogw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xiazai988qianbaogw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005831; classtype:social-engineering; sid:6005831; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (helpcloud-location-map.com/expire/)"; flow:established,to_server; http.uri; content:"/expire/"; startswith; fast_pattern; http.host; content:"helpcloud-location-map.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005832; classtype:social-engineering; sid:6005832; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bobiqianbaoappxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bobiqianbaoappxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005833; classtype:social-engineering; sid:6005833; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamaskloginjn.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metamaskloginjn.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005834; classtype:social-engineering; sid:6005834; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (234payqianbaoguanwangrukou.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"234payqianbaoguanwangrukou.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005835; classtype:social-engineering; sid:6005835; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jarmetoki.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jarmetoki.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005836; classtype:social-engineering; sid:6005836; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (988payqianbaoappguanwanggw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"988payqianbaoappguanwanggw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005837; classtype:social-engineering; sid:6005837; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vivoqianbaoxiazaianzhuanggw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vivoqianbaoxiazaianzhuanggw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005838; classtype:social-engineering; sid:6005838; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bixinqianbaoapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bixinqianbaoapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005839; classtype:social-engineering; sid:6005839; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web3qianbaoxiazai.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web3qianbaoxiazai.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005840; classtype:social-engineering; sid:6005840; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gdpayqianbao.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gdpayqianbao.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005841; classtype:social-engineering; sid:6005841; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (applefinder.com.tr/expire/)"; flow:established,to_server; http.uri; content:"/expire/"; startswith; fast_pattern; http.host; content:"applefinder.com.tr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005842; classtype:social-engineering; sid:6005842; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (808qianbaoappxiazaianzhuang.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"808qianbaoappxiazaianzhuang.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005843; classtype:social-engineering; sid:6005843; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (goubaoqianbaoanzhuobangw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"goubaoqianbaoanzhuobangw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005844; classtype:social-engineering; sid:6005844; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.davleniro.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.davleniro.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005845; classtype:social-engineering; sid:6005845; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xinyongqianbaogw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xinyongqianbaogw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005846; classtype:social-engineering; sid:6005846; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (quanminqianbaoxiazaiappgw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"quanminqianbaoxiazaiappgw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005847; classtype:social-engineering; sid:6005847; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.brivoliti.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.brivoliti.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005848; classtype:social-engineering; sid:6005848; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-user-account.vercel.app/secure-access)"; flow:established,to_server; http.uri; content:"/secure-access"; startswith; fast_pattern; http.host; content:"verify-user-account.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005849; classtype:social-engineering; sid:6005849; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-top-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app-top-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005850; classtype:social-engineering; sid:6005850; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (giantpanda968-cmd.github.io/Netflix/)"; flow:established,to_server; http.uri; content:"/Netflix/"; startswith; fast_pattern; http.host; content:"giantpanda968-cmd.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005851; classtype:social-engineering; sid:6005851; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jplkrnvqb.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jplkrnvqb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005852; classtype:social-engineering; sid:6005852; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.earvoteli.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.earvoteli.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005853; classtype:social-engineering; sid:6005853; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.calnorexi.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.calnorexi.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005854; classtype:social-engineering; sid:6005854; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.ialvexor.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.ialvexor.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005855; classtype:social-engineering; sid:6005855; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qiannengqianbaoguanwangdenglurukougw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qiannengqianbaoguanwangdenglurukougw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005856; classtype:social-engineering; sid:6005856; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (buscar-applemaps.com/script/login_2026/index.php)"; flow:established,to_server; http.uri; content:"/script/login_2026/index.php"; startswith; fast_pattern; http.host; content:"buscar-applemaps.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005857; classtype:social-engineering; sid:6005857; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kuucainlogin.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kuucainlogin.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005858; classtype:social-engineering; sid:6005858; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.iarmetaki.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.iarmetaki.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005859; classtype:social-engineering; sid:6005859; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (modoperdido.help/aU4VXCP6/)"; flow:established,to_server; http.uri; content:"/aU4VXCP6/"; startswith; fast_pattern; http.host; content:"modoperdido.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005860; classtype:social-engineering; sid:6005860; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.srramumksh.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.srramumksh.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005861; classtype:social-engineering; sid:6005861; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.koiiccuiglogig.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.koiiccuiglogig.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005862; classtype:social-engineering; sid:6005862; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kuccoin-custtomerr-serrvice-nnumber.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kuccoin-custtomerr-serrvice-nnumber.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005863; classtype:social-engineering; sid:6005863; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.deliverox.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.deliverox.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005864; classtype:social-engineering; sid:6005864; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (crytwaultattx.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"crytwaultattx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005865; classtype:social-engineering; sid:6005865; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ddpayqianbaoxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ddpayqianbaoxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005866; classtype:social-engineering; sid:6005866; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paypal-clone-one.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paypal-clone-one.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005867; classtype:social-engineering; sid:6005867; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloudfind.com.tr/aU4VXCP6)"; flow:established,to_server; http.uri; content:"/aU4VXCP6"; startswith; fast_pattern; http.host; content:"icloudfind.com.tr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005868; classtype:social-engineering; sid:6005868; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.dormelaki.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.dormelaki.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005869; classtype:social-engineering; sid:6005869; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kdouqianbaoguanfangzhengbanxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kdouqianbaoguanfangzhengbanxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005870; classtype:social-engineering; sid:6005870; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iforget.ubicacion-cloud.info/aU4VXCP6/)"; flow:established,to_server; http.uri; content:"/aU4VXCP6/"; startswith; fast_pattern; http.host; content:"iforget.ubicacion-cloud.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005871; classtype:social-engineering; sid:6005871; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.fqplxwr.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.fqplxwr.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005872; classtype:social-engineering; sid:6005872; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bvxqtrm.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.bvxqtrm.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005873; classtype:social-engineering; sid:6005873; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.gqwmtrxppl.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.gqwmtrxppl.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005874; classtype:social-engineering; sid:6005874; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.cnwrzv.club/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.cnwrzv.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005875; classtype:social-engineering; sid:6005875; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.linkvera.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.linkvera.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005876; classtype:social-engineering; sid:6005876; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.gnplzr.ink/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.gnplzr.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005877; classtype:social-engineering; sid:6005877; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abpayqianbaoappguanfangxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"abpayqianbaoappguanfangxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005878; classtype:social-engineering; sid:6005878; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cangpinhui.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cangpinhui.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005879; classtype:social-engineering; sid:6005879; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vivoqianbaodenglurukou.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vivoqianbaodenglurukou.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005880; classtype:social-engineering; sid:6005880; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (988qianbaoanzhuoguanwangxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"988qianbaoanzhuoguanwangxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005881; classtype:social-engineering; sid:6005881; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (988payqianbaoxiazaianzhuang.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"988payqianbaoxiazaianzhuang.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005882; classtype:social-engineering; sid:6005882; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yuanmengqianbaoappxiazaianzhuanggw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yuanmengqianbaoappxiazaianzhuanggw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005883; classtype:social-engineering; sid:6005883; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.granketio.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.granketio.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005884; classtype:social-engineering; sid:6005884; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.plznqx.ink/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.plznqx.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005885; classtype:social-engineering; sid:6005885; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (808qianbaoappxiazaiguanwanggw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"808qianbaoappxiazaiguanwanggw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005886; classtype:social-engineering; sid:6005886; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (findmy.nolocattion-sopport.sbs/aU4VXCP6)"; flow:established,to_server; http.uri; content:"/aU4VXCP6"; startswith; fast_pattern; http.host; content:"findmy.nolocattion-sopport.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005887; classtype:social-engineering; sid:6005887; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-pps-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app-pps-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005888; classtype:social-engineering; sid:6005888; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ubiiclou.info/expire/)"; flow:established,to_server; http.uri; content:"/expire/"; startswith; fast_pattern; http.host; content:"ubiiclou.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005889; classtype:social-engineering; sid:6005889; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dfghjklertyuiocvbnm-9s4cmpwuks.edgeone.dev/english.html)"; flow:established,to_server; http.uri; content:"/english.html"; startswith; fast_pattern; http.host; content:"dfghjklertyuiocvbnm-9s4cmpwuks.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005890; classtype:social-engineering; sid:6005890; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.zplkrvbnq.club/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.zplkrvbnq.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005891; classtype:social-engineering; sid:6005891; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (upayqianbaoxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"upayqianbaoxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005892; classtype:social-engineering; sid:6005892; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hadiahshopee286.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hadiahshopee286.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005893; classtype:social-engineering; sid:6005893; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bzqwnp.ink/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.bzqwnp.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005894; classtype:social-engineering; sid:6005894; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.forminformation.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.forminformation.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005895; classtype:social-engineering; sid:6005895; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.zqplkrvbn.club/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.zqplkrvbn.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005896; classtype:social-engineering; sid:6005896; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.podfort.lol/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.podfort.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005897; classtype:social-engineering; sid:6005897; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365qianbaoappguanwangrukougw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"365qianbaoappguanwangrukougw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005898; classtype:social-engineering; sid:6005898; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (234qianbaoguanfangzhengbanxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"234qianbaoguanfangzhengbanxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005899; classtype:social-engineering; sid:6005899; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (998payqianbaoanquanxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"998payqianbaoanquanxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005900; classtype:social-engineering; sid:6005900; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.investmaxz.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.investmaxz.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005901; classtype:social-engineering; sid:6005901; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jangkautotoo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jangkautotoo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005902; classtype:social-engineering; sid:6005902; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qiannengqianbaoappanzhuoxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qiannengqianbaoappanzhuoxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005903; classtype:social-engineering; sid:6005903; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.cxmvtrqplk.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.cxmvtrqplk.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005904; classtype:social-engineering; sid:6005904; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zo-gate.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zo-gate.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005905; classtype:social-engineering; sid:6005905; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.988qianbaoappxiazaiguanwanggw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.988qianbaoappxiazaiguanwanggw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005906; classtype:social-engineering; sid:6005906; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rzkplqvbn.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rzkplqvbn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005907; classtype:social-engineering; sid:6005907; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (findmy.nolocattion-sopport.sbs/expire/)"; flow:established,to_server; http.uri; content:"/expire/"; startswith; fast_pattern; http.host; content:"findmy.nolocattion-sopport.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005908; classtype:social-engineering; sid:6005908; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vivoqianbaoappguanfangxiazai.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vivoqianbaoappguanfangxiazai.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005909; classtype:social-engineering; sid:6005909; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cbiqianbaoxiazairukougw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cbiqianbaoxiazairukougw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005910; classtype:social-engineering; sid:6005910; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fudouqianbaoxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fudouqianbaoxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005911; classtype:social-engineering; sid:6005911; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (goubaoqianbaoappguanwangxiazaianzhuanggw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"goubaoqianbaoappguanwangxiazaianzhuanggw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005912; classtype:social-engineering; sid:6005912; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (git-aayush.github.io/Spotify-Clone)"; flow:established,to_server; http.uri; content:"/Spotify-Clone"; startswith; fast_pattern; http.host; content:"git-aayush.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005913; classtype:social-engineering; sid:6005913; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shorta.vip/adbVw)"; flow:established,to_server; http.uri; content:"/adbVw"; startswith; fast_pattern; http.host; content:"shorta.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005914; classtype:social-engineering; sid:6005914; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (program-shopee47.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"program-shopee47.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005915; classtype:social-engineering; sid:6005915; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (okpayqianbaoguanwangbangw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"okpayqianbaoguanwangbangw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005916; classtype:social-engineering; sid:6005916; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365qianbaoxiazaishoujibangw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"365qianbaoxiazaishoujibangw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005917; classtype:social-engineering; sid:6005917; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bnkplqrvj.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.bnkplqrvj.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005918; classtype:social-engineering; sid:6005918; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gnnhohaevqheyuan.jizuo.com.cn/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"gnnhohaevqheyuan.jizuo.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005919; classtype:social-engineering; sid:6005919; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bvtrmq.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.bvtrmq.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005920; classtype:social-engineering; sid:6005920; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (goubaoqianbaoappxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"goubaoqianbaoappxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005921; classtype:social-engineering; sid:6005921; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.paketnova.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.paketnova.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005922; classtype:social-engineering; sid:6005922; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bitmartwlogin.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bitmartwlogin.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005923; classtype:social-engineering; sid:6005923; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.deliverytrans.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.deliverytrans.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005924; classtype:social-engineering; sid:6005924; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.padisahbigboss.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.padisahbigboss.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005925; classtype:social-engineering; sid:6005925; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abpayqianbaoguanwangrukou.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"abpayqianbaoguanwangrukou.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005926; classtype:social-engineering; sid:6005926; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web5-vip-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web5-vip-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005927; classtype:social-engineering; sid:6005927; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-webapp.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-webapp.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005928; classtype:social-engineering; sid:6005928; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iforget.ubicacion-cloud.info/expire/)"; flow:established,to_server; http.uri; content:"/expire/"; startswith; fast_pattern; http.host; content:"iforget.ubicacion-cloud.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005929; classtype:social-engineering; sid:6005929; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (okqianbaoxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"okqianbaoxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005930; classtype:social-engineering; sid:6005930; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (okpayqianbaozuixinbanbengw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"okpayqianbaozuixinbanbengw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005931; classtype:social-engineering; sid:6005931; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.program-resmi163.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.program-resmi163.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005932; classtype:social-engineering; sid:6005932; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee2349.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopee2349.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005933; classtype:social-engineering; sid:6005933; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.hvxtrmqpl.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.hvxtrmqpl.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005934; classtype:social-engineering; sid:6005934; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kpjqrlvbn.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.kpjqrlvbn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005935; classtype:social-engineering; sid:6005935; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-clone-app.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-clone-app.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005936; classtype:social-engineering; sid:6005936; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coinsquuaarelogi.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coinsquuaarelogi.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005937; classtype:social-engineering; sid:6005937; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.eraveloni.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.eraveloni.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005938; classtype:social-engineering; sid:6005938; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqznwklpt.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.rqznwklpt.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005939; classtype:social-engineering; sid:6005939; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bra9-pts-facil.dynv6.net/B88547/B755154478447801/home.php?hash=11492896666a105285879ca2.43118919)"; flow:established,to_server; http.uri; content:"/B88547/B755154478447801/home.php?hash=11492896666a105285879ca2.43118919"; startswith; fast_pattern; http.host; content:"bra9-pts-facil.dynv6.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005940; classtype:social-engineering; sid:6005940; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (okpayguanwangxiazaiapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"okpayguanwangxiazaiapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005941; classtype:social-engineering; sid:6005941; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roundcub-webmaster-v2khy4y1sx.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"roundcub-webmaster-v2khy4y1sx.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005942; classtype:social-engineering; sid:6005942; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my-bybite-authh.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"my-bybite-authh.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005943; classtype:social-engineering; sid:6005943; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (applefinder.com.tr/aU4VXCP6)"; flow:established,to_server; http.uri; content:"/aU4VXCP6"; startswith; fast_pattern; http.host; content:"applefinder.com.tr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005944; classtype:social-engineering; sid:6005944; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jplwrz.club/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.jplwrz.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005945; classtype:social-engineering; sid:6005945; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yuanmengqianbaozhengshishangxian.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yuanmengqianbaozhengshishangxian.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005946; classtype:social-engineering; sid:6005946; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kucoenlogini.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kucoenlogini.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005947; classtype:social-engineering; sid:6005947; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.hvplmzn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.hvplmzn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005948; classtype:social-engineering; sid:6005948; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (woqianbaogf.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"woqianbaogf.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005949; classtype:social-engineering; sid:6005949; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (okqianbaoappxiazaianzhuanggw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"okqianbaoappxiazaianzhuanggw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005950; classtype:social-engineering; sid:6005950; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.qjfklpznr.ink/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.qjfklpznr.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005951; classtype:social-engineering; sid:6005951; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mpayqianbaoxiazai.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mpayqianbaoxiazai.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005952; classtype:social-engineering; sid:6005952; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloudfind.com.tr/expire/)"; flow:established,to_server; http.uri; content:"/expire/"; startswith; fast_pattern; http.host; content:"icloudfind.com.tr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005953; classtype:social-engineering; sid:6005953; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee5389.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopee5389.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005954; classtype:social-engineering; sid:6005954; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (24qianbaoappxiazaianzhuanggw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"24qianbaoappxiazaianzhuanggw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005955; classtype:social-engineering; sid:6005955; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dream-wendingyule.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.dream-wendingyule.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005956; classtype:social-engineering; sid:6005956; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kdpayanzhuobanxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kdpayanzhuobanxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005957; classtype:social-engineering; sid:6005957; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robuxhub.systeme.io/8000-robux-code/)"; flow:established,to_server; http.uri; content:"/8000-robux-code/"; startswith; fast_pattern; http.host; content:"robuxhub.systeme.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005958; classtype:social-engineering; sid:6005958; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (808payqianbaoguanfangxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"808payqianbaoguanfangxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005959; classtype:social-engineering; sid:6005959; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (topayqianbaoxiazaiguanwanggw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"topayqianbaoxiazaiguanwanggw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005960; classtype:social-engineering; sid:6005960; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (n-e-t-f-l-ix.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"n-e-t-f-l-ix.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005961; classtype:social-engineering; sid:6005961; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (streaming-ui-demo.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"streaming-ui-demo.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005962; classtype:social-engineering; sid:6005962; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (808payqianbaoappgw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"808payqianbaoappgw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005963; classtype:social-engineering; sid:6005963; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jqpxvztkry.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jqpxvztkry.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005964; classtype:social-engineering; sid:6005964; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (upayqianbaoguanfangrukou.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"upayqianbaoguanfangrukou.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005965; classtype:social-engineering; sid:6005965; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.aisizhushou-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.aisizhushou-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005966; classtype:social-engineering; sid:6005966; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.ivarnokti.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.ivarnokti.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005967; classtype:social-engineering; sid:6005967; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.fonarviex.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.fonarviex.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005968; classtype:social-engineering; sid:6005968; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fortzone.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fortzone.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005969; classtype:social-engineering; sid:6005969; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (quanminqianbaoappxiazaiguanwang.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"quanminqianbaoappxiazaiguanwang.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005970; classtype:social-engineering; sid:6005970; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blacko-lake.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"blacko-lake.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005971; classtype:social-engineering; sid:6005971; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bzqwpn.club/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.bzqwpn.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005972; classtype:social-engineering; sid:6005972; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usdtqianbaoxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"usdtqianbaoxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005973; classtype:social-engineering; sid:6005973; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kuicoinloggin.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kuicoinloggin.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005974; classtype:social-engineering; sid:6005974; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anushkaguptaniet.github.io/Amazon-clone)"; flow:established,to_server; http.uri; content:"/Amazon-clone"; startswith; fast_pattern; http.host; content:"anushkaguptaniet.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005975; classtype:social-engineering; sid:6005975; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kdouqianbaoappguanfangxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kdouqianbaoappguanfangxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005976; classtype:social-engineering; sid:6005976; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jremotaki.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.jremotaki.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005977; classtype:social-engineering; sid:6005977; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jxmvtr.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.jxmvtr.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005978; classtype:social-engineering; sid:6005978; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abqianbaoxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"abqianbaoxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005979; classtype:social-engineering; sid:6005979; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qiannengqianbaoappxiazaiguanwanggw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qiannengqianbaoappxiazaiguanwanggw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005980; classtype:social-engineering; sid:6005980; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (noqianbaoiosxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"noqianbaoiosxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005981; classtype:social-engineering; sid:6005981; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (airbnb-clone-theta-ruddy.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"airbnb-clone-theta-ruddy.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005982; classtype:social-engineering; sid:6005982; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.forteup.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.forteup.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005983; classtype:social-engineering; sid:6005983; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tiktokpay-ql1i766t9b.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tiktokpay-ql1i766t9b.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005984; classtype:social-engineering; sid:6005984; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sddftyrdyfwaru.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sddftyrdyfwaru.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005985; classtype:social-engineering; sid:6005985; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (808qianbaoxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"808qianbaoxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005986; classtype:social-engineering; sid:6005986; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (quanminqianbaoappxiazaianzhuang.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"quanminqianbaoappxiazaianzhuang.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005987; classtype:social-engineering; sid:6005987; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (supportmapsarg.info/aU4VXCP6/)"; flow:established,to_server; http.uri; content:"/aU4VXCP6/"; startswith; fast_pattern; http.host; content:"supportmapsarg.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005988; classtype:social-engineering; sid:6005988; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagramusicabrasilinstagram.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagramusicabrasilinstagram.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005989; classtype:social-engineering; sid:6005989; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.renewr.cfd/co.uk)"; flow:established,to_server; http.uri; content:"/co.uk"; startswith; fast_pattern; http.host; content:"dpd.renewr.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005990; classtype:social-engineering; sid:6005990; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qqqianbaogw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qqqianbaogw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005991; classtype:social-engineering; sid:6005991; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tibiqianbaoxiazaiapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tibiqianbaoxiazaiapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005992; classtype:social-engineering; sid:6005992; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kdouqianbaoxiazaianzhuang.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kdouqianbaoxiazaianzhuang.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005993; classtype:social-engineering; sid:6005993; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kbhavesh119.github.io/Spotune)"; flow:established,to_server; http.uri; content:"/Spotune"; startswith; fast_pattern; http.host; content:"kbhavesh119.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005994; classtype:social-engineering; sid:6005994; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bqkrlpvzn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.bqkrlpvzn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005995; classtype:social-engineering; sid:6005995; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (topayqianbaoappxiazaizuixinbanbengw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"topayqianbaoappxiazaizuixinbanbengw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005996; classtype:social-engineering; sid:6005996; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jdpayqianbaoxiazaiappgw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jdpayqianbaoxiazaiappgw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005997; classtype:social-engineering; sid:6005997; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.htyd.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.htyd.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005998; classtype:social-engineering; sid:6005998; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vikash-kherwa.github.io/amazon-homepage-project-)"; flow:established,to_server; http.uri; content:"/amazon-homepage-project-"; startswith; fast_pattern; http.host; content:"vikash-kherwa.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005999; classtype:social-engineering; sid:6005999; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.iraveloni.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.iraveloni.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006000; classtype:social-engineering; sid:6006000; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (foilboardhydrofoilsurfboardelectric.vercel.app/home)"; flow:established,to_server; http.uri; content:"/home"; startswith; fast_pattern; http.host; content:"foilboardhydrofoilsurfboardelectric.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006001; classtype:social-engineering; sid:6006001; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopeetbk823.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.shopeetbk823.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006002; classtype:social-engineering; sid:6006002; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cn.mbx3.net:9119/sports/)"; flow:established,to_server; http.uri; content:"/sports/"; startswith; fast_pattern; http.host; content:"cn.mbx3.net:9119"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006003; classtype:social-engineering; sid:6006003; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kjplqrvbn.ink/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.kjplqrvbn.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006004; classtype:social-engineering; sid:6006004; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (php1-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"php1-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006005; classtype:social-engineering; sid:6006005; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-homepage-ui.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-homepage-ui.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006006; classtype:social-engineering; sid:6006006; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jremoteki.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jremoteki.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006007; classtype:social-engineering; sid:6006007; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.cargomint.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.cargomint.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006008; classtype:social-engineering; sid:6006008; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamaskwalletcustomerservice.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metamaskwalletcustomerservice.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006009; classtype:social-engineering; sid:6006009; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.fjkplrvbn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.fjkplrvbn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006010; classtype:social-engineering; sid:6006010; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqwkpl.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqwkpl.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006011; classtype:social-engineering; sid:6006011; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spotify-client-beta.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spotify-client-beta.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006012; classtype:social-engineering; sid:6006012; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.fundlinex.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.fundlinex.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006013; classtype:social-engineering; sid:6006013; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tmqrxv.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.tmqrxv.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006014; classtype:social-engineering; sid:6006014; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.padisahbet-guncel-girisleri2026.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.padisahbet-guncel-girisleri2026.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006015; classtype:social-engineering; sid:6006015; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.web-git-mp-tdp-sticky-header-uniswap.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.web-git-mp-tdp-sticky-header-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006016; classtype:social-engineering; sid:6006016; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fb-clone-new.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fb-clone-new.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006017; classtype:social-engineering; sid:6006017; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortunemail.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortunemail.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006018; classtype:social-engineering; sid:6006018; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-clone-app.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-clone-app.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006019; classtype:social-engineering; sid:6006019; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coboqianbao.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coboqianbao.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006020; classtype:social-engineering; sid:6006020; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.metamaskwalletcustomerservice.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.metamaskwalletcustomerservice.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006021; classtype:social-engineering; sid:6006021; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (extraordinary-pie-9372ce.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"extraordinary-pie-9372ce.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006022; classtype:social-engineering; sid:6006022; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.lonvexar.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.lonvexar.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006023; classtype:social-engineering; sid:6006023; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (forminformation.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"forminformation.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006024; classtype:social-engineering; sid:6006024; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.koralviox.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.koralviox.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006025; classtype:social-engineering; sid:6006025; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365qianbaoxiazailianjie.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"365qianbaoxiazailianjie.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006026; classtype:social-engineering; sid:6006026; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.gnwrzpl.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.gnwrzpl.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006027; classtype:social-engineering; sid:6006027; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.malorvix.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.malorvix.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006028; classtype:social-engineering; sid:6006028; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (modoperdido.help/expire/)"; flow:established,to_server; http.uri; content:"/expire/"; startswith; fast_pattern; http.host; content:"modoperdido.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006029; classtype:social-engineering; sid:6006029; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee5389.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopee5389.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006030; classtype:social-engineering; sid:6006030; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ubiiclou.info/aU4VXCP6/)"; flow:established,to_server; http.uri; content:"/aU4VXCP6/"; startswith; fast_pattern; http.host; content:"ubiiclou.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006031; classtype:social-engineering; sid:6006031; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xiaoweiqianbaoapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xiaoweiqianbaoapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006032; classtype:social-engineering; sid:6006032; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yangshuqianbaoappxiazaianzhuang.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yangshuqianbaoappxiazaianzhuang.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006033; classtype:social-engineering; sid:6006033; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (payoneergw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"payoneergw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006034; classtype:social-engineering; sid:6006034; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rmpqkzljb.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rmpqkzljb.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006035; classtype:social-engineering; sid:6006035; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coinbaseguanwangxiazai.com.cn/about.html)"; flow:established,to_server; http.uri; content:"/about.html"; startswith; fast_pattern; http.host; content:"coinbaseguanwangxiazai.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006036; classtype:social-engineering; sid:6006036; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iforget-account-ubic.click/expire/)"; flow:established,to_server; http.uri; content:"/expire/"; startswith; fast_pattern; http.host; content:"iforget-account-ubic.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006037; classtype:social-engineering; sid:6006037; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (santanderblnito.hosted.phplist.com/lists/?p=subscribe&id=3)"; flow:established,to_server; http.uri; content:"/lists/?p=subscribe&id=3"; startswith; fast_pattern; http.host; content:"santanderblnito.hosted.phplist.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006038; classtype:social-engineering; sid:6006038; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paybank.qotbcrzs.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paybank.qotbcrzs.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006039; classtype:social-engineering; sid:6006039; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wbmail.free.fr.s-host.net/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"wbmail.free.fr.s-host.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006040; classtype:social-engineering; sid:6006040; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paybank.bamczq.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paybank.bamczq.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006041; classtype:social-engineering; sid:6006041; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paybank.annovmc.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paybank.annovmc.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006042; classtype:social-engineering; sid:6006042; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paybank.bhsvken.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paybank.bhsvken.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006043; classtype:social-engineering; sid:6006043; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paybank.nowifea.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paybank.nowifea.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006044; classtype:social-engineering; sid:6006044; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (global-learn.ghost.io/suite/)"; flow:established,to_server; http.uri; content:"/suite/"; startswith; fast_pattern; http.host; content:"global-learn.ghost.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006045; classtype:social-engineering; sid:6006045; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paybank.ccuzazv.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paybank.ccuzazv.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006046; classtype:social-engineering; sid:6006046; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paybank.bwttvk.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paybank.bwttvk.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006047; classtype:social-engineering; sid:6006047; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paybank.uzzpwsd.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paybank.uzzpwsd.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006048; classtype:social-engineering; sid:6006048; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paybank.sbbjdu.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paybank.sbbjdu.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006049; classtype:social-engineering; sid:6006049; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paybank.appcmiy.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paybank.appcmiy.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006050; classtype:social-engineering; sid:6006050; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (homepage-trezo.ghost.io/suite-en/)"; flow:established,to_server; http.uri; content:"/suite-en/"; startswith; fast_pattern; http.host; content:"homepage-trezo.ghost.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006051; classtype:social-engineering; sid:6006051; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lanaselsy.com/wp-admin/type.php?r=bD1odHRwczovL2RxcmRidi5jb20v)"; flow:established,to_server; http.uri; content:"/wp-admin/type.php?r=bD1odHRwczovL2RxcmRidi5jb20v"; startswith; fast_pattern; http.host; content:"lanaselsy.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006052; classtype:social-engineering; sid:6006052; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paybank.zgedgfb.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paybank.zgedgfb.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006053; classtype:social-engineering; sid:6006053; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paybank.modcrw.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paybank.modcrw.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006054; classtype:social-engineering; sid:6006054; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kleinanzeigen.bestell49439.shop/order/2048490?utm_source=1)"; flow:established,to_server; http.uri; content:"/order/2048490?utm_source=1"; startswith; fast_pattern; http.host; content:"kleinanzeigen.bestell49439.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006055; classtype:social-engineering; sid:6006055; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usausua.com/561489)"; flow:established,to_server; http.uri; content:"/561489"; startswith; fast_pattern; http.host; content:"usausua.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006056; classtype:social-engineering; sid:6006056; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (servicepeagefrance.org/index.php)"; flow:established,to_server; http.uri; content:"/index.php"; startswith; fast_pattern; http.host; content:"servicepeagefrance.org"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006057; classtype:social-engineering; sid:6006057; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paybank.tvujzxv.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paybank.tvujzxv.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006058; classtype:social-engineering; sid:6006058; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paybank.vjedqh.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paybank.vjedqh.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006059; classtype:social-engineering; sid:6006059; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (01i1xpol-9v84.a5fxid.casa/o/mjo4a/1778774254666#selectedbank2)"; flow:established,to_server; http.uri; content:"/o/mjo4a/1778774254666#selectedbank2"; startswith; fast_pattern; http.host; content:"01i1xpol-9v84.a5fxid.casa"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006060; classtype:social-engineering; sid:6006060; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2026-05-24.sqllq.com/en/?howtosuecslplasma.org#nolanguage)"; flow:established,to_server; http.uri; content:"/en/?howtosuecslplasma.org#nolanguage"; startswith; fast_pattern; http.host; content:"2026-05-24.sqllq.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006061; classtype:social-engineering; sid:6006061; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lavessi.moderneccentric.com/wp-content/plugins/wp-respiratory-direct/index.php?r=bD1odHRwczovL2RxcmRidi5jb20v)"; flow:established,to_server; http.uri; content:"/wp-content/plugins/wp-respiratory-direct/index.php?r=bD1odHRwczovL2RxcmRidi5jb20v"; startswith; fast_pattern; http.host; content:"lavessi.moderneccentric.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006062; classtype:social-engineering; sid:6006062; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paybank.agfbh.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paybank.agfbh.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006063; classtype:social-engineering; sid:6006063; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paybank.voxmvqn.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paybank.voxmvqn.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006064; classtype:social-engineering; sid:6006064; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (servicepeagefrance.org/#/captcha)"; flow:established,to_server; http.uri; content:"/#/captcha"; startswith; fast_pattern; http.host; content:"servicepeagefrance.org"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006065; classtype:social-engineering; sid:6006065; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (form-ap1-561450.public.500apps.org/forms/12993/email)"; flow:established,to_server; http.uri; content:"/forms/12993/email"; startswith; fast_pattern; http.host; content:"form-ap1-561450.public.500apps.org"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006066; classtype:social-engineering; sid:6006066; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (middlesex33secure.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"middlesex33secure.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006067; classtype:social-engineering; sid:6006067; rev:1; metadata: signature_severity Major, created_et 2026_05_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (live-ledggr-help.zapier.app/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"live-ledggr-help.zapier.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006068; classtype:social-engineering; sid:6006068; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (home-starts-ledgrcdn.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"home-starts-ledgrcdn.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006069; classtype:social-engineering; sid:6006069; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure.winred.com/1776-patriots-united/tariff-check-pending-vt/?recurring=true&amtposition=2&utm_source=VT&utm_medium=text-ep&utm_campaign=EXT&utm_content=tcre&utm_term=OPU-IR-ROC-050926-SMS-P-RS--65ef3c24c5dcd87a2dfdf7f4)"; flow:established,to_server; http.uri; content:"/1776-patriots-united/tariff-check-pending-vt/?recurring=true&amtposition=2&utm_source=VT&utm_medium=text-ep&utm_campaign=EXT&utm_content=tcre&utm_term=OPU-IR-ROC-050926-SMS-P-RS--65ef3c24c5dcd87a2dfdf7f4"; startswith; fast_pattern; http.host; content:"secure.winred.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006070; classtype:social-engineering; sid:6006070; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagrmm.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagrmm.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006071; classtype:social-engineering; sid:6006071; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (server.852852.vip/admin/auth/login)"; flow:established,to_server; http.uri; content:"/admin/auth/login"; startswith; fast_pattern; http.host; content:"server.852852.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006072; classtype:social-engineering; sid:6006072; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.feiji-tele.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.feiji-tele.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006073; classtype:social-engineering; sid:6006073; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usdtqianbaoguanwangrukougw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"usdtqianbaoguanwangrukougw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006074; classtype:social-engineering; sid:6006074; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebookf9.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebookf9.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006075; classtype:social-engineering; sid:6006075; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365qianbaoanzhuobananzhuanggw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"365qianbaoanzhuobananzhuanggw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006076; classtype:social-engineering; sid:6006076; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pubgmgobal.officiall-events.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pubgmgobal.officiall-events.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006077; classtype:social-engineering; sid:6006077; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.sexnavor.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.sexnavor.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006078; classtype:social-engineering; sid:6006078; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tarnexov.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tarnexov.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006079; classtype:social-engineering; sid:6006079; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kdouqianbaoguanfangxiazairukou.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kdouqianbaoguanfangxiazairukou.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006080; classtype:social-engineering; sid:6006080; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xenvirox.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.xenvirox.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006081; classtype:social-engineering; sid:6006081; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (okpayshoujibanxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"okpayshoujibanxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006082; classtype:social-engineering; sid:6006082; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tronqianbaoguanwang.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tronqianbaoguanwang.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006083; classtype:social-engineering; sid:6006083; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (upholld-login.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"upholld-login.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006084; classtype:social-engineering; sid:6006084; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kdpayqianbaoxiazairukou.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kdpayqianbaoxiazairukou.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006085; classtype:social-engineering; sid:6006085; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xuniqianbaoxiazai.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xuniqianbaoxiazai.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006086; classtype:social-engineering; sid:6006086; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jingdongqiyeqianbaogw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jingdongqiyeqianbaogw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006087; classtype:social-engineering; sid:6006087; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.dranketio.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.dranketio.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006088; classtype:social-engineering; sid:6006088; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mipchincha-2026.zya.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mipchincha-2026.zya.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006089; classtype:social-engineering; sid:6006089; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kdpayqianbaoappzuixinbanbenxiazai.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kdpayqianbaoappzuixinbanbenxiazai.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006090; classtype:social-engineering; sid:6006090; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (admin.coinbase-china.info/admin/auth/login)"; flow:established,to_server; http.uri; content:"/admin/auth/login"; startswith; fast_pattern; http.host; content:"admin.coinbase-china.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006091; classtype:social-engineering; sid:6006091; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cn-hht-web-whatsapp.com.cn/shop/configs/index.php)"; flow:established,to_server; http.uri; content:"/shop/configs/index.php"; startswith; fast_pattern; http.host; content:"cn-hht-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006092; classtype:social-engineering; sid:6006092; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.veleloro.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.veleloro.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006093; classtype:social-engineering; sid:6006093; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bvxtrmqpl.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.bvxtrmqpl.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006094; classtype:social-engineering; sid:6006094; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gamefrenzy180.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gamefrenzy180.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006095; classtype:social-engineering; sid:6006095; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.telvora.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.telvora.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006096; classtype:social-engineering; sid:6006096; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fdsf32fdsfsvb4bber3r2-c3exgte7agfzdjej.z03.azurefd.net/Win20Errfb020/index.html)"; flow:established,to_server; http.uri; content:"/Win20Errfb020/index.html"; startswith; fast_pattern; http.host; content:"fdsf32fdsfsvb4bber3r2-c3exgte7agfzdjej.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006097; classtype:social-engineering; sid:6006097; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.uarmetaki.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.uarmetaki.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006098; classtype:social-engineering; sid:6006098; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eqe-qhx-biz-rkp-vtn-sp3ct1.pages.dev/form_submit_appeal/)"; flow:established,to_server; http.uri; content:"/form_submit_appeal/"; startswith; fast_pattern; http.host; content:"eqe-qhx-biz-rkp-vtn-sp3ct1.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006099; classtype:social-engineering; sid:6006099; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.jiaoxue-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.jiaoxue-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006100; classtype:social-engineering; sid:6006100; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ansr.pt.ha009.t.mydomain.zone/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ansr.pt.ha009.t.mydomain.zone"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006101; classtype:social-engineering; sid:6006101; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dipanwitachakraborty25.github.io/NETFLIX/)"; flow:established,to_server; http.uri; content:"/NETFLIX/"; startswith; fast_pattern; http.host; content:"dipanwitachakraborty25.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006102; classtype:social-engineering; sid:6006102; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imkeeto.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"imkeeto.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006103; classtype:social-engineering; sid:6006103; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cbiqianbaoxiazaiappzuixinban.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cbiqianbaoxiazaiappzuixinban.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006104; classtype:social-engineering; sid:6006104; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cn-hua-web-whatsapp.com.cn/css)"; flow:established,to_server; http.uri; content:"/css"; startswith; fast_pattern; http.host; content:"www.cn-hua-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006105; classtype:social-engineering; sid:6006105; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dobslaw.net/askx/)"; flow:established,to_server; http.uri; content:"/askx/"; startswith; fast_pattern; http.host; content:"www.dobslaw.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006106; classtype:social-engineering; sid:6006106; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bnqvxp.club/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.bnqvxp.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006107; classtype:social-engineering; sid:6006107; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tynqkrl.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.tynqkrl.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006108; classtype:social-engineering; sid:6006108; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.shipgridhub.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.shipgridhub.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006109; classtype:social-engineering; sid:6006109; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uqianbaoguanwangrukougw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uqianbaoguanwangrukougw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006110; classtype:social-engineering; sid:6006110; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (13846.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"13846.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006111; classtype:social-engineering; sid:6006111; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kdpayqianbaoxiazaianzhuobangw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kdpayqianbaoxiazaianzhuobangw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006112; classtype:social-engineering; sid:6006112; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.infohadiah354.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.infohadiah354.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006113; classtype:social-engineering; sid:6006113; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.yemkaroli.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.yemkaroli.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006114; classtype:social-engineering; sid:6006114; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.wealthhubz.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.wealthhubz.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006115; classtype:social-engineering; sid:6006115; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.ivelvoketi.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.ivelvoketi.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006116; classtype:social-engineering; sid:6006116; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bt2026-ai.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bt2026-ai.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006117; classtype:social-engineering; sid:6006117; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tradetrix.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.tradetrix.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006118; classtype:social-engineering; sid:6006118; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xexnavor.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.xexnavor.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006119; classtype:social-engineering; sid:6006119; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tqplvkr.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.tqplvkr.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006120; classtype:social-engineering; sid:6006120; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-jwb-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app-jwb-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006121; classtype:social-engineering; sid:6006121; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shuziqianbaogw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shuziqianbaogw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006122; classtype:social-engineering; sid:6006122; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cgpayqianbaoguanfangrukougw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cgpayqianbaoguanfangrukougw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006123; classtype:social-engineering; sid:6006123; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vexnavor.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.vexnavor.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006124; classtype:social-engineering; sid:6006124; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bobiqianbaoappanzhuoxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bobiqianbaoappanzhuoxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006125; classtype:social-engineering; sid:6006125; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abpayaiboqianbaoguanwang.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"abpayaiboqianbaoguanwang.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006126; classtype:social-engineering; sid:6006126; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (topayqianbaoanzhuoban.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"topayqianbaoanzhuoban.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006127; classtype:social-engineering; sid:6006127; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktty-pnjam.dft-tar.my.id/no.html)"; flow:established,to_server; http.uri; content:"/no.html"; startswith; fast_pattern; http.host; content:"aktty-pnjam.dft-tar.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006128; classtype:social-engineering; sid:6006128; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tonvexar.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.tonvexar.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006129; classtype:social-engineering; sid:6006129; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.velelora.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.velelora.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006130; classtype:social-engineering; sid:6006130; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (okqianbaoguanwangxiazai.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"okqianbaoguanwangxiazai.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006131; classtype:social-engineering; sid:6006131; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee-jkt445.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopee-jkt445.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006132; classtype:social-engineering; sid:6006132; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vrqkbnljp.club/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.vrqkbnljp.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006133; classtype:social-engineering; sid:6006133; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (16189.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"16189.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006134; classtype:social-engineering; sid:6006134; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (optionsface.028426.com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"optionsface.028426.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006135; classtype:social-engineering; sid:6006135; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (okpayqianbaozuixinbananzhuoban.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"okpayqianbaozuixinbananzhuoban.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006136; classtype:social-engineering; sid:6006136; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (douyinqianbaojieqian.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"douyinqianbaojieqian.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006137; classtype:social-engineering; sid:6006137; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail-server-supportmy-yiscx80byz.zh-cn.edgeone.cool/?eo_token=251d47fbeeb8fb4c806ddb1af5fb30c1)"; flow:established,to_server; http.uri; content:"/?eo_token=251d47fbeeb8fb4c806ddb1af5fb30c1"; startswith; fast_pattern; http.host; content:"mail-server-supportmy-yiscx80byz.zh-cn.edgeone.cool"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006138; classtype:social-engineering; sid:6006138; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.kcc.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.kcc.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006139; classtype:social-engineering; sid:6006139; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagrmm.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagrmm.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006140; classtype:social-engineering; sid:6006140; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5twtbg.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"5twtbg.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006141; classtype:social-engineering; sid:6006141; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.wealthlinex.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.wealthlinex.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006142; classtype:social-engineering; sid:6006142; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-uphold-com-authen.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sso-uphold-com-authen.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006143; classtype:social-engineering; sid:6006143; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cgpayqianbaoguanwangxiazai.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cgpayqianbaoguanwangxiazai.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006144; classtype:social-engineering; sid:6006144; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webapp---docs---trezor.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webapp---docs---trezor.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006145; classtype:social-engineering; sid:6006145; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shareumqnz.pages.dev/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"shareumqnz.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006146; classtype:social-engineering; sid:6006146; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.program-shopee47.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.program-shopee47.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006147; classtype:social-engineering; sid:6006147; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abpayqianbaoappxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"abpayqianbaoappxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006148; classtype:social-engineering; sid:6006148; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web.coinbase-china.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web.coinbase-china.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006149; classtype:social-engineering; sid:6006149; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vjqpxzrlyt.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.vjqpxzrlyt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006150; classtype:social-engineering; sid:6006150; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tqplkbr.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.tqplkbr.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006151; classtype:social-engineering; sid:6006151; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shanyongqianbao.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shanyongqianbao.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006152; classtype:social-engineering; sid:6006152; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lengqianbaoappxiazai.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lengqianbaoappxiazai.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006153; classtype:social-engineering; sid:6006153; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rremoteki.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.rremoteki.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006154; classtype:social-engineering; sid:6006154; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.veleloni.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.veleloni.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006155; classtype:social-engineering; sid:6006155; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (upayqianbaoappxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"upayqianbaoappxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006156; classtype:social-engineering; sid:6006156; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.remkaroli.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.remkaroli.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006157; classtype:social-engineering; sid:6006157; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appqianbaoxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"appqianbaoxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006158; classtype:social-engineering; sid:6006158; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (derlifed.github.io/ig-unblocked/)"; flow:established,to_server; http.uri; content:"/ig-unblocked/"; startswith; fast_pattern; http.host; content:"derlifed.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006159; classtype:social-engineering; sid:6006159; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xiazaishuziqianbaoapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xiazaishuziqianbaoapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006160; classtype:social-engineering; sid:6006160; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vraklenoki.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.vraklenoki.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006161; classtype:social-engineering; sid:6006161; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (okddd.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"okddd.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006162; classtype:social-engineering; sid:6006162; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aiboabpayqianbao.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aiboabpayqianbao.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006163; classtype:social-engineering; sid:6006163; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dana4-indoneesia.hvqs.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dana4-indoneesia.hvqs.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006164; classtype:social-engineering; sid:6006164; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.velelumi.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.velelumi.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006165; classtype:social-engineering; sid:6006165; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.shipgatewayhub.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.shipgatewayhub.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006166; classtype:social-engineering; sid:6006166; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.wanvirox.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.wanvirox.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006167; classtype:social-engineering; sid:6006167; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sf-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.sf-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006168; classtype:social-engineering; sid:6006168; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moveinbreeze.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moveinbreeze.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006169; classtype:social-engineering; sid:6006169; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vfjkblqzr.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.vfjkblqzr.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006170; classtype:social-engineering; sid:6006170; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mpayqianbaoguanwangxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mpayqianbaoguanwangxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006171; classtype:social-engineering; sid:6006171; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.wanvexori.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.wanvexori.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006172; classtype:social-engineering; sid:6006172; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (noqianbaoshoujibanxiazai.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"noqianbaoshoujibanxiazai.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006173; classtype:social-engineering; sid:6006173; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso----m-uphold-app.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sso----m-uphold-app.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006174; classtype:social-engineering; sid:6006174; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qianbaoappxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qianbaoappxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006175; classtype:social-engineering; sid:6006175; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xiaoweiqianbaogf.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xiaoweiqianbaogf.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006176; classtype:social-engineering; sid:6006176; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-clone-phi-seven.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-clone-phi-seven.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006177; classtype:social-engineering; sid:6006177; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hans-oe.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hans-oe.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006178; classtype:social-engineering; sid:6006178; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (noqianbaoappguanwangxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"noqianbaoappguanwangxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006179; classtype:social-engineering; sid:6006179; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.texnavor.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.texnavor.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006180; classtype:social-engineering; sid:6006180; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yekemetal.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yekemetal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006181; classtype:social-engineering; sid:6006181; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoja36.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoja36.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006182; classtype:social-engineering; sid:6006182; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kuailian-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kuailian-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006183; classtype:social-engineering; sid:6006183; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-web5-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app-web5-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006184; classtype:social-engineering; sid:6006184; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.shipquick.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.shipquick.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006185; classtype:social-engineering; sid:6006185; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tqplvxn.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.tqplvxn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006186; classtype:social-engineering; sid:6006186; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.wealthhubx.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.wealthhubx.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006187; classtype:social-engineering; sid:6006187; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tradetrixio.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.tradetrixio.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006188; classtype:social-engineering; sid:6006188; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nowalletqianbao.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nowalletqianbao.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006189; classtype:social-engineering; sid:6006189; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bobiqianbaoappmianfeixiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bobiqianbaoappmianfeixiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006190; classtype:social-engineering; sid:6006190; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trc20qianbaoxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trc20qianbaoxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006191; classtype:social-engineering; sid:6006191; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eeqianbaoappxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eeqianbaoappxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006192; classtype:social-engineering; sid:6006192; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.trvkbqn.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.trvkbqn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006193; classtype:social-engineering; sid:6006193; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mofa.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mofa.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006194; classtype:social-engineering; sid:6006194; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (feiji-tgle.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"feiji-tgle.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006195; classtype:social-engineering; sid:6006195; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kdouqianbaoappxiazailianjiegw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kdouqianbaoappxiazailianjiegw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006196; classtype:social-engineering; sid:6006196; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tgpayqianbaoappxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tgpayqianbaoappxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006197; classtype:social-engineering; sid:6006197; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.sremoteki.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.sremoteki.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006198; classtype:social-engineering; sid:6006198; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ansr.pt.ha009.t.mydomain.zone/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ansr.pt.ha009.t.mydomain.zone"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006199; classtype:social-engineering; sid:6006199; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (okpayxiazaianzhuobangw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"okpayxiazaianzhuobangw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006200; classtype:social-engineering; sid:6006200; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.uanvirox.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.uanvirox.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006201; classtype:social-engineering; sid:6006201; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.yklrpqvbn.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.yklrpqvbn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006202; classtype:social-engineering; sid:6006202; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paywallbuster.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paywallbuster.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006203; classtype:social-engineering; sid:6006203; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (epicskin.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"epicskin.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006204; classtype:social-engineering; sid:6006204; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cbiqianbaoappxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cbiqianbaoappxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006205; classtype:social-engineering; sid:6006205; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xonvexar.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.xonvexar.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006206; classtype:social-engineering; sid:6006206; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.wealthlinez.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.wealthlinez.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006207; classtype:social-engineering; sid:6006207; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vippayqianbaoguanfangxiazaianzhuang.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vippayqianbaoguanfangxiazaianzhuang.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006208; classtype:social-engineering; sid:6006208; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wanbiqianbaoappxiazaianzhuangzuixinban.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wanbiqianbaoappxiazaianzhuangzuixinban.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006209; classtype:social-engineering; sid:6006209; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kdpayqianbaoxiazaidizhi.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kdpayqianbaoxiazaidizhi.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006210; classtype:social-engineering; sid:6006210; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (noqianbaoxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"noqianbaoxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006211; classtype:social-engineering; sid:6006211; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zuse-b8h9efdraab5ajf7.z02.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zuse-b8h9efdraab5ajf7.z02.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006212; classtype:social-engineering; sid:6006212; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (napps-upholld.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"napps-upholld.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006213; classtype:social-engineering; sid:6006213; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tqzvrpn.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.tqzvrpn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006214; classtype:social-engineering; sid:6006214; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (feiraoserasa2026.vercel.app/serasa/ultimasemanafeiraonovo/ofertas.html/)"; flow:established,to_server; http.uri; content:"/serasa/ultimasemanafeiraonovo/ofertas.html/"; startswith; fast_pattern; http.host; content:"feiraoserasa2026.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006215; classtype:social-engineering; sid:6006215; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vorvexan.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.vorvexan.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006216; classtype:social-engineering; sid:6006216; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-net4-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app-net4-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006217; classtype:social-engineering; sid:6006217; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cgpayguanfangxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cgpayguanfangxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006218; classtype:social-engineering; sid:6006218; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.sendzuno.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.sendzuno.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006219; classtype:social-engineering; sid:6006219; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hans-oe.com.cn/download.html)"; flow:established,to_server; http.uri; content:"/download.html"; startswith; fast_pattern; http.host; content:"hans-oe.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006220; classtype:social-engineering; sid:6006220; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (homes-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"homes-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006221; classtype:social-engineering; sid:6006221; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.qsplx.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.qsplx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006222; classtype:social-engineering; sid:6006222; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.xupqetbd.one/uqjmw/)"; flow:established,to_server; http.uri; content:"/uqjmw/"; startswith; fast_pattern; http.host; content:"usps.xupqetbd.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006223; classtype:social-engineering; sid:6006223; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ddbqianbaoappxiazai.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ddbqianbaoappxiazai.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006224; classtype:social-engineering; sid:6006224; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.wealthmax.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.wealthmax.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006225; classtype:social-engineering; sid:6006225; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.uarnexov.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.uarnexov.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006226; classtype:social-engineering; sid:6006226; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qtpayqianbaoxiazaianzhuang.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qtpayqianbaoxiazaianzhuang.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006227; classtype:social-engineering; sid:6006227; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ebpayzhifupingtai.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ebpayzhifupingtai.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006228; classtype:social-engineering; sid:6006228; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (urlto.me/293f2)"; flow:established,to_server; http.uri; content:"/293f2"; startswith; fast_pattern; http.host; content:"urlto.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006229; classtype:social-engineering; sid:6006229; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support-uphold-cdn-auth.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"support-uphold-cdn-auth.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006230; classtype:social-engineering; sid:6006230; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smithjammy29-cmd.github.io/Bdhdn/)"; flow:established,to_server; http.uri; content:"/Bdhdn/"; startswith; fast_pattern; http.host; content:"smithjammy29-cmd.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006231; classtype:social-engineering; sid:6006231; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.cxvqtr.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.cxvqtr.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006232; classtype:social-engineering; sid:6006232; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vbklyrq.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.vbklyrq.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006233; classtype:social-engineering; sid:6006233; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.deliverza.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.deliverza.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006234; classtype:social-engineering; sid:6006234; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.27842636365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.27842636365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006235; classtype:social-engineering; sid:6006235; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (urlto.me/29PP6)"; flow:established,to_server; http.uri; content:"/29PP6"; startswith; fast_pattern; http.host; content:"urlto.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006236; classtype:social-engineering; sid:6006236; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bobiqianbaoappwangyebanrukougw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bobiqianbaoappwangyebanrukougw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006237; classtype:social-engineering; sid:6006237; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login-xingkongzh.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"login-xingkongzh.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006238; classtype:social-engineering; sid:6006238; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (admin.cccoinbase.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"admin.cccoinbase.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006239; classtype:social-engineering; sid:6006239; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.shipbexo.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.shipbexo.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006240; classtype:social-engineering; sid:6006240; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.luvmelove.com/cori/)"; flow:established,to_server; http.uri; content:"/cori/"; startswith; fast_pattern; http.host; content:"www.luvmelove.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006241; classtype:social-engineering; sid:6006241; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (estudiocils.com.ar/198198/redirect)"; flow:established,to_server; http.uri; content:"/198198/redirect"; startswith; fast_pattern; http.host; content:"estudiocils.com.ar"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006242; classtype:social-engineering; sid:6006242; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kdouqianbaoappxiazaiguanwang.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kdouqianbaoappxiazaiguanwang.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006243; classtype:social-engineering; sid:6006243; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appleservice.sviluppo.host/Login/510515CEERT0I12UO12QSDR000008U41SDC0SDVDF0BF005TYYJ1510D5FV1ZE51F04/3)"; flow:established,to_server; http.uri; content:"/Login/510515CEERT0I12UO12QSDR000008U41SDC0SDVDF0BF005TYYJ1510D5FV1ZE51F04/3"; startswith; fast_pattern; http.host; content:"appleservice.sviluppo.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006244; classtype:social-engineering; sid:6006244; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tarmetaki.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tarmetaki.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006245; classtype:social-engineering; sid:6006245; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (on3.305.myftpupload.com/cor/correos-2025-normal/correos-2025-normal/pages/alert.php)"; flow:established,to_server; http.uri; content:"/cor/correos-2025-normal/correos-2025-normal/pages/alert.php"; startswith; fast_pattern; http.host; content:"on3.305.myftpupload.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006246; classtype:social-engineering; sid:6006246; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.deliverywaypro.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.deliverywaypro.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006247; classtype:social-engineering; sid:6006247; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zxdanaindonsianew.fascist.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zxdanaindonsianew.fascist.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006248; classtype:social-engineering; sid:6006248; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hans-oe.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hans-oe.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006249; classtype:social-engineering; sid:6006249; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.veleloti.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.veleloti.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006250; classtype:social-engineering; sid:6006250; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (daishuqianbaogw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"daishuqianbaogw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006251; classtype:social-engineering; sid:6006251; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tpqianbaoappguanfangxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tpqianbaoappguanfangxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006252; classtype:social-engineering; sid:6006252; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.xupqvgej.shop/uqjmw/)"; flow:established,to_server; http.uri; content:"/uqjmw/"; startswith; fast_pattern; http.host; content:"usps.xupqvgej.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006253; classtype:social-engineering; sid:6006253; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.shipgatewayzone.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.shipgatewayzone.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006254; classtype:social-engineering; sid:6006254; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (16162.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"16162.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006255; classtype:social-engineering; sid:6006255; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (okpayguanfangxiazairukou.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"okpayguanfangxiazairukou.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006256; classtype:social-engineering; sid:6006256; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365appqianbaoguanwangxiazai.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"365appqianbaoguanwangxiazai.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006257; classtype:social-engineering; sid:6006257; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kdouqianbaopingguoxiazai.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kdouqianbaopingguoxiazai.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006258; classtype:social-engineering; sid:6006258; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.worvexira.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.worvexira.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006259; classtype:social-engineering; sid:6006259; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usdtqianbaodizhichaxungw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"usdtqianbaodizhichaxungw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006260; classtype:social-engineering; sid:6006260; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (808qianbaoanzhuobanxiazai.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"808qianbaoanzhuobanxiazai.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006261; classtype:social-engineering; sid:6006261; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.sendxora.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.sendxora.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006262; classtype:social-engineering; sid:6006262; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (miaofuqianbaoxiazaiappgw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"miaofuqianbaoxiazaiappgw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006263; classtype:social-engineering; sid:6006263; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ezpayguanfangzhengbanxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ezpayguanfangzhengbanxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006264; classtype:social-engineering; sid:6006264; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bzrvqn.club/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.bzrvqn.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006265; classtype:social-engineering; sid:6006265; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rlvkqbm.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.rlvkqbm.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006266; classtype:social-engineering; sid:6006266; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-follow.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-follow.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006267; classtype:social-engineering; sid:6006267; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kbaoqianbaoappxiazaianzhuanggw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kbaoqianbaoappxiazaianzhuanggw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006268; classtype:social-engineering; sid:6006268; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webser99-mxhost997.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webser99-mxhost997.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006269; classtype:social-engineering; sid:6006269; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth-uphold-log-sso.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auth-uphold-log-sso.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006270; classtype:social-engineering; sid:6006270; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bobiqianbaoappguanwangxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bobiqianbaoappguanwangxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006271; classtype:social-engineering; sid:6006271; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ebpayguanwanggw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ebpayguanwanggw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006272; classtype:social-engineering; sid:6006272; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (krishnapratapsingh44.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"krishnapratapsingh44.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006273; classtype:social-engineering; sid:6006273; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.webser99-mxhost997.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.webser99-mxhost997.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006274; classtype:social-engineering; sid:6006274; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (okpaypingguoshoujixiazaiwangzhi.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"okpaypingguoshoujixiazaiwangzhi.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006275; classtype:social-engineering; sid:6006275; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (disanfangqianbaoappgw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"disanfangqianbaoappgw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006276; classtype:social-engineering; sid:6006276; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vorvexira.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.vorvexira.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006277; classtype:social-engineering; sid:6006277; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.okbbb.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.okbbb.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006278; classtype:social-engineering; sid:6006278; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-uphold-cdn.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-uphold-cdn.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006279; classtype:social-engineering; sid:6006279; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kbaoqianbaoappguanfangrukougw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kbaoqianbaoappguanfangrukougw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006280; classtype:social-engineering; sid:6006280; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (988payqianbaoxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"988payqianbaoxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006281; classtype:social-engineering; sid:6006281; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tarnixo.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.tarnixo.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006282; classtype:social-engineering; sid:6006282; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (24coinqianbaoxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"24coinqianbaoxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006283; classtype:social-engineering; sid:6006283; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tanvirox.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.tanvirox.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006284; classtype:social-engineering; sid:6006284; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-clone-phi-seven.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-clone-phi-seven.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006285; classtype:social-engineering; sid:6006285; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tzqvlrb.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.tzqvlrb.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006286; classtype:social-engineering; sid:6006286; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tradetwistx.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.tradetwistx.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006287; classtype:social-engineering; sid:6006287; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (noqianbaowangyebangw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"noqianbaowangyebangw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006288; classtype:social-engineering; sid:6006288; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (noqianbaoguanwangrukougw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"noqianbaoguanwangrukougw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006289; classtype:social-engineering; sid:6006289; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xuniqianbaogf.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xuniqianbaogf.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006290; classtype:social-engineering; sid:6006290; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vivoqianbaoappxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vivoqianbaoappxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006291; classtype:social-engineering; sid:6006291; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ddbqianbaoxiazaianzhuanggw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ddbqianbaoxiazaianzhuanggw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006292; classtype:social-engineering; sid:6006292; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tavnexor.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tavnexor.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006293; classtype:social-engineering; sid:6006293; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.wealthtrackx.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.wealthtrackx.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006294; classtype:social-engineering; sid:6006294; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.earnhubz.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.earnhubz.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006295; classtype:social-engineering; sid:6006295; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-secure-login.vercel.app/olb/app/logon-web)"; flow:established,to_server; http.uri; content:"/olb/app/logon-web"; startswith; fast_pattern; http.host; content:"business-secure-login.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006296; classtype:social-engineering; sid:6006296; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (988payqianbaopingguoban.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"988payqianbaopingguoban.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006297; classtype:social-engineering; sid:6006297; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (solicitemaisaumentoaqui.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"solicitemaisaumentoaqui.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006298; classtype:social-engineering; sid:6006298; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (haohanqianbaoappxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"haohanqianbaoappxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006299; classtype:social-engineering; sid:6006299; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cbiqianbaowangyebangw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cbiqianbaowangyebangw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006300; classtype:social-engineering; sid:6006300; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktty-pnjam.dft-tar.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktty-pnjam.dft-tar.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006301; classtype:social-engineering; sid:6006301; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nuevacarteradeclientes--manita121.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nuevacarteradeclientes--manita121.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006302; classtype:social-engineering; sid:6006302; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (feiji-yo.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"feiji-yo.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006303; classtype:social-engineering; sid:6006303; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.eranketio.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.eranketio.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006304; classtype:social-engineering; sid:6006304; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth---com-uphold-login.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auth---com-uphold-login.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006305; classtype:social-engineering; sid:6006305; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.sendzaro.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.sendzaro.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006306; classtype:social-engineering; sid:6006306; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (page--auth-uphold-sso.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"page--auth-uphold-sso.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006307; classtype:social-engineering; sid:6006307; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (noqianbaoappguanwangrukougw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"noqianbaoappguanwangrukougw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006308; classtype:social-engineering; sid:6006308; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.giant-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.giant-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006309; classtype:social-engineering; sid:6006309; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-login-clone-nine.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-login-clone-nine.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006310; classtype:social-engineering; sid:6006310; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cgpayqianbaoxiazaiguanwanggw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cgpayqianbaoxiazaiguanwanggw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006311; classtype:social-engineering; sid:6006311; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jdpayqianbaoguanwang.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jdpayqianbaoguanwang.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006312; classtype:social-engineering; sid:6006312; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kdouqianbaowangzhandenglurukou.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kdouqianbaowangzhandenglurukou.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006313; classtype:social-engineering; sid:6006313; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kdouqianbaoappxiazaianzhuanggw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kdouqianbaoappxiazaianzhuanggw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006314; classtype:social-engineering; sid:6006314; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nopayqianbaoxiazaidizhigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nopayqianbaoxiazaidizhigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006315; classtype:social-engineering; sid:6006315; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.earnmaxx.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.earnmaxx.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006316; classtype:social-engineering; sid:6006316; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.deliverytrailx.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.deliverytrailx.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006317; classtype:social-engineering; sid:6006317; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kualianlin.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kualianlin.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006318; classtype:social-engineering; sid:6006318; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.wonvexar.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.wonvexar.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006319; classtype:social-engineering; sid:6006319; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portallogin-pchincha.zya.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"portallogin-pchincha.zya.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006320; classtype:social-engineering; sid:6006320; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cn-hht-web-whatsapp.com.cn/dynamicweb/jsp/login/userLoginAction.do)"; flow:established,to_server; http.uri; content:"/dynamicweb/jsp/login/userLoginAction.do"; startswith; fast_pattern; http.host; content:"cn-hht-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006321; classtype:social-engineering; sid:6006321; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xiazaikdouqianbaoapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xiazaikdouqianbaoapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006322; classtype:social-engineering; sid:6006322; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (admin.luxurywatchesus.com/admin/auth/login)"; flow:established,to_server; http.uri; content:"/admin/auth/login"; startswith; fast_pattern; http.host; content:"admin.luxurywatchesus.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006323; classtype:social-engineering; sid:6006323; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.q6m9fh.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.q6m9fh.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006324; classtype:social-engineering; sid:6006324; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (upholdloogine.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"upholdloogine.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006325; classtype:social-engineering; sid:6006325; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee-jkt445.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopee-jkt445.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006326; classtype:social-engineering; sid:6006326; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (astoriaking15.github.io/netflix-clone)"; flow:established,to_server; http.uri; content:"/netflix-clone"; startswith; fast_pattern; http.host; content:"astoriaking15.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006327; classtype:social-engineering; sid:6006327; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appleservice.sviluppo.host/Login/510515CEERT0I12UO12QSDR000008U41SDC0SDVDF0BF005TYYJ1510D5FV1ZE51F04/)"; flow:established,to_server; http.uri; content:"/Login/510515CEERT0I12UO12QSDR000008U41SDC0SDVDF0BF005TYYJ1510D5FV1ZE51F04/"; startswith; fast_pattern; http.host; content:"appleservice.sviluppo.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006328; classtype:social-engineering; sid:6006328; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-login-clone-nine.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-login-clone-nine.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006329; classtype:social-engineering; sid:6006329; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bzqwln.club/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.bzqwln.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006330; classtype:social-engineering; sid:6006330; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web.cccoinbase.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web.cccoinbase.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006331; classtype:social-engineering; sid:6006331; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support.fast-assist.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"support.fast-assist.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006332; classtype:social-engineering; sid:6006332; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rbx.asia/TgIa1LK)"; flow:established,to_server; http.uri; content:"/TgIa1LK"; startswith; fast_pattern; http.host; content:"rbx.asia"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006333; classtype:social-engineering; sid:6006333; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qnasndnasn.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qnasndnasn.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006334; classtype:social-engineering; sid:6006334; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xhdhhd.com/rotorder)"; flow:established,to_server; http.uri; content:"/rotorder"; startswith; fast_pattern; http.host; content:"www.xhdhhd.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006335; classtype:social-engineering; sid:6006335; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xiazaihongdouqianbaoappgw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xiazaihongdouqianbaoappgw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006336; classtype:social-engineering; sid:6006336; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dianziqianbaoappxiazaigw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dianziqianbaoappxiazaigw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006337; classtype:social-engineering; sid:6006337; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login--sso-uphold-app.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"login--sso-uphold-app.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006338; classtype:social-engineering; sid:6006338; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tradezonez.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.tradezonez.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006339; classtype:social-engineering; sid:6006339; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (okpayqianbaoappxiazairukougw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"okpayqianbaoappxiazairukougw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006340; classtype:social-engineering; sid:6006340; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.wealthtrackz.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.wealthtrackz.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006341; classtype:social-engineering; sid:6006341; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (admin.cccoinbase.com/admin/auth/login)"; flow:established,to_server; http.uri; content:"/admin/auth/login"; startswith; fast_pattern; http.host; content:"admin.cccoinbase.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006342; classtype:social-engineering; sid:6006342; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (okqianbaoxiazaianzhuobangw.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"okqianbaoxiazaianzhuobangw.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006343; classtype:social-engineering; sid:6006343; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nardowy-site-clients.armann.se/797310df979004ae9651651e893a4bf2/PL/card.php)"; flow:established,to_server; http.uri; content:"/797310df979004ae9651651e893a4bf2/PL/card.php"; startswith; fast_pattern; http.host; content:"nardowy-site-clients.armann.se"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006344; classtype:social-engineering; sid:6006344; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pay.kirvano.com/a8612b14-ad97-46b5-a022-daebaa7e7caf)"; flow:established,to_server; http.uri; content:"/a8612b14-ad97-46b5-a022-daebaa7e7caf"; startswith; fast_pattern; http.host; content:"pay.kirvano.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006345; classtype:social-engineering; sid:6006345; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trzrious.wixstudio.com/strt)"; flow:established,to_server; http.uri; content:"/strt"; startswith; fast_pattern; http.host; content:"trzrious.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006346; classtype:social-engineering; sid:6006346; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trzriostrt.wixstudio.com/home)"; flow:established,to_server; http.uri; content:"/home"; startswith; fast_pattern; http.host; content:"trzriostrt.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006347; classtype:social-engineering; sid:6006347; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (starttrzr.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"starttrzr.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006348; classtype:social-engineering; sid:6006348; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.find-myphonee.top/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"mail.find-myphonee.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006349; classtype:social-engineering; sid:6006349; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ww-1cloud.com/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"ww-1cloud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006350; classtype:social-engineering; sid:6006350; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bitpue.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bitpue.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006351; classtype:social-engineering; sid:6006351; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tokenpockgt.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tokenpockgt.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006352; classtype:social-engineering; sid:6006352; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.located-devices.help/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"mail.located-devices.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006353; classtype:social-engineering; sid:6006353; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.icloudmyfind.com/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"mail.icloudmyfind.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006354; classtype:social-engineering; sid:6006354; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.findmyideviced.sbs/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"mail.findmyideviced.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006355; classtype:social-engineering; sid:6006355; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (saniya-s4.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"saniya-s4.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006356; classtype:social-engineering; sid:6006356; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kauongit.github.io/wannabe-E-commerce-assignment-1/)"; flow:established,to_server; http.uri; content:"/wannabe-E-commerce-assignment-1/"; startswith; fast_pattern; http.host; content:"kauongit.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006357; classtype:social-engineering; sid:6006357; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tokenpockkt.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tokenpockkt.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006358; classtype:social-engineering; sid:6006358; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jtj-iqiyi.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jtj-iqiyi.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006359; classtype:social-engineering; sid:6006359; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.apleid-login.us/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"mail.apleid-login.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006360; classtype:social-engineering; sid:6006360; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (click.wranglerdenver.info/ga/click/2-17643509-33-7707-15054-8253-118241d7cc-72e79cb278)"; flow:established,to_server; http.uri; content:"/ga/click/2-17643509-33-7707-15054-8253-118241d7cc-72e79cb278"; startswith; fast_pattern; http.host; content:"click.wranglerdenver.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006361; classtype:social-engineering; sid:6006361; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sabrina0604-max.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"sabrina0604-max.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006362; classtype:social-engineering; sid:6006362; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.idevicelocate.us/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"mail.idevicelocate.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006363; classtype:social-engineering; sid:6006363; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (autocolourpaint.co.za/nmxnmxzmm/bncmnmnznzm.html)"; flow:established,to_server; http.uri; content:"/nmxnmxzmm/bncmnmnznzm.html"; startswith; fast_pattern; http.host; content:"autocolourpaint.co.za"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006364; classtype:social-engineering; sid:6006364; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (autocolourpaint.co.za/mnzxxzmncooo/zmnmmnznmtool.html)"; flow:established,to_server; http.uri; content:"/mnzxxzmncooo/zmnmmnznmtool.html"; startswith; fast_pattern; http.host; content:"autocolourpaint.co.za"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006365; classtype:social-engineering; sid:6006365; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (onlybuytt.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"onlybuytt.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006366; classtype:social-engineering; sid:6006366; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (upholldlogi.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"upholldlogi.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006367; classtype:social-engineering; sid:6006367; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloud-find.top/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"icloud-find.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006368; classtype:social-engineering; sid:6006368; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (io-uphold.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"io-uphold.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006369; classtype:social-engineering; sid:6006369; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (raomudassir361.github.io/Amazon_Clone/)"; flow:established,to_server; http.uri; content:"/Amazon_Clone/"; startswith; fast_pattern; http.host; content:"raomudassir361.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006370; classtype:social-engineering; sid:6006370; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gala-yeni.cam/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gala-yeni.cam"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006371; classtype:social-engineering; sid:6006371; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (esl-org-secure.lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"esl-org-secure.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006372; classtype:social-engineering; sid:6006372; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.maps-locate-isupport.com/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"mail.maps-locate-isupport.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006373; classtype:social-engineering; sid:6006373; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (01felipeaugusto-star.github.io/https-www.instagram.com-/)"; flow:established,to_server; http.uri; content:"/https-www.instagram.com-/"; startswith; fast_pattern; http.host; content:"01felipeaugusto-star.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006374; classtype:social-engineering; sid:6006374; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-clone-eta.vercel.app/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"instagram-clone-eta.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006375; classtype:social-engineering; sid:6006375; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fnlocker.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fnlocker.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006376; classtype:social-engineering; sid:6006376; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (01felipeaugusto-star.github.io/https-www.instagram.com-)"; flow:established,to_server; http.uri; content:"/https-www.instagram.com-"; startswith; fast_pattern; http.host; content:"01felipeaugusto-star.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006377; classtype:social-engineering; sid:6006377; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imtoknn.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"imtoknn.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006378; classtype:social-engineering; sid:6006378; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (boutiqueelkesuperior.spahotel.guru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"boutiqueelkesuperior.spahotel.guru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006379; classtype:social-engineering; sid:6006379; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (matzpich.space/login.php)"; flow:established,to_server; http.uri; content:"/login.php"; startswith; fast_pattern; http.host; content:"matzpich.space"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006380; classtype:social-engineering; sid:6006380; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pc-web-zh-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pc-web-zh-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006381; classtype:social-engineering; sid:6006381; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (okmusic.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"okmusic.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006382; classtype:social-engineering; sid:6006382; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.myfindsupported.com/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"mail.myfindsupported.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006383; classtype:social-engineering; sid:6006383; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clouds-myphones.sbs/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"clouds-myphones.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006384; classtype:social-engineering; sid:6006384; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gu19.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gu19.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006385; classtype:social-engineering; sid:6006385; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hpa-lzya.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hpa-lzya.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006386; classtype:social-engineering; sid:6006386; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (freerobux.biowikiweb.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"freerobux.biowikiweb.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006387; classtype:social-engineering; sid:6006387; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ob-football-xingkong.bet/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ob-football-xingkong.bet"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006388; classtype:social-engineering; sid:6006388; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.encontrar-mapsslf.us/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"mail.encontrar-mapsslf.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006389; classtype:social-engineering; sid:6006389; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.findmy-dispositive.us/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"mail.findmy-dispositive.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006390; classtype:social-engineering; sid:6006390; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (findmy-dispositive.us/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"findmy-dispositive.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006391; classtype:social-engineering; sid:6006391; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iphone-lostdevice.help/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"iphone-lostdevice.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006392; classtype:social-engineering; sid:6006392; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.upholldlogi.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.upholldlogi.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006393; classtype:social-engineering; sid:6006393; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ifind-mydevices.us/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"ifind-mydevices.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006394; classtype:social-engineering; sid:6006394; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (waterpumpske.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"waterpumpske.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006395; classtype:social-engineering; sid:6006395; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (io-upheldlogi.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"io-upheldlogi.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006396; classtype:social-engineering; sid:6006396; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fy-device-isupport.com/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"fy-device-isupport.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006397; classtype:social-engineering; sid:6006397; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.apple-icloudlost.help/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"mail.apple-icloudlost.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006398; classtype:social-engineering; sid:6006398; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abhishek-tyagi23.github.io/Netflix-Clone)"; flow:established,to_server; http.uri; content:"/Netflix-Clone"; startswith; fast_pattern; http.host; content:"abhishek-tyagi23.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006399; classtype:social-engineering; sid:6006399; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imtoknr.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"imtoknr.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006400; classtype:social-engineering; sid:6006400; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.m--portal--uphld--autth--m.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.m--portal--uphld--autth--m.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006401; classtype:social-engineering; sid:6006401; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jux-mkliu.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jux-mkliu.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006402; classtype:social-engineering; sid:6006402; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso---hel--uphldd-us.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sso---hel--uphldd-us.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006403; classtype:social-engineering; sid:6006403; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tokenpockjt.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tokenpockjt.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006404; classtype:social-engineering; sid:6006404; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hr.dropcloud.it/paycheckaction?rid=giiTdAh)"; flow:established,to_server; http.uri; content:"/paycheckaction?rid=giiTdAh"; startswith; fast_pattern; http.host; content:"hr.dropcloud.it"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006405; classtype:social-engineering; sid:6006405; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imtoket.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"imtoket.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006406; classtype:social-engineering; sid:6006406; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (supports-cloudmyapple.sbs/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"supports-cloudmyapple.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006407; classtype:social-engineering; sid:6006407; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-clone-eta.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-clone-eta.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006408; classtype:social-engineering; sid:6006408; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anul-socgen.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"anul-socgen.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006409; classtype:social-engineering; sid:6006409; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tokenpockbt.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tokenpockbt.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006410; classtype:social-engineering; sid:6006410; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myfindsupport.com/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"myfindsupport.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006411; classtype:social-engineering; sid:6006411; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.supports-cloudmyapple.sbs/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"mail.supports-cloudmyapple.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006412; classtype:social-engineering; sid:6006412; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tokenpocknt.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tokenpocknt.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006413; classtype:social-engineering; sid:6006413; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-clone-eta.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-clone-eta.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006414; classtype:social-engineering; sid:6006414; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vitte.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vitte.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006415; classtype:social-engineering; sid:6006415; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (phone-locationsbs.us/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"phone-locationsbs.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006416; classtype:social-engineering; sid:6006416; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.steamcommunity-cs.at/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.steamcommunity-cs.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006417; classtype:social-engineering; sid:6006417; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tokenpockdt.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tokenpockdt.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006418; classtype:social-engineering; sid:6006418; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maps-locate-isupport.com/ICL266/?Ky1az8eeXIBQk2RY6kewEYudPa2UJ1J3RfYBAyqjmeZUJi7mKUfvBw2eDqVbwI6MXrFWQgVaB1L04yztUiqW6xRGjZ8NNAnjzn1x0IFgXCfqKTmi6LevsLE6s2gLk35FFhjZmRts2JEuzCWJgt5VAQEIGMRNUEHHguZ2e1XYUR=)"; flow:established,to_server; http.uri; content:"/ICL266/?Ky1az8eeXIBQk2RY6kewEYudPa2UJ1J3RfYBAyqjmeZUJi7mKUfvBw2eDqVbwI6MXrFWQgVaB1L04yztUiqW6xRGjZ8NNAnjzn1x0IFgXCfqKTmi6LevsLE6s2gLk35FFhjZmRts2JEuzCWJgt5VAQEIGMRNUEHHguZ2e1XYUR="; startswith; fast_pattern; http.host; content:"maps-locate-isupport.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006419; classtype:social-engineering; sid:6006419; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fnrarity.xin/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fnrarity.xin"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006420; classtype:social-engineering; sid:6006420; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.myphone-locate.us/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"mail.myphone-locate.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006421; classtype:social-engineering; sid:6006421; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-for-growth-leadership-center.pages.dev/appeals/submit-appeal-form/return/)"; flow:established,to_server; http.uri; content:"/appeals/submit-appeal-form/return/"; startswith; fast_pattern; http.host; content:"business-for-growth-leadership-center.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006422; classtype:social-engineering; sid:6006422; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aisios.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aisios.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006423; classtype:social-engineering; sid:6006423; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.2-www-lcloud.info/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"mail.2-www-lcloud.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006424; classtype:social-engineering; sid:6006424; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flnds-acountdmy.icu/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"flnds-acountdmy.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006425; classtype:social-engineering; sid:6006425; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imtokng.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"imtokng.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006426; classtype:social-engineering; sid:6006426; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xn--chqc11w798e.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xn--chqc11w798e.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006427; classtype:social-engineering; sid:6006427; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (saqib216.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"saqib216.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006428; classtype:social-engineering; sid:6006428; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.myphone-find.us/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"mail.myphone-find.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006429; classtype:social-engineering; sid:6006429; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezor-bridge-public-start-web-sso.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezor-bridge-public-start-web-sso.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006430; classtype:social-engineering; sid:6006430; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.2-www-lcloud.com/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"mail.2-www-lcloud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006431; classtype:social-engineering; sid:6006431; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tokenpockht.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tokenpockht.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006432; classtype:social-engineering; sid:6006432; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.amazon-clone-teal-three.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazon-clone-teal-three.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006433; classtype:social-engineering; sid:6006433; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reliable-mail.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"reliable-mail.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006434; classtype:social-engineering; sid:6006434; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tokenpockat.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tokenpockat.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006435; classtype:social-engineering; sid:6006435; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (id-myphone.us/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"id-myphone.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006436; classtype:social-engineering; sid:6006436; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.findphonecloud.life/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"mail.findphonecloud.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006437; classtype:social-engineering; sid:6006437; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wrightgtonhealthclub.spahotel.guru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wrightgtonhealthclub.spahotel.guru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006438; classtype:social-engineering; sid:6006438; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (global-iobriidge.zapier.app/bridge-en)"; flow:established,to_server; http.uri; content:"/bridge-en"; startswith; fast_pattern; http.host; content:"global-iobriidge.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006439; classtype:social-engineering; sid:6006439; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-follow.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-follow.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006440; classtype:social-engineering; sid:6006440; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (youzdao.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"youzdao.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006441; classtype:social-engineering; sid:6006441; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (findmydevice-info.us/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"findmydevice-info.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006442; classtype:social-engineering; sid:6006442; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tokenpockmt.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tokenpockmt.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006443; classtype:social-engineering; sid:6006443; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (insta-clone-app.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"insta-clone-app.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006444; classtype:social-engineering; sid:6006444; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (evitar-ya-lacompra26co.iceiy.com/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"evitar-ya-lacompra26co.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006445; classtype:social-engineering; sid:6006445; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeeday-11-11.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopeeday-11-11.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006446; classtype:social-engineering; sid:6006446; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.ww-1cloud.com/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"mail.ww-1cloud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006447; classtype:social-engineering; sid:6006447; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kartik-sharma-dev.github.io/Netflix-clone-)"; flow:established,to_server; http.uri; content:"/Netflix-clone-"; startswith; fast_pattern; http.host; content:"kartik-sharma-dev.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006448; classtype:social-engineering; sid:6006448; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-replica.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-replica.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006449; classtype:social-engineering; sid:6006449; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ilocate-devices.us/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"ilocate-devices.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006450; classtype:social-engineering; sid:6006450; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (danaa-iindonesia4.fxq.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"danaa-iindonesia4.fxq.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006451; classtype:social-engineering; sid:6006451; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tokenpockct.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tokenpockct.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006452; classtype:social-engineering; sid:6006452; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galabetonline.casino/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galabetonline.casino"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006453; classtype:social-engineering; sid:6006453; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-esl-org.lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-esl-org.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006454; classtype:social-engineering; sid:6006454; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imtokni.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"imtokni.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006455; classtype:social-engineering; sid:6006455; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e12oo-06e1-36ru-eda-4gl85.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e12oo-06e1-36ru-eda-4gl85.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006456; classtype:social-engineering; sid:6006456; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.waterpumpske.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.waterpumpske.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006457; classtype:social-engineering; sid:6006457; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.iapple-recover.com/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"mail.iapple-recover.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006458; classtype:social-engineering; sid:6006458; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (devices-ilocate.us/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"devices-ilocate.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006459; classtype:social-engineering; sid:6006459; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwwl-find-myiphone.help/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"wwwl-find-myiphone.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006460; classtype:social-engineering; sid:6006460; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.io-uphold.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.io-uphold.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006461; classtype:social-engineering; sid:6006461; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ilocate-device.us/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"ilocate-device.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006462; classtype:social-engineering; sid:6006462; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acces-myaccount.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"acces-myaccount.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006463; classtype:social-engineering; sid:6006463; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (match-odds-bet365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"match-odds-bet365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006464; classtype:social-engineering; sid:6006464; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apple-icloudlost.top/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"apple-icloudlost.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006465; classtype:social-engineering; sid:6006465; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mandtromainthus.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mandtromainthus.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006466; classtype:social-engineering; sid:6006466; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m--portal--uphld--autth--m.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m--portal--uphld--autth--m.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006467; classtype:social-engineering; sid:6006467; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.fy-device-isupport.com/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"mail.fy-device-isupport.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006468; classtype:social-engineering; sid:6006468; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2-www-lcloud.info/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"2-www-lcloud.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006469; classtype:social-engineering; sid:6006469; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tokenpockpt.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tokenpockpt.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006470; classtype:social-engineering; sid:6006470; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.1-www-lcloud.com/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"mail.1-www-lcloud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006471; classtype:social-engineering; sid:6006471; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-clone-eta.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-clone-eta.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006472; classtype:social-engineering; sid:6006472; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.www7find-myiphone.us/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"mail.www7find-myiphone.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006473; classtype:social-engineering; sid:6006473; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.ifindphone.us/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"mail.ifindphone.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006474; classtype:social-engineering; sid:6006474; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.onebuyone.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.onebuyone.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006475; classtype:social-engineering; sid:6006475; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16297.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16297.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006476; classtype:social-engineering; sid:6006476; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.apple-icloudlost.top/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"mail.apple-icloudlost.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006477; classtype:social-engineering; sid:6006477; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myphone-find.us/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"myphone-find.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006478; classtype:social-engineering; sid:6006478; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.ilocate-device.us/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"mail.ilocate-device.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006479; classtype:social-engineering; sid:6006479; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dy-tt.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dy-tt.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006480; classtype:social-engineering; sid:6006480; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2-www-lcloud.com/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"2-www-lcloud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006481; classtype:social-engineering; sid:6006481; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acortarlink.cl/eqhh6)"; flow:established,to_server; http.uri; content:"/eqhh6"; startswith; fast_pattern; http.host; content:"acortarlink.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006482; classtype:social-engineering; sid:6006482; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.findmydevice-info.us/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"mail.findmydevice-info.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006483; classtype:social-engineering; sid:6006483; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imtoknm.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"imtoknm.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006484; classtype:social-engineering; sid:6006484; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fyjd.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fyjd.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006485; classtype:social-engineering; sid:6006485; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web.cdn-app-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web.cdn-app-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006486; classtype:social-engineering; sid:6006486; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth-uphold-log-com.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auth-uphold-log-com.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006487; classtype:social-engineering; sid:6006487; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.auth---uphold-cdn-login.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.auth---uphold-cdn-login.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006488; classtype:social-engineering; sid:6006488; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rez-vtrw.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rez-vtrw.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006489; classtype:social-engineering; sid:6006489; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.wwwl-find-myiphone.help/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"mail.wwwl-find-myiphone.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006490; classtype:social-engineering; sid:6006490; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (claim-hadiah.idco.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"claim-hadiah.idco.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006491; classtype:social-engineering; sid:6006491; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fangr-youdao.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fangr-youdao.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006492; classtype:social-engineering; sid:6006492; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecert.am/.well-known/)"; flow:established,to_server; http.uri; content:"/.well-known/"; startswith; fast_pattern; http.host; content:"ecert.am"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006493; classtype:social-engineering; sid:6006493; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.fy-apple-isupport.com/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"mail.fy-apple-isupport.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006494; classtype:social-engineering; sid:6006494; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maps-locate-isupport.com/ICL266/?0mwwjQYoZLyYfISXFmVBrMoHUF0z9DGamBz2DGGEWXTw0w03ycm8kqcW9VMoBqxedgTg2X4T2pdoSj8ZW0lpMZSYG9OBRffFIQg42aiHjE2rb51HcFk09VeFkxxdFkblwer4ziXvcQt0HlCxSonmCthS0Ki052MTtcAmEdjkwt=)"; flow:established,to_server; http.uri; content:"/ICL266/?0mwwjQYoZLyYfISXFmVBrMoHUF0z9DGamBz2DGGEWXTw0w03ycm8kqcW9VMoBqxedgTg2X4T2pdoSj8ZW0lpMZSYG9OBRffFIQg42aiHjE2rb51HcFk09VeFkxxdFkblwer4ziXvcQt0HlCxSonmCthS0Ki052MTtcAmEdjkwt="; startswith; fast_pattern; http.host; content:"maps-locate-isupport.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006495; classtype:social-engineering; sid:6006495; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dataaaaaa223.agency-manager-support.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dataaaaaa223.agency-manager-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006496; classtype:social-engineering; sid:6006496; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (encontrar-mapsslf.us/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"encontrar-mapsslf.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006497; classtype:social-engineering; sid:6006497; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.iphone-lostdevice.help/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"mail.iphone-lostdevice.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006498; classtype:social-engineering; sid:6006498; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.id-myphone.us/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"mail.id-myphone.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006499; classtype:social-engineering; sid:6006499; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tokenpockft.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tokenpockft.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006500; classtype:social-engineering; sid:6006500; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tokenpocklt.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tokenpocklt.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006501; classtype:social-engineering; sid:6006501; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.acur.me/l/jRoHD)"; flow:established,to_server; http.uri; content:"/l/jRoHD"; startswith; fast_pattern; http.host; content:"www.acur.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006502; classtype:social-engineering; sid:6006502; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lcloud-flnd.my/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"lcloud-flnd.my"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006503; classtype:social-engineering; sid:6006503; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (duttaprithviraj2007-debug.github.io/Netflix-clone)"; flow:established,to_server; http.uri; content:"/Netflix-clone"; startswith; fast_pattern; http.host; content:"duttaprithviraj2007-debug.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006504; classtype:social-engineering; sid:6006504; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (col-sopportcloud.top/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"col-sopportcloud.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006505; classtype:social-engineering; sid:6006505; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pemulihan-dana.idco.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pemulihan-dana.idco.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006506; classtype:social-engineering; sid:6006506; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.device-ilocate.us/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"mail.device-ilocate.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006507; classtype:social-engineering; sid:6006507; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (locations-phone-ios.us/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"locations-phone-ios.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006508; classtype:social-engineering; sid:6006508; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myphone-locate.us/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"myphone-locate.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006509; classtype:social-engineering; sid:6006509; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqtmplx.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.rqtmplx.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006510; classtype:social-engineering; sid:6006510; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (justcall.mystagingwebsite.com/wp-content/plugins/adourbhanis/public/index.php)"; flow:established,to_server; http.uri; content:"/wp-content/plugins/adourbhanis/public/index.php"; startswith; fast_pattern; http.host; content:"justcall.mystagingwebsite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006511; classtype:social-engineering; sid:6006511; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fy-apple-isupport.com/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"fy-apple-isupport.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006512; classtype:social-engineering; sid:6006512; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ubicacionsatelital.help/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"ubicacionsatelital.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006513; classtype:social-engineering; sid:6006513; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xinzuqiuzhibohuifang.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xinzuqiuzhibohuifang.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006514; classtype:social-engineering; sid:6006514; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gwgf-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gwgf-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006515; classtype:social-engineering; sid:6006515; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lcloudslocations.sbs/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"lcloudslocations.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006516; classtype:social-engineering; sid:6006516; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instalacionesjm.com.mx/0/)"; flow:established,to_server; http.uri; content:"/0/"; startswith; fast_pattern; http.host; content:"instalacionesjm.com.mx"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006517; classtype:social-engineering; sid:6006517; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lrzzx.hekkohaknu.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lrzzx.hekkohaknu.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006518; classtype:social-engineering; sid:6006518; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.onebuyone.xyz/challenge?return=%2Fsurvey)"; flow:established,to_server; http.uri; content:"/challenge?return=%2Fsurvey"; startswith; fast_pattern; http.host; content:"www.onebuyone.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006519; classtype:social-engineering; sid:6006519; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suppurt-icloudpq4.us/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"suppurt-icloudpq4.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006520; classtype:social-engineering; sid:6006520; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365okvip8.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"365okvip8.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006521; classtype:social-engineering; sid:6006521; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e12oo-06e1-36ru-eda-4gl85.netlify.app/welcome_aboard)"; flow:established,to_server; http.uri; content:"/welcome_aboard"; startswith; fast_pattern; http.host; content:"e12oo-06e1-36ru-eda-4gl85.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006522; classtype:social-engineering; sid:6006522; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (idevicelocate.us/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"idevicelocate.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006523; classtype:social-engineering; sid:6006523; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.lcloud-flnd.my/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"mail.lcloud-flnd.my"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006524; classtype:social-engineering; sid:6006524; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.ilocate-devices.us/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"mail.ilocate-devices.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006525; classtype:social-engineering; sid:6006525; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blessed-successes-826688.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"blessed-successes-826688.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006526; classtype:social-engineering; sid:6006526; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robiox.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"robiox.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006527; classtype:social-engineering; sid:6006527; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mydevice-find.us/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"mydevice-find.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006528; classtype:social-engineering; sid:6006528; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myfindsupported.com/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"myfindsupported.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006529; classtype:social-engineering; sid:6006529; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iapple-recover.com/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"iapple-recover.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006530; classtype:social-engineering; sid:6006530; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.mydevice-find.us/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"mail.mydevice-find.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006531; classtype:social-engineering; sid:6006531; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imtoknk.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"imtoknk.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006532; classtype:social-engineering; sid:6006532; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.ideviceslocate.us/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"mail.ideviceslocate.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006533; classtype:social-engineering; sid:6006533; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.yb-sports.games/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.yb-sports.games"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006534; classtype:social-engineering; sid:6006534; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bjtanzhesi.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bjtanzhesi.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006535; classtype:social-engineering; sid:6006535; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verificar-email-enter.iceiy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"verificar-email-enter.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006536; classtype:social-engineering; sid:6006536; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-teal-three.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-teal-three.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006537; classtype:social-engineering; sid:6006537; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.flnds-myaccountds.sbs/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"mail.flnds-myaccountds.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006538; classtype:social-engineering; sid:6006538; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.ifind-myphone.us/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"mail.ifind-myphone.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006539; classtype:social-engineering; sid:6006539; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yeroiu.site/pon1/)"; flow:established,to_server; http.uri; content:"/pon1/"; startswith; fast_pattern; http.host; content:"yeroiu.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006540; classtype:social-engineering; sid:6006540; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (claim-saldo-gratis.idco.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"claim-saldo-gratis.idco.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006541; classtype:social-engineering; sid:6006541; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jtj-qq.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jtj-qq.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006542; classtype:social-engineering; sid:6006542; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accesmyaccount.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"accesmyaccount.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006543; classtype:social-engineering; sid:6006543; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imtoknc.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"imtoknc.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006544; classtype:social-engineering; sid:6006544; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (autodwc.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"autodwc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006545; classtype:social-engineering; sid:6006545; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usc1.contabostorage.com/838791fe69554831b3324947c035cbca:over/all-domain-fixed.html?email=valix2@20d05fddb0376eb6258cd38d4cffb82b4c28.net)"; flow:established,to_server; http.uri; content:"/838791fe69554831b3324947c035cbca:over/all-domain-fixed.html?email=valix2@20d05fddb0376eb6258cd38d4cffb82b4c28.net"; startswith; fast_pattern; http.host; content:"usc1.contabostorage.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006546; classtype:social-engineering; sid:6006546; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smartnetprotocols.web.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"smartnetprotocols.web.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006547; classtype:social-engineering; sid:6006547; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (findmyideviced.sbs/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"findmyideviced.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006548; classtype:social-engineering; sid:6006548; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.suppurt-icloudpq4.us/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"mail.suppurt-icloudpq4.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006549; classtype:social-engineering; sid:6006549; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.ubicacionsatelital.help/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"mail.ubicacionsatelital.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006550; classtype:social-engineering; sid:6006550; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ifindphone.us/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"ifindphone.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006551; classtype:social-engineering; sid:6006551; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (upholdcustomerservice.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"upholdcustomerservice.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006552; classtype:social-engineering; sid:6006552; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apleid-login.us/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"apleid-login.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006553; classtype:social-engineering; sid:6006553; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login---uphid-sso.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"login---uphid-sso.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006554; classtype:social-engineering; sid:6006554; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (y22k.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"y22k.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006555; classtype:social-engineering; sid:6006555; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www7find-myiphone.us/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"www7find-myiphone.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006556; classtype:social-engineering; sid:6006556; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (l-cloud.cam/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"l-cloud.cam"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006557; classtype:social-engineering; sid:6006557; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth---uphold-cdn-login.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auth---uphold-cdn-login.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006558; classtype:social-engineering; sid:6006558; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (now.vieclamonline-shop-pee.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"now.vieclamonline-shop-pee.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006559; classtype:social-engineering; sid:6006559; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-clone-eta.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-clone-eta.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006560; classtype:social-engineering; sid:6006560; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fesco-training.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fesco-training.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006561; classtype:social-engineering; sid:6006561; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (queenscalls.com/laps/korea.html)"; flow:established,to_server; http.uri; content:"/laps/korea.html"; startswith; fast_pattern; http.host; content:"queenscalls.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006562; classtype:social-engineering; sid:6006562; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (findphonecloud.life/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"findphonecloud.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006563; classtype:social-engineering; sid:6006563; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.ifind-mydevices.us/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"mail.ifind-mydevices.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006564; classtype:social-engineering; sid:6006564; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.insta-clone-app.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.insta-clone-app.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006565; classtype:social-engineering; sid:6006565; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.col-sopportcloud.top/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"mail.col-sopportcloud.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006566; classtype:social-engineering; sid:6006566; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (find-myphonee.top/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"find-myphonee.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006567; classtype:social-engineering; sid:6006567; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.myfindsupport.com/ICL266)"; flow:established,to_server; http.uri; content:"/ICL266"; startswith; fast_pattern; http.host; content:"mail.myfindsupport.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006568; classtype:social-engineering; sid:6006568; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-replica.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-replica.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006569; classtype:social-engineering; sid:6006569; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (isvaklhoti.cam/px)"; flow:established,to_server; http.uri; content:"/px"; startswith; fast_pattern; http.host; content:"isvaklhoti.cam"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006570; classtype:social-engineering; sid:6006570; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.oferta03946850.lat/oferta/kukirin-g4-dpbl6jdu)"; flow:established,to_server; http.uri; content:"/oferta/kukirin-g4-dpbl6jdu"; startswith; fast_pattern; http.host; content:"allegrolokalnie.oferta03946850.lat"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006571; classtype:social-engineering; sid:6006571; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klelnanzeigen-deutch.gain399.live/receive/order/eR9qeC1dbL-?r=0x3&__cf_chl_rt_tk=htTZHVODnyzwSyMfASpTjK_WmfVP.jmEMJLmC9ATtFE-1779618481-1.0.1.1-R068VS85oekEyG8u8rqiwK9G.JRg5NGCKMg7eA3MQX4)"; flow:established,to_server; http.uri; content:"/receive/order/eR9qeC1dbL-?r=0x3&__cf_chl_rt_tk=htTZHVODnyzwSyMfASpTjK_WmfVP.jmEMJLmC9ATtFE-1779618481-1.0.1.1-R068VS85oekEyG8u8rqiwK9G.JRg5NGCKMg7eA3MQX4"; startswith; fast_pattern; http.host; content:"klelnanzeigen-deutch.gain399.live"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006572; classtype:social-engineering; sid:6006572; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aloufa.jpod5714521.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aloufa.jpod5714521.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006573; classtype:social-engineering; sid:6006573; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.jpod844255.pro/captcha.php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"www.jpod844255.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006574; classtype:social-engineering; sid:6006574; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (melanchier.jpod844255.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"melanchier.jpod844255.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006575; classtype:social-engineering; sid:6006575; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.maogancj.cn/home)"; flow:established,to_server; http.uri; content:"/home"; startswith; fast_pattern; http.host; content:"www.maogancj.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006576; classtype:social-engineering; sid:6006576; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.370923.cfd/oferta/Bagaznik-rowerowy-Thule-EuroWay-920)"; flow:established,to_server; http.uri; content:"/oferta/Bagaznik-rowerowy-Thule-EuroWay-920"; startswith; fast_pattern; http.host; content:"allegrolokalnie.370923.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006577; classtype:social-engineering; sid:6006577; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox.com.ug/games/606849621/Jailbreak?privateServerLinkCode=94530839785389640896361655211502)"; flow:established,to_server; http.uri; content:"/games/606849621/Jailbreak?privateServerLinkCode=94530839785389640896361655211502"; startswith; fast_pattern; http.host; content:"roblox.com.ug"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006578; classtype:social-engineering; sid:6006578; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (micosroft.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"micosroft.framer.website"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006579; classtype:social-engineering; sid:6006579; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (frizet.info-9710614.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"frizet.info-9710614.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006580; classtype:social-engineering; sid:6006580; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (irostech.com/wp-content/secur/serafi/page/index.php)"; flow:established,to_server; http.uri; content:"/wp-content/secur/serafi/page/index.php"; startswith; fast_pattern; http.host; content:"irostech.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006581; classtype:social-engineering; sid:6006581; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (everwisecualertlnkweb.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"everwisecualertlnkweb.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006582; classtype:social-engineering; sid:6006582; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.58176.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalnie.58176.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006583; classtype:social-engineering; sid:6006583; rev:1; metadata: signature_severity Major, created_et 2026_05_24, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (online-lrmcsv.top/?secure_connect=fo9*fc*&_subid=k63n9.68.vnqu&_token=r5ub332mafi4h.1779641080.11.9371b570ca990440c06d64b7e260dfb3)"; flow:established,to_server; http.uri; content:"/?secure_connect=fo9*fc*&_subid=k63n9.68.vnqu&_token=r5ub332mafi4h.1779641080.11.9371b570ca990440c06d64b7e260dfb3"; startswith; fast_pattern; http.host; content:"online-lrmcsv.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006584; classtype:social-engineering; sid:6006584; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (llsterlnllbomk-online.top/?secure_connect=241*fc*&_subid=395mvce.21.vrnc&_token=1aumof91cbq1ej.1779724645.1.d216a94627341fc468b4915b18f1f367)"; flow:established,to_server; http.uri; content:"/?secure_connect=241*fc*&_subid=395mvce.21.vrnc&_token=1aumof91cbq1ej.1779724645.1.d216a94627341fc468b4915b18f1f367"; startswith; fast_pattern; http.host; content:"llsterlnllbomk-online.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006585; classtype:social-engineering; sid:6006585; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.support-clientpalservice.com/pages/ban.php)"; flow:established,to_server; http.uri; content:"/pages/ban.php"; startswith; fast_pattern; http.host; content:"www.support-clientpalservice.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006586; classtype:social-engineering; sid:6006586; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mycreditqueen.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mycreditqueen.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006587; classtype:social-engineering; sid:6006587; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alabarnasv.top/?secure_connect=u111*fc*&_subid=3pl30i4.57.vo3r&_token=iokgk71212mma.1779712545.3.2617f1b989f303814b2c00c76136b956)"; flow:established,to_server; http.uri; content:"/?secure_connect=u111*fc*&_subid=3pl30i4.57.vo3r&_token=iokgk71212mma.1779712545.3.2617f1b989f303814b2c00c76136b956"; startswith; fast_pattern; http.host; content:"alabarnasv.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006588; classtype:social-engineering; sid:6006588; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (llsterlnllbomk-online.top/?secure_connect=241*fc*&_subid=3q14sv1.21.vrnd&_token=3pc20jq20gf4ip.1779724647.1.9db3b9884835b43318a9b3af3cf54903)"; flow:established,to_server; http.uri; content:"/?secure_connect=241*fc*&_subid=3q14sv1.21.vrnd&_token=3pc20jq20gf4ip.1779724647.1.9db3b9884835b43318a9b3af3cf54903"; startswith; fast_pattern; http.host; content:"llsterlnllbomk-online.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006589; classtype:social-engineering; sid:6006589; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.roblox.com/request-error?code=404)"; flow:established,to_server; http.uri; content:"/request-error?code=404"; startswith; fast_pattern; http.host; content:"www.roblox.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006590; classtype:social-engineering; sid:6006590; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezor-io-start-uss.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezor-io-start-uss.zapier.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006591; classtype:social-engineering; sid:6006591; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (llsterlnllbomk-online.top/?secure_connect=241*fc*&_subid=2n6ie56.21.vrnb&_token=20qppmq1dhgicq.1779724644.1.2b66a82765fe3cf488ea534ace23fb8e)"; flow:established,to_server; http.uri; content:"/?secure_connect=241*fc*&_subid=2n6ie56.21.vrnb&_token=20qppmq1dhgicq.1779724644.1.2b66a82765fe3cf488ea534ace23fb8e"; startswith; fast_pattern; http.host; content:"llsterlnllbomk-online.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006592; classtype:social-engineering; sid:6006592; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (digital-agency.busines-help-center.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"digital-agency.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006593; classtype:social-engineering; sid:6006593; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.czplqw.ink/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.czplqw.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006594; classtype:social-engineering; sid:6006594; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (voicedatacenterrecice-address-desktopam-a150.widivag676.workers.dev/Voicemailacess-document-authorization-m365-sector-ag265KgYspNAcotT6okDqqCDrMgSSilZ/h2d4535fCWWE0u6EWkEmxpTzhMgfxreMoI786J4q/)"; flow:established,to_server; http.uri; content:"/Voicemailacess-document-authorization-m365-sector-ag265KgYspNAcotT6okDqqCDrMgSSilZ/h2d4535fCWWE0u6EWkEmxpTzhMgfxreMoI786J4q/"; startswith; fast_pattern; http.host; content:"voicedatacenterrecice-address-desktopam-a150.widivag676.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006595; classtype:social-engineering; sid:6006595; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (id65234.agency-manager-support.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"id65234.agency-manager-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006596; classtype:social-engineering; sid:6006596; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aqw-hgvcx.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aqw-hgvcx.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006597; classtype:social-engineering; sid:6006597; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wil.keki.workers.dev/Instag?chatId=8791290357)"; flow:established,to_server; http.uri; content:"/Instag?chatId=8791290357"; startswith; fast_pattern; http.host; content:"wil.keki.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006598; classtype:social-engineering; sid:6006598; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (splendid-apricot-964690.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"splendid-apricot-964690.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006599; classtype:social-engineering; sid:6006599; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adorable-dragon-135154.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"adorable-dragon-135154.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006600; classtype:social-engineering; sid:6006600; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.redpeppe.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.redpeppe.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006601; classtype:social-engineering; sid:6006601; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.teams-cv.com/p/fjbd-cbch/vepitxco/)"; flow:established,to_server; http.uri; content:"/p/fjbd-cbch/vepitxco/"; startswith; fast_pattern; http.host; content:"s.teams-cv.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006602; classtype:social-engineering; sid:6006602; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5o4n3-18zi-kk1-i4t-ih3k-i2ee1i.netlify.app/send_appeal_request/)"; flow:established,to_server; http.uri; content:"/send_appeal_request/"; startswith; fast_pattern; http.host; content:"5o4n3-18zi-kk1-i4t-ih3k-i2ee1i.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006603; classtype:social-engineering; sid:6006603; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (znlyanind-paylterxn.tiaoxsid.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"znlyanind-paylterxn.tiaoxsid.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006604; classtype:social-engineering; sid:6006604; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezorr--appgoup.gitbook.io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"trezorr--appgoup.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006605; classtype:social-engineering; sid:6006605; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezorr--appgoup.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezorr--appgoup.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006606; classtype:social-engineering; sid:6006606; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j3656vip.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"j3656vip.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006607; classtype:social-engineering; sid:6006607; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.inforesmi11.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.inforesmi11.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006608; classtype:social-engineering; sid:6006608; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.zqvnlprkb.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.zqvnlprkb.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006609; classtype:social-engineering; sid:6006609; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.renewy.cfd/co.uk/)"; flow:established,to_server; http.uri; content:"/co.uk/"; startswith; fast_pattern; http.host; content:"dpd.renewy.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006610; classtype:social-engineering; sid:6006610; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fh-in.games/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fh-in.games"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006611; classtype:social-engineering; sid:6006611; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pt-shopee110.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"pt-shopee110.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006612; classtype:social-engineering; sid:6006612; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (royal-sun-86e8.martinezmary87716.workers.dev/meta-support-center/)"; flow:established,to_server; http.uri; content:"/meta-support-center/"; startswith; fast_pattern; http.host; content:"royal-sun-86e8.martinezmary87716.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006613; classtype:social-engineering; sid:6006613; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metaimsklogn.gitbook.io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"metaimsklogn.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006614; classtype:social-engineering; sid:6006614; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hasyimf.github.io/login-instagram/)"; flow:established,to_server; http.uri; content:"/login-instagram/"; startswith; fast_pattern; http.host; content:"hasyimf.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006615; classtype:social-engineering; sid:6006615; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (voicedatacenterrecice-address-desktopam-a150.widivag676.workers.dev/Voicemailacess-document-authorization-m365-sector-VwygvFZUgimQMhZsIjVHbqUnHl5jRlQL/sLRVjTfcJw4ed3BbgU0ydDKgpQAjmDUccIdKNduV/)"; flow:established,to_server; http.uri; content:"/Voicemailacess-document-authorization-m365-sector-VwygvFZUgimQMhZsIjVHbqUnHl5jRlQL/sLRVjTfcJw4ed3BbgU0ydDKgpQAjmDUccIdKNduV/"; startswith; fast_pattern; http.host; content:"voicedatacenterrecice-address-desktopam-a150.widivag676.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006616; classtype:social-engineering; sid:6006616; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (talk-messenger.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"talk-messenger.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006617; classtype:social-engineering; sid:6006617; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (messenger-clone-gamma-two.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"messenger-clone-gamma-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006618; classtype:social-engineering; sid:6006618; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortnite-crew.pro/id/login)"; flow:established,to_server; http.uri; content:"/id/login"; startswith; fast_pattern; http.host; content:"fortnite-crew.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006619; classtype:social-engineering; sid:6006619; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (voicedatacenterrecice-address-desktopam-a150.widivag676.workers.dev/Voicemailacess-document-authorization-m365-sector-67GYkUPYVQKW72qc3xMqSEVxTV7sv929/YQbGtTGPjGfYysSQE30qwA6SJThjAfgBhc1ahb0E/)"; flow:established,to_server; http.uri; content:"/Voicemailacess-document-authorization-m365-sector-67GYkUPYVQKW72qc3xMqSEVxTV7sv929/YQbGtTGPjGfYysSQE30qwA6SJThjAfgBhc1ahb0E/"; startswith; fast_pattern; http.host; content:"voicedatacenterrecice-address-desktopam-a150.widivag676.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006620; classtype:social-engineering; sid:6006620; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (y26u.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"y26u.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006621; classtype:social-engineering; sid:6006621; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.plan-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.plan-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006622; classtype:social-engineering; sid:6006622; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vip36560.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"vip36560.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006623; classtype:social-engineering; sid:6006623; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (x3656vip.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"x3656vip.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006624; classtype:social-engineering; sid:6006624; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (department7669-design.github.io/document)"; flow:established,to_server; http.uri; content:"/document"; startswith; fast_pattern; http.host; content:"department7669-design.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006625; classtype:social-engineering; sid:6006625; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (broader-studies-147078.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"broader-studies-147078.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006626; classtype:social-engineering; sid:6006626; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-rust-ten.vercel.app/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"netflix-clone-rust-ten.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006627; classtype:social-engineering; sid:6006627; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (airbnb-clone-beta-five.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"airbnb-clone-beta-five.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006628; classtype:social-engineering; sid:6006628; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pixnai.com/uiubt/)"; flow:established,to_server; http.uri; content:"/uiubt/"; startswith; fast_pattern; http.host; content:"pixnai.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006629; classtype:social-engineering; sid:6006629; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ayanattaarbab.github.io/netflix-ui/)"; flow:established,to_server; http.uri; content:"/netflix-ui/"; startswith; fast_pattern; http.host; content:"ayanattaarbab.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006630; classtype:social-engineering; sid:6006630; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (program-shopee49.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"program-shopee49.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006631; classtype:social-engineering; sid:6006631; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.robloxt.cv/charts)"; flow:established,to_server; http.uri; content:"/charts"; startswith; fast_pattern; http.host; content:"www.robloxt.cv"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006632; classtype:social-engineering; sid:6006632; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (voicedatacenterrecice-address-desktopam-a150.widivag676.workers.dev/Voicemailacess-document-authorization-m365-sector-60oj868WlQ5Mf31GxuP1y3F9nVsqcPPz/ot12lP5sYCFoAjYugdXu762apHlvKmUhtlRjZ0Qb/)"; flow:established,to_server; http.uri; content:"/Voicemailacess-document-authorization-m365-sector-60oj868WlQ5Mf31GxuP1y3F9nVsqcPPz/ot12lP5sYCFoAjYugdXu762apHlvKmUhtlRjZ0Qb/"; startswith; fast_pattern; http.host; content:"voicedatacenterrecice-address-desktopam-a150.widivag676.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006633; classtype:social-engineering; sid:6006633; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j67c.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j67c.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006634; classtype:social-engineering; sid:6006634; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kucoisauths.gitbook.io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"kucoisauths.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006635; classtype:social-engineering; sid:6006635; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pt-shopee110.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pt-shopee110.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006636; classtype:social-engineering; sid:6006636; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (voicedatacenterrecice-address-desktopam-a150.widivag676.workers.dev/Voicemailacess-document-authorization-m365-sector-FGSHk56hMWRHcme4kZ4Si67dCTcsWQCQ/wHk481s3mNgUTtcEu9VywBUX89RIuRxpTG5sORCJ/)"; flow:established,to_server; http.uri; content:"/Voicemailacess-document-authorization-m365-sector-FGSHk56hMWRHcme4kZ4Si67dCTcsWQCQ/wHk481s3mNgUTtcEu9VywBUX89RIuRxpTG5sORCJ/"; startswith; fast_pattern; http.host; content:"voicedatacenterrecice-address-desktopam-a150.widivag676.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006637; classtype:social-engineering; sid:6006637; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store.communitydesingapp.shop/workshop/AK47-EternalDecay/)"; flow:established,to_server; http.uri; content:"/workshop/AK47-EternalDecay/"; startswith; fast_pattern; http.host; content:"store.communitydesingapp.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006638; classtype:social-engineering; sid:6006638; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tznvlkqpr.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.tznvlkqpr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006639; classtype:social-engineering; sid:6006639; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortrating.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortrating.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006640; classtype:social-engineering; sid:6006640; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365okvip9.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"365okvip9.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006641; classtype:social-engineering; sid:6006641; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-rust-ten.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-rust-ten.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006642; classtype:social-engineering; sid:6006642; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiifkanpaylaaterz.resmi-yaa3.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiifkanpaylaaterz.resmi-yaa3.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006643; classtype:social-engineering; sid:6006643; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.airbnb-clone-beta-five.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.airbnb-clone-beta-five.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006644; classtype:social-engineering; sid:6006644; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.eiusky.buzz/track-it/)"; flow:established,to_server; http.uri; content:"/track-it/"; startswith; fast_pattern; http.host; content:"brt.eiusky.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006645; classtype:social-engineering; sid:6006645; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kjwertyuiopcvbnm-u3qrobqifp.edgeone.dev/korea.html)"; flow:established,to_server; http.uri; content:"/korea.html"; startswith; fast_pattern; http.host; content:"kjwertyuiopcvbnm-u3qrobqifp.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006646; classtype:social-engineering; sid:6006646; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-auth-uphold-eng.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sso-auth-uphold-eng.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006647; classtype:social-engineering; sid:6006647; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (drcbuilt.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"drcbuilt.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006648; classtype:social-engineering; sid:6006648; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (quiet-challenge-690227.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"quiet-challenge-690227.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006649; classtype:social-engineering; sid:6006649; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (messenger-one-eta.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"messenger-one-eta.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006650; classtype:social-engineering; sid:6006650; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iccinscc1.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"iccinscc1.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006651; classtype:social-engineering; sid:6006651; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amz-web.52ritao.cn/-/en/gp/help/customer/display.html?nodeId=G201485660)"; flow:established,to_server; http.uri; content:"/-/en/gp/help/customer/display.html?nodeId=G201485660"; startswith; fast_pattern; http.host; content:"amz-web.52ritao.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006652; classtype:social-engineering; sid:6006652; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.crytwaultnovar.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.crytwaultnovar.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006653; classtype:social-engineering; sid:6006653; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.q63f.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.q63f.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006654; classtype:social-engineering; sid:6006654; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rdyhgd.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rdyhgd.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006655; classtype:social-engineering; sid:6006655; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support-manager.busines-help-center.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"support-manager.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006656; classtype:social-engineering; sid:6006656; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suggesting.info/PL-1466-160526/email@example.com)"; flow:established,to_server; http.uri; content:"/PL-1466-160526/email@example.com"; startswith; fast_pattern; http.host; content:"suggesting.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006657; classtype:social-engineering; sid:6006657; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.j65s.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.j65s.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006658; classtype:social-engineering; sid:6006658; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (messenger-clone-eltahawy.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"messenger-clone-eltahawy.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006659; classtype:social-engineering; sid:6006659; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.nymh.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.nymh.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006660; classtype:social-engineering; sid:6006660; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktifkan-fitur-danaxpay.susm.my.id/Danaweb/)"; flow:established,to_server; http.uri; content:"/Danaweb/"; startswith; fast_pattern; http.host; content:"aktifkan-fitur-danaxpay.susm.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006661; classtype:social-engineering; sid:6006661; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreibfgs3ja2tfyrozjrdkoqaktezyutqo7dr5hqq44ygase4t5y57eu.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreibfgs3ja2tfyrozjrdkoqaktezyutqo7dr5hqq44ygase4t5y57eu.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006662; classtype:social-engineering; sid:6006662; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortbundle.lol/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortbundle.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006663; classtype:social-engineering; sid:6006663; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-start-kraken.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app-start-kraken.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006664; classtype:social-engineering; sid:6006664; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aspotify.qpon/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aspotify.qpon"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006665; classtype:social-engineering; sid:6006665; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (messenger-clone-delta-two.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"messenger-clone-delta-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006666; classtype:social-engineering; sid:6006666; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365ok08.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"365ok08.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006667; classtype:social-engineering; sid:6006667; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (durveshkadav.github.io/Netflix-Clone)"; flow:established,to_server; http.uri; content:"/Netflix-Clone"; startswith; fast_pattern; http.host; content:"durveshkadav.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006668; classtype:social-engineering; sid:6006668; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox.iconce.com/RealProfile)"; flow:established,to_server; http.uri; content:"/RealProfile"; startswith; fast_pattern; http.host; content:"roblox.iconce.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006669; classtype:social-engineering; sid:6006669; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cepuaustralia.com/dasjsukuksdabn)"; flow:established,to_server; http.uri; content:"/dasjsukuksdabn"; startswith; fast_pattern; http.host; content:"cepuaustralia.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006670; classtype:social-engineering; sid:6006670; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (voicedatacenterrecice-address-desktopam-a150.widivag676.workers.dev/Voicemailacess-document-authorization-m365-sector-LJr3gzL43IRobzfjOrhIhlsTQrp5wZ2U/i9u8yfuHoM6Gykl01qlMYB9O308mb7HipyRZquBc/)"; flow:established,to_server; http.uri; content:"/Voicemailacess-document-authorization-m365-sector-LJr3gzL43IRobzfjOrhIhlsTQrp5wZ2U/i9u8yfuHoM6Gykl01qlMYB9O308mb7HipyRZquBc/"; startswith; fast_pattern; http.host; content:"voicedatacenterrecice-address-desktopam-a150.widivag676.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006671; classtype:social-engineering; sid:6006671; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.shipdora.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.shipdora.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006672; classtype:social-engineering; sid:6006672; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vip3656i.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"vip3656i.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006673; classtype:social-engineering; sid:6006673; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b28i.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b28i.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006674; classtype:social-engineering; sid:6006674; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kucoisauths.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kucoisauths.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006675; classtype:social-engineering; sid:6006675; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (naturokare.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"naturokare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006676; classtype:social-engineering; sid:6006676; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (raman-2r.github.io/Amazon-Clone-/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone-/"; startswith; fast_pattern; http.host; content:"raman-2r.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006677; classtype:social-engineering; sid:6006677; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16137.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16137.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006678; classtype:social-engineering; sid:6006678; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (97ee9.catex.at/cnbcard/)"; flow:established,to_server; http.uri; content:"/cnbcard/"; startswith; fast_pattern; http.host; content:"97ee9.catex.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006679; classtype:social-engineering; sid:6006679; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (syedhassan31545.github.io/Amazon)"; flow:established,to_server; http.uri; content:"/Amazon"; startswith; fast_pattern; http.host; content:"syedhassan31545.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006680; classtype:social-engineering; sid:6006680; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-pemenangsupershoping99.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.info-pemenangsupershoping99.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006681; classtype:social-engineering; sid:6006681; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bdointegral.cc/ph)"; flow:established,to_server; http.uri; content:"/ph"; startswith; fast_pattern; http.host; content:"bdointegral.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006682; classtype:social-engineering; sid:6006682; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-uphold-io.created.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-uphold-io.created.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006683; classtype:social-engineering; sid:6006683; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.program-resmi763.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.program-resmi763.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006684; classtype:social-engineering; sid:6006684; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shaw-onlines1477.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shaw-onlines1477.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006685; classtype:social-engineering; sid:6006685; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (notivenunmain.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"notivenunmain.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006686; classtype:social-engineering; sid:6006686; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.helpdmswkrhdesk.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.helpdmswkrhdesk.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006687; classtype:social-engineering; sid:6006687; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (silk-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"silk-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006688; classtype:social-engineering; sid:6006688; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fvypec.top/pay/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.fvypec.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006689; classtype:social-engineering; sid:6006689; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (el.gaiafitt.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"el.gaiafitt.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006690; classtype:social-engineering; sid:6006690; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kuucoinxlogin.gitbook.io/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"kuucoinxlogin.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006691; classtype:social-engineering; sid:6006691; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-pemenangsupershoping99.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"info-pemenangsupershoping99.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006692; classtype:social-engineering; sid:6006692; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (saviobrodz.github.io/NetflixRom/)"; flow:established,to_server; http.uri; content:"/NetflixRom/"; startswith; fast_pattern; http.host; content:"saviobrodz.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006693; classtype:social-engineering; sid:6006693; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (decisive-learning-046079.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"decisive-learning-046079.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006694; classtype:social-engineering; sid:6006694; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16159.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16159.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006695; classtype:social-engineering; sid:6006695; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (arhumkham-295.github.io/smit-assignment-Amazon-Clone)"; flow:established,to_server; http.uri; content:"/smit-assignment-Amazon-Clone"; startswith; fast_pattern; http.host; content:"arhumkham-295.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006696; classtype:social-engineering; sid:6006696; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (memetamsksignn.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"memetamsksignn.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006697; classtype:social-engineering; sid:6006697; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bet365k13.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bet365k13.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006698; classtype:social-engineering; sid:6006698; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xtfi231.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xtfi231.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006699; classtype:social-engineering; sid:6006699; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.lasalleunipa.ucoz.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.lasalleunipa.ucoz.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006700; classtype:social-engineering; sid:6006700; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gleeful-kitsune-cd3127.netlify.app/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"gleeful-kitsune-cd3127.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006701; classtype:social-engineering; sid:6006701; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (voicedatacenterrecice-address-desktopam-a150.widivag676.workers.dev/Voicemailacess-document-authorization-m365-sector-PVXkkU0ywwdZIixh7Ax94WZXDPewtUI9/mMVU1eV1Yp9wazJXXncexwLRRM6WYdMgldMKd85s/)"; flow:established,to_server; http.uri; content:"/Voicemailacess-document-authorization-m365-sector-PVXkkU0ywwdZIixh7Ax94WZXDPewtUI9/mMVU1eV1Yp9wazJXXncexwLRRM6WYdMgldMKd85s/"; startswith; fast_pattern; http.host; content:"voicedatacenterrecice-address-desktopam-a150.widivag676.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006702; classtype:social-engineering; sid:6006702; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (voicedatacenterrecice-address-desktopam-a150.widivag676.workers.dev/Voicemailacess-document-authorization-m365-sector-vYneU1JnLg7Z7V4rG5gXkZr9z35nZTGp/y0ghst5GYtjatBvht1qolFQI5rQrv3oKgVfOnVGJ/)"; flow:established,to_server; http.uri; content:"/Voicemailacess-document-authorization-m365-sector-vYneU1JnLg7Z7V4rG5gXkZr9z35nZTGp/y0ghst5GYtjatBvht1qolFQI5rQrv3oKgVfOnVGJ/"; startswith; fast_pattern; http.host; content:"voicedatacenterrecice-address-desktopam-a150.widivag676.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006703; classtype:social-engineering; sid:6006703; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.myfinity.douglasdhawk.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.myfinity.douglasdhawk.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006704; classtype:social-engineering; sid:6006704; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vrq-irdf.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vrq-irdf.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006705; classtype:social-engineering; sid:6006705; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suggesting.info/PL-1466-160526/[email%C2%A0protected])"; flow:established,to_server; http.uri; content:"/PL-1466-160526/[email%C2%A0protected]"; startswith; fast_pattern; http.host; content:"suggesting.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006706; classtype:social-engineering; sid:6006706; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-uphold-us.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-uphold-us.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006707; classtype:social-engineering; sid:6006707; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (round-voice-342b.jkiqnayabevkdnhtvrnhoct.workers.dev/meta.support.manager)"; flow:established,to_server; http.uri; content:"/meta.support.manager"; startswith; fast_pattern; http.host; content:"round-voice-342b.jkiqnayabevkdnhtvrnhoct.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006708; classtype:social-engineering; sid:6006708; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smart-uphild-logon.pineapple.page/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"smart-uphild-logon.pineapple.page"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006709; classtype:social-engineering; sid:6006709; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nishchalvpandit.github.io/streaming-ui-demo)"; flow:established,to_server; http.uri; content:"/streaming-ui-demo"; startswith; fast_pattern; http.host; content:"nishchalvpandit.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006710; classtype:social-engineering; sid:6006710; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (home.barccapital.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"home.barccapital.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006711; classtype:social-engineering; sid:6006711; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vip3656k.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"vip3656k.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006712; classtype:social-engineering; sid:6006712; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bwvqzj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bwvqzj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006713; classtype:social-engineering; sid:6006713; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (midasbuy-season.topup-mobiles.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"midasbuy-season.topup-mobiles.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006714; classtype:social-engineering; sid:6006714; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.liaisonvaluers.com/united_k/verify.html)"; flow:established,to_server; http.uri; content:"/united_k/verify.html"; startswith; fast_pattern; http.host; content:"www.liaisonvaluers.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006715; classtype:social-engineering; sid:6006715; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loggginnn-microsft365-online-comm-commmmon-oauths--vv-959706.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"loggginnn-microsft365-online-comm-commmmon-oauths--vv-959706.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006716; classtype:social-engineering; sid:6006716; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ing-help.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ing-help.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006717; classtype:social-engineering; sid:6006717; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.renewt.cfd/co.uk)"; flow:established,to_server; http.uri; content:"/co.uk"; startswith; fast_pattern; http.host; content:"dpd.renewt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006718; classtype:social-engineering; sid:6006718; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (square-resonance-2db3.makemolla1.workers.dev/7689811001/)"; flow:established,to_server; http.uri; content:"/7689811001/"; startswith; fast_pattern; http.host; content:"square-resonance-2db3.makemolla1.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006719; classtype:social-engineering; sid:6006719; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (voicedatacenterrecice-address-desktopam-a150.widivag676.workers.dev/Voicemailacess-document-authorization-m365-sector-pc6LuQSDLxsk0LePY0mGW7tu2KFUx6Qu/KvI7b8w3v708NMRGtzKuCt3hsfcG4UTB42JZO0RT/)"; flow:established,to_server; http.uri; content:"/Voicemailacess-document-authorization-m365-sector-pc6LuQSDLxsk0LePY0mGW7tu2KFUx6Qu/KvI7b8w3v708NMRGtzKuCt3hsfcG4UTB42JZO0RT/"; startswith; fast_pattern; http.host; content:"voicedatacenterrecice-address-desktopam-a150.widivag676.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006720; classtype:social-engineering; sid:6006720; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-inky.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-inky.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006721; classtype:social-engineering; sid:6006721; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hap-svfrw.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hap-svfrw.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006722; classtype:social-engineering; sid:6006722; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.wgmerchant.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.wgmerchant.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006723; classtype:social-engineering; sid:6006723; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (billrogerson.ihsanfidyah.com/antidisestablishmentarianism/portico/2HDU17xi5eZP/YM6dtHQakTYo2JW8/Y214WGVGWjNZblphZDNoc1dsRlNOVnAzVWpWV2RtcDJjVVpXTmxaNmRUQnhWVTl0UW5scWFVdFFPWFp1U210bWNIbzVZVTFMVjIxdk1qVnRURXBOZVhGVmVYaHZNa0Z0VEVwTmVVMVZWMk54ZWtob2IwcFhZMjh5VFRGTlNtdHRXWHBCYVc5SmFtbHdVWFY0V2xSeGQxcDRVM0JaYkZabVZtRkVka0ozVWpOQmJYaHRRVzFFYkVKSGVHWldZVloyUW5aV2FrSlJSRFZNZDFZeldsRlNNMDFSVERCQ1NsWnNUSHBCZWtGNlRYZGFVVVF4V25wRmVrRjZUR3RCZGxabVZtRmFka0oyVjBGTWVXTm1XbUZQZVVwMlZtWldZVXgyUW5aV2JGcFJWakpaZDFKMldWQlhkMVozWW5aR1NVOXNjVlZqYkVGSFNUQkJlRGxDVm1Fd1BRPT18fDZqSGRrbGxOSGNlUXhCV1pMdGhDS2FELUVldk9oMUt5MGd1Wnh0QzRsMUNTQzVSbWYyUUhrZTA2RktTYjNqQ0Y/GTcVluFT)"; flow:established,to_server; http.uri; content:"/antidisestablishmentarianism/portico/2HDU17xi5eZP/YM6dtHQakTYo2JW8/Y214WGVGWjNZblphZDNoc1dsRlNOVnAzVWpWV2RtcDJjVVpXTmxaNmRUQnhWVTl0UW5scWFVdFFPWFp1U210bWNIbzVZVTFMVjIxdk1qVnRURXBOZVhGVmVYaHZNa0Z0VEVwTmVVMVZWMk54ZWtob2IwcFhZMjh5VFRGTlNtdHRXWHBCYVc5SmFtbHdVWFY0V2xSeGQxcDRVM0JaYkZabVZtRkVka0ozVWpOQmJYaHRRVzFFYkVKSGVHWldZVloyUW5aV2FrSlJSRFZNZDFZeldsRlNNMDFSVERCQ1NsWnNUSHBCZWtGNlRYZGFVVVF4V25wRmVrRjZUR3RCZGxabVZtRmFka0oyVjBGTWVXTm1XbUZQZVVwMlZtWldZVXgyUW5aV2JGcFJWakpaZDFKMldWQlhkMVozWW5aR1NVOXNjVlZqYkVGSFNUQkJlRGxDVm1Fd1BRPT18fDZqSGRrbGxOSGNlUXhCV1pMdGhDS2FELUVldk9oMUt5MGd1Wnh0QzRsMUNTQzVSbWYyUUhrZTA2RktTYjNqQ0Y/GTcVluFT"; startswith; fast_pattern; http.host; content:"billrogerson.ihsanfidyah.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006724; classtype:social-engineering; sid:6006724; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi3125.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"info-resmi3125.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006725; classtype:social-engineering; sid:6006725; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vip3656x.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"vip3656x.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006726; classtype:social-engineering; sid:6006726; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (voicedatacenterrecice-address-desktopam-a150.widivag676.workers.dev/Voicemailacess-document-authorization-m365-sector-J3EFkhznAC15rrTXUu6VOdPevGqvjDJD/1ZdVtqTFU7K31MKIyIIypxY0ATeNdSnWnuUnzJ1j/)"; flow:established,to_server; http.uri; content:"/Voicemailacess-document-authorization-m365-sector-J3EFkhznAC15rrTXUu6VOdPevGqvjDJD/1ZdVtqTFU7K31MKIyIIypxY0ATeNdSnWnuUnzJ1j/"; startswith; fast_pattern; http.host; content:"voicedatacenterrecice-address-desktopam-a150.widivag676.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006727; classtype:social-engineering; sid:6006727; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.talk-messenger.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.talk-messenger.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006728; classtype:social-engineering; sid:6006728; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (helpdmswkrhdesk.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"helpdmswkrhdesk.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006729; classtype:social-engineering; sid:6006729; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lasalleunipa.ucoz.site/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"lasalleunipa.ucoz.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006730; classtype:social-engineering; sid:6006730; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.booking-clone-app.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.booking-clone-app.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006731; classtype:social-engineering; sid:6006731; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suggesting.info/PL-1466-160526/?u=162C1466&e=mirel@4009221a80cbcb56eb1151e9d9c0327ae7a9.net&s3=&s4=&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/PL-1466-160526/?u=162C1466&e=mirel@4009221a80cbcb56eb1151e9d9c0327ae7a9.net&s3=&s4=&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"suggesting.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006732; classtype:social-engineering; sid:6006732; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dnnaidpayllterxn.arsenion.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dnnaidpayllterxn.arsenion.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006733; classtype:social-engineering; sid:6006733; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kqnzwr.ink/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.kqnzwr.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006734; classtype:social-engineering; sid:6006734; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.gzqier.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.gzqier.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006735; classtype:social-engineering; sid:6006735; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.program-shopee49.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.program-shopee49.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006736; classtype:social-engineering; sid:6006736; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.renewt.cfd/co.uk/)"; flow:established,to_server; http.uri; content:"/co.uk/"; startswith; fast_pattern; http.host; content:"dpd.renewt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006737; classtype:social-engineering; sid:6006737; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.xwvfxz.help/track-it/)"; flow:established,to_server; http.uri; content:"/track-it/"; startswith; fast_pattern; http.host; content:"brt.xwvfxz.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006738; classtype:social-engineering; sid:6006738; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (khusi-gouda.github.io/Amazon-UI-clone)"; flow:established,to_server; http.uri; content:"/Amazon-UI-clone"; startswith; fast_pattern; http.host; content:"khusi-gouda.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006739; classtype:social-engineering; sid:6006739; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shaw-onlines1477.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shaw-onlines1477.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006740; classtype:social-engineering; sid:6006740; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pubgmcreatives.topup-mobiles.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pubgmcreatives.topup-mobiles.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006741; classtype:social-engineering; sid:6006741; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365asia.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"365asia.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006742; classtype:social-engineering; sid:6006742; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16133.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16133.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006743; classtype:social-engineering; sid:6006743; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.robloxt.cv/login?returlUrl=192245539)"; flow:established,to_server; http.uri; content:"/login?returlUrl=192245539"; startswith; fast_pattern; http.host; content:"www.robloxt.cv"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006744; classtype:social-engineering; sid:6006744; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a-atendimentobron.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a-atendimentobron.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006745; classtype:social-engineering; sid:6006745; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mauribel.com/billroger/)"; flow:established,to_server; http.uri; content:"/billroger/"; startswith; fast_pattern; http.host; content:"www.mauribel.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006746; classtype:social-engineering; sid:6006746; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (messenger-clone-zeta-three.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"messenger-clone-zeta-three.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006747; classtype:social-engineering; sid:6006747; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vip3656y.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"vip3656y.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006748; classtype:social-engineering; sid:6006748; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (justfort.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"justfort.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006749; classtype:social-engineering; sid:6006749; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezorhardwarwallet.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezorhardwarwallet.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006750; classtype:social-engineering; sid:6006750; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi3125.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi3125.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006751; classtype:social-engineering; sid:6006751; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (voicedatacenterrecice-address-desktopam-a150.widivag676.workers.dev/Voicemailacess-document-authorization-m365-sector-M2QPNyB6V9z98D1V3ovQyxbeOKMYfCq9/0nbbrggGwe4qPC66Qf8Q9SNTD2nJcH4VIcp50xnS/)"; flow:established,to_server; http.uri; content:"/Voicemailacess-document-authorization-m365-sector-M2QPNyB6V9z98D1V3ovQyxbeOKMYfCq9/0nbbrggGwe4qPC66Qf8Q9SNTD2nJcH4VIcp50xnS/"; startswith; fast_pattern; http.host; content:"voicedatacenterrecice-address-desktopam-a150.widivag676.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006752; classtype:social-engineering; sid:6006752; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sensational-popover-484895.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sensational-popover-484895.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006753; classtype:social-engineering; sid:6006753; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en-us-uphld-portal.created.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"en-us-uphld-portal.created.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006754; classtype:social-engineering; sid:6006754; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16093.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16093.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006755; classtype:social-engineering; sid:6006755; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.messenger-inky.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.messenger-inky.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006756; classtype:social-engineering; sid:6006756; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myfinity.douglasdhawk.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"myfinity.douglasdhawk.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006757; classtype:social-engineering; sid:6006757; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (voicedatacenterrecice-address-desktopam-a150.widivag676.workers.dev/Voicemailacess-document-authorization-m365-sector-lBI2H5Fdqj5jLD8OBHcilRpSn3ABKfPd/80ZxfRlPlhDP9Mfytz02bG9rdOj7E9jJ2D4kXCVG/)"; flow:established,to_server; http.uri; content:"/Voicemailacess-document-authorization-m365-sector-lBI2H5Fdqj5jLD8OBHcilRpSn3ABKfPd/80ZxfRlPlhDP9Mfytz02bG9rdOj7E9jJ2D4kXCVG/"; startswith; fast_pattern; http.host; content:"voicedatacenterrecice-address-desktopam-a150.widivag676.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006758; classtype:social-engineering; sid:6006758; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (seasonmid.putunesimbah.de/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"seasonmid.putunesimbah.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006759; classtype:social-engineering; sid:6006759; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inforesmi11.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"inforesmi11.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006760; classtype:social-engineering; sid:6006760; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.h111i.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.h111i.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006761; classtype:social-engineering; sid:6006761; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (signing-gpsmap.cc/app/webroot/script/login_2026)"; flow:established,to_server; http.uri; content:"/app/webroot/script/login_2026"; startswith; fast_pattern; http.host; content:"signing-gpsmap.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006762; classtype:social-engineering; sid:6006762; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (heavenlyhounds.info/PL-1466-160526/?u=81C1466&e=cemoi%40wp)"; flow:established,to_server; http.uri; content:"/PL-1466-160526/?u=81C1466&e=cemoi%40wp"; startswith; fast_pattern; http.host; content:"heavenlyhounds.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006763; classtype:social-engineering; sid:6006763; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.renewy.cfd/co.uk)"; flow:established,to_server; http.uri; content:"/co.uk"; startswith; fast_pattern; http.host; content:"dpd.renewy.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006764; classtype:social-engineering; sid:6006764; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kznwqpltr.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.kznwqpltr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006765; classtype:social-engineering; sid:6006765; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (messenger-clone-delta-eight.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"messenger-clone-delta-eight.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006766; classtype:social-engineering; sid:6006766; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (h19w.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"h19w.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006767; classtype:social-engineering; sid:6006767; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (messenger-inky.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"messenger-inky.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006768; classtype:social-engineering; sid:6006768; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vip3656g.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"vip3656g.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006769; classtype:social-engineering; sid:6006769; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreia7cfmuefjovgweh4n3on7ph62hkx7nrv43wvpmloim7zgeiwajae.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreia7cfmuefjovgweh4n3on7ph62hkx7nrv43wvpmloim7zgeiwajae.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006770; classtype:social-engineering; sid:6006770; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (multidisciplinary-leaders-547304.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"multidisciplinary-leaders-547304.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006771; classtype:social-engineering; sid:6006771; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vip3656q.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"vip3656q.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006772; classtype:social-engineering; sid:6006772; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mwahajx87.github.io/Seventh_Assignment)"; flow:established,to_server; http.uri; content:"/Seventh_Assignment"; startswith; fast_pattern; http.host; content:"mwahajx87.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006773; classtype:social-engineering; sid:6006773; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (o3656vip.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"o3656vip.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006774; classtype:social-engineering; sid:6006774; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bankofamericaclover.com/product/clover-go/)"; flow:established,to_server; http.uri; content:"/product/clover-go/"; startswith; fast_pattern; http.host; content:"bankofamericaclover.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006775; classtype:social-engineering; sid:6006775; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kuucoinxlogin.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kuucoinxlogin.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006776; classtype:social-engineering; sid:6006776; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store.communityuserdev.shop/workshop/AWP-AncientHeritage/)"; flow:established,to_server; http.uri; content:"/workshop/AWP-AncientHeritage/"; startswith; fast_pattern; http.host; content:"store.communityuserdev.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006777; classtype:social-engineering; sid:6006777; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whole-assistant-021521.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whole-assistant-021521.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006778; classtype:social-engineering; sid:6006778; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j61s.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j61s.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006779; classtype:social-engineering; sid:6006779; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (16140.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"16140.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006780; classtype:social-engineering; sid:6006780; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xtfi231.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xtfi231.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006781; classtype:social-engineering; sid:6006781; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cute-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cute-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006782; classtype:social-engineering; sid:6006782; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bfjklrvqn.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.bfjklrvqn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006783; classtype:social-engineering; sid:6006783; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (canetflxalert.com/signin/index.html)"; flow:established,to_server; http.uri; content:"/signin/index.html"; startswith; fast_pattern; http.host; content:"canetflxalert.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006784; classtype:social-engineering; sid:6006784; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinitttiiyysdafgh2026.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinitttiiyysdafgh2026.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006785; classtype:social-engineering; sid:6006785; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (important-embeds-449362.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"important-embeds-449362.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006786; classtype:social-engineering; sid:6006786; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (important-behavior-363054.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"important-behavior-363054.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006787; classtype:social-engineering; sid:6006787; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xetyuiomnxcewat.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xetyuiomnxcewat.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006788; classtype:social-engineering; sid:6006788; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (voicedatacenterrecice-address-desktopam-a150.widivag676.workers.dev/Voicemailacess-document-authorization-m365-sector-KAVuL3mndxhjDi8CzsIaDQSxxeeM810t/MErzojWRbkneyMiwYmLbUfOS90RrxGdQn54e2bSI/)"; flow:established,to_server; http.uri; content:"/Voicemailacess-document-authorization-m365-sector-KAVuL3mndxhjDi8CzsIaDQSxxeeM810t/MErzojWRbkneyMiwYmLbUfOS90RrxGdQn54e2bSI/"; startswith; fast_pattern; http.host; content:"voicedatacenterrecice-address-desktopam-a150.widivag676.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006789; classtype:social-engineering; sid:6006789; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gzqier.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gzqier.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006790; classtype:social-engineering; sid:6006790; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metaimsklogn.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metaimsklogn.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006791; classtype:social-engineering; sid:6006791; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (program-resmi763.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"program-resmi763.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006792; classtype:social-engineering; sid:6006792; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (convivial-tenure-487024.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"convivial-tenure-487024.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006793; classtype:social-engineering; sid:6006793; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dobraya-raduga.com.tr/id=5162802847)"; flow:established,to_server; http.uri; content:"/id=5162802847"; startswith; fast_pattern; http.host; content:"dobraya-raduga.com.tr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006794; classtype:social-engineering; sid:6006794; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support-tools.busines-help-center.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"support-tools.busines-help-center.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006795; classtype:social-engineering; sid:6006795; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uphold-en-usa.created.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uphold-en-usa.created.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006796; classtype:social-engineering; sid:6006796; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (saba-okv-milan.games/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"saba-okv-milan.games"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006797; classtype:social-engineering; sid:6006797; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (223900.vip/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"223900.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006798; classtype:social-engineering; sid:6006798; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (batalkanpembayarandisini.apexe.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"batalkanpembayarandisini.apexe.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006799; classtype:social-engineering; sid:6006799; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telstradat.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"telstradat.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006800; classtype:social-engineering; sid:6006800; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (messenger-clone-beta.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"messenger-clone-beta.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006801; classtype:social-engineering; sid:6006801; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mayank314mk.github.io/Netflix-UI-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-UI-Clone/"; startswith; fast_pattern; http.host; content:"mayank314mk.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006802; classtype:social-engineering; sid:6006802; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dgsjdynet.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.dgsjdynet.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006803; classtype:social-engineering; sid:6006803; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.90073.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.90073.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006804; classtype:social-engineering; sid:6006804; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (midasbuyplus-official.topup-mobiles.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"midasbuyplus-official.topup-mobiles.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006805; classtype:social-engineering; sid:6006805; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xetyuiomnxcewat.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xetyuiomnxcewat.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006806; classtype:social-engineering; sid:6006806; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booking-clone-app.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"booking-clone-app.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006807; classtype:social-engineering; sid:6006807; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en-apps-exedusweb.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"en-apps-exedusweb.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006808; classtype:social-engineering; sid:6006808; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bridge-power.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"bridge-power.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006809; classtype:social-engineering; sid:6006809; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezir-suiteappss.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"trezir-suiteappss.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006810; classtype:social-engineering; sid:6006810; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure.site.myaccountlogin.verif-optusnet.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure.site.myaccountlogin.verif-optusnet.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006811; classtype:social-engineering; sid:6006811; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.artmartialsensoriel.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.artmartialsensoriel.org"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006812; classtype:social-engineering; sid:6006812; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (belepes-mvmnext.com/support/payment/)"; flow:established,to_server; http.uri; content:"/support/payment/"; startswith; fast_pattern; http.host; content:"belepes-mvmnext.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006813; classtype:social-engineering; sid:6006813; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-7ee911a6faf241b6a84d2558aaa5e6e1.r2.dev/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-7ee911a6faf241b6a84d2558aaa5e6e1.r2.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006814; classtype:social-engineering; sid:6006814; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m-relay.services/pages/captcha.php)"; flow:established,to_server; http.uri; content:"/pages/captcha.php"; startswith; fast_pattern; http.host; content:"m-relay.services"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006815; classtype:social-engineering; sid:6006815; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mwregularizacaofacil.weebly.com/?gad_source=1&\;gad_campaignid=22790382676&\;gbraid=0AAAABAmxLMwvHgTyj0sEGM_M6yKhIp19A&\;gclid=EAIaIQobChMI5aLotP3LlAMV6Y6DBx3XFyGOEAAYASAAEgIBAPD_BwE)"; flow:established,to_server; http.uri; content:"/?gad_source=1&|3b|gad_campaignid=22790382676&|3b|gbraid=0AAAABAmxLMwvHgTyj0sEGM_M6yKhIp19A&|3b|gclid=EAIaIQobChMI5aLotP3LlAMV6Y6DBx3XFyGOEAAYASAAEgIBAPD_BwE"; startswith; fast_pattern; http.host; content:"mwregularizacaofacil.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006816; classtype:social-engineering; sid:6006816; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.84380h1g.bond/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.84380h1g.bond"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006817; classtype:social-engineering; sid:6006817; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maxisxi.ltd/mymaxis)"; flow:established,to_server; http.uri; content:"/mymaxis"; startswith; fast_pattern; http.host; content:"maxisxi.ltd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006818; classtype:social-engineering; sid:6006818; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (main-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"main-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006819; classtype:social-engineering; sid:6006819; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.h19x.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.h19x.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006820; classtype:social-engineering; sid:6006820; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (easycab.thetrybe.xyz/ea/koren.html)"; flow:established,to_server; http.uri; content:"/ea/koren.html"; startswith; fast_pattern; http.host; content:"easycab.thetrybe.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006821; classtype:social-engineering; sid:6006821; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ziply.pk/TDECkw)"; flow:established,to_server; http.uri; content:"/TDECkw"; startswith; fast_pattern; http.host; content:"ziply.pk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006822; classtype:social-engineering; sid:6006822; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (esl-claims.lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"esl-claims.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006823; classtype:social-engineering; sid:6006823; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.messenger-one-eta.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.messenger-one-eta.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006824; classtype:social-engineering; sid:6006824; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-shop-now.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-shop-now.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006825; classtype:social-engineering; sid:6006825; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.communitysessionmint2.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.communitysessionmint2.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006826; classtype:social-engineering; sid:6006826; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreicwpyrrcdviomdzoghfypihyjunaqhmujjumibnw6y34wfjkjeq54.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreicwpyrrcdviomdzoghfypihyjunaqhmujjumibnw6y34wfjkjeq54.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006827; classtype:social-engineering; sid:6006827; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kouqdis.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kouqdis.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006828; classtype:social-engineering; sid:6006828; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreia3w4sh7ezvfj62xpvuk7c4vunuf2nm2zc3r33wzcru7qlto76cdm.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreia3w4sh7ezvfj62xpvuk7c4vunuf2nm2zc3r33wzcru7qlto76cdm.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006829; classtype:social-engineering; sid:6006829; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uspsmailjourney.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uspsmailjourney.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006830; classtype:social-engineering; sid:6006830; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.doc-bet365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.doc-bet365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006831; classtype:social-engineering; sid:6006831; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16096.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16096.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006832; classtype:social-engineering; sid:6006832; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiaezawhk45pp3ax5rxdyq3bdwchtgtzv3vwz5egmwh4zmxdfp4dmy.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiaezawhk45pp3ax5rxdyq3bdwchtgtzv3vwz5egmwh4zmxdfp4dmy.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006833; classtype:social-engineering; sid:6006833; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.nextairbnbclone.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.nextairbnbclone.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006834; classtype:social-engineering; sid:6006834; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (foresee.ae/tes)"; flow:established,to_server; http.uri; content:"/tes"; startswith; fast_pattern; http.host; content:"foresee.ae"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006835; classtype:social-engineering; sid:6006835; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-clone-rust-ten.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-rust-ten.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006836; classtype:social-engineering; sid:6006836; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16146.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16146.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006837; classtype:social-engineering; sid:6006837; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (elaborate-products-order.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"elaborate-products-order.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006838; classtype:social-engineering; sid:6006838; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgerdistribute.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledgerdistribute.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006839; classtype:social-engineering; sid:6006839; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (borderclick.com/BC/media/Borderclick/Files/Freeamazon2026.html)"; flow:established,to_server; http.uri; content:"/BC/media/Borderclick/Files/Freeamazon2026.html"; startswith; fast_pattern; http.host; content:"borderclick.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006840; classtype:social-engineering; sid:6006840; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mfacebook.vn/v6da9g4drf?a)"; flow:established,to_server; http.uri; content:"/v6da9g4drf?a"; startswith; fast_pattern; http.host; content:"mfacebook.vn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006841; classtype:social-engineering; sid:6006841; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-login-page-theta.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-login-page-theta.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006842; classtype:social-engineering; sid:6006842; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aakifiqbal925.github.io/instagram/)"; flow:established,to_server; http.uri; content:"/instagram/"; startswith; fast_pattern; http.host; content:"aakifiqbal925.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006843; classtype:social-engineering; sid:6006843; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abnbrent-website.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"abnbrent-website.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006844; classtype:social-engineering; sid:6006844; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ashburnunmain.wasmer.app/omnired)"; flow:established,to_server; http.uri; content:"/omnired"; startswith; fast_pattern; http.host; content:"ashburnunmain.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006845; classtype:social-engineering; sid:6006845; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.messenger-clone-delta-eight.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.messenger-clone-delta-eight.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006846; classtype:social-engineering; sid:6006846; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s75u-zdsqx-zyof3f-rf4b0m.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"s75u-zdsqx-zyof3f-rf4b0m.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006847; classtype:social-engineering; sid:6006847; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgerorder.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledgerorder.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006848; classtype:social-engineering; sid:6006848; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (baiqiu.midasbuy-officials.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"baiqiu.midasbuy-officials.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006849; classtype:social-engineering; sid:6006849; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bitcoinsv-wallet.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bitcoinsv-wallet.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006850; classtype:social-engineering; sid:6006850; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.83094.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.83094.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006851; classtype:social-engineering; sid:6006851; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (naturalagro.in/excelxlx/index.html)"; flow:established,to_server; http.uri; content:"/excelxlx/index.html"; startswith; fast_pattern; http.host; content:"naturalagro.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006852; classtype:social-engineering; sid:6006852; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (l0g1n-access-pichncha.free.nf/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"l0g1n-access-pichncha.free.nf"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006853; classtype:social-engineering; sid:6006853; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (seld.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"seld.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006854; classtype:social-engineering; sid:6006854; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (program-resmi029.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"program-resmi029.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006855; classtype:social-engineering; sid:6006855; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jaytechomes.com/dsgsdgsh/Aruba/arubapc.htm)"; flow:established,to_server; http.uri; content:"/dsgsdgsh/Aruba/arubapc.htm"; startswith; fast_pattern; http.host; content:"jaytechomes.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006856; classtype:social-engineering; sid:6006856; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help-ndex-logen.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"help-ndex-logen.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006857; classtype:social-engineering; sid:6006857; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee7547.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopee7547.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006858; classtype:social-engineering; sid:6006858; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.l0g1n-access-pichncha.free.nf/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.l0g1n-access-pichncha.free.nf"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006859; classtype:social-engineering; sid:6006859; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.messenger-clone-gamma-two.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.messenger-clone-gamma-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006860; classtype:social-engineering; sid:6006860; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ie.nhyfhbc.net/adodmsisk/index.html)"; flow:established,to_server; http.uri; content:"/adodmsisk/index.html"; startswith; fast_pattern; http.host; content:"ie.nhyfhbc.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006861; classtype:social-engineering; sid:6006861; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (foresee.ae/tes/login.php)"; flow:established,to_server; http.uri; content:"/tes/login.php"; startswith; fast_pattern; http.host; content:"foresee.ae"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006862; classtype:social-engineering; sid:6006862; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee4678.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopee4678.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006863; classtype:social-engineering; sid:6006863; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-w6vzhq5av.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-w6vzhq5av.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006864; classtype:social-engineering; sid:6006864; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16136.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16136.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006865; classtype:social-engineering; sid:6006865; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (helpdeskk.sviluppo.host/fil/)"; flow:established,to_server; http.uri; content:"/fil/"; startswith; fast_pattern; http.host; content:"helpdeskk.sviluppo.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006866; classtype:social-engineering; sid:6006866; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s75u-zdsqx-zyof3f-rf4b0m.netlify.app/welcome_aboard)"; flow:established,to_server; http.uri; content:"/welcome_aboard"; startswith; fast_pattern; http.host; content:"s75u-zdsqx-zyof3f-rf4b0m.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006867; classtype:social-engineering; sid:6006867; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16134.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16134.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006868; classtype:social-engineering; sid:6006868; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pg.binanncee.com/show/)"; flow:established,to_server; http.uri; content:"/show/"; startswith; fast_pattern; http.host; content:"pg.binanncee.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006869; classtype:social-engineering; sid:6006869; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (recusos-humanos.com/?r=39b3bfd3-72cd-4c16-a20f-add88ba3eae7)"; flow:established,to_server; http.uri; content:"/?r=39b3bfd3-72cd-4c16-a20f-add88ba3eae7"; startswith; fast_pattern; http.host; content:"recusos-humanos.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006870; classtype:social-engineering; sid:6006870; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ebay-v.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ebay-v.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006871; classtype:social-engineering; sid:6006871; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suite-core.partner-programhub.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"suite-core.partner-programhub.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006872; classtype:social-engineering; sid:6006872; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16185.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16185.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006873; classtype:social-engineering; sid:6006873; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloud.you/joshy911)"; flow:established,to_server; http.uri; content:"/joshy911"; startswith; fast_pattern; http.host; content:"icloud.you"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006874; classtype:social-engineering; sid:6006874; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lnp00tp5ol-yc9pn.at9qmn.sbs/i/f1gcn/1779614965966#product&redi)"; flow:established,to_server; http.uri; content:"/i/f1gcn/1779614965966#product&redi"; startswith; fast_pattern; http.host; content:"lnp00tp5ol-yc9pn.at9qmn.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006875; classtype:social-engineering; sid:6006875; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.program-resmi029.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.program-resmi029.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006876; classtype:social-engineering; sid:6006876; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16182.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16182.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006877; classtype:social-engineering; sid:6006877; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (track.pstmrk.it/3s/asiolaadanasteamworf99fa.myclickfunnels.com/asphalti/804w/wY-FAQ/AQ/4ff5f5ef-47c0-4358-a05a-32c27c4fbc9b/1/DrAsivw520)"; flow:established,to_server; http.uri; content:"/3s/asiolaadanasteamworf99fa.myclickfunnels.com/asphalti/804w/wY-FAQ/AQ/4ff5f5ef-47c0-4358-a05a-32c27c4fbc9b/1/DrAsivw520"; startswith; fast_pattern; http.host; content:"track.pstmrk.it"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006878; classtype:social-engineering; sid:6006878; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cszb-dz.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cszb-dz.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006879; classtype:social-engineering; sid:6006879; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eldurmienteelquino.cl/wp-includes/zzz/)"; flow:established,to_server; http.uri; content:"/wp-includes/zzz/"; startswith; fast_pattern; http.host; content:"eldurmienteelquino.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006880; classtype:social-engineering; sid:6006880; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ashburnunmain.wasmer.app/syzcapitalag)"; flow:established,to_server; http.uri; content:"/syzcapitalag"; startswith; fast_pattern; http.host; content:"ashburnunmain.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006881; classtype:social-engineering; sid:6006881; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (energetic-indigo-dxeo7k8pg2.edgeone.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"energetic-indigo-dxeo7k8pg2.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006882; classtype:social-engineering; sid:6006882; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (96364.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"96364.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006883; classtype:social-engineering; sid:6006883; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parklnga.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parklnga.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006884; classtype:social-engineering; sid:6006884; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bagi-bagi-hadiah759.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bagi-bagi-hadiah759.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006885; classtype:social-engineering; sid:6006885; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (asesoriabarrachina.es/wp-includes/strato/?user-agent=Mozilla/5.0%20(Windows%20NT%2010.0)"; flow:established,to_server; http.uri; content:"/wp-includes/strato/?user-agent=Mozilla/5.0%20(Windows%20NT%2010.0"; startswith; fast_pattern; http.host; content:"asesoriabarrachina.es"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006886; classtype:social-engineering; sid:6006886; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.messenger-clone-delta-two.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.messenger-clone-delta-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006887; classtype:social-engineering; sid:6006887; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreicyghdtqspqrperjhwyfum7blmddcsnbeegsm5n46dfjkgypjcste.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreicyghdtqspqrperjhwyfum7blmddcsnbeegsm5n46dfjkgypjcste.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006888; classtype:social-engineering; sid:6006888; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thegreenpowerhour.info/PL-1466-160526/?u=83C1466&e=kelyn@83f744acfb53255758e27f0481235ca9d88b.org&s3=Aneta&s4=Kruszniewska&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/PL-1466-160526/?u=83C1466&e=kelyn@83f744acfb53255758e27f0481235ca9d88b.org&s3=Aneta&s4=Kruszniewska&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"thegreenpowerhour.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006889; classtype:social-engineering; sid:6006889; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pg.binanncee.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pg.binanncee.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006890; classtype:social-engineering; sid:6006890; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gebyar-shopee62.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"gebyar-shopee62.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006891; classtype:social-engineering; sid:6006891; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazonpk-clone.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazonpk-clone.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006892; classtype:social-engineering; sid:6006892; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (permissions.mystagingwebsite.com/wp-content/themes/fourtijoune/public/index.php)"; flow:established,to_server; http.uri; content:"/wp-content/themes/fourtijoune/public/index.php"; startswith; fast_pattern; http.host; content:"permissions.mystagingwebsite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006893; classtype:social-engineering; sid:6006893; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.qgzkkr.help/track-it/)"; flow:established,to_server; http.uri; content:"/track-it/"; startswith; fast_pattern; http.host; content:"brt.qgzkkr.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006894; classtype:social-engineering; sid:6006894; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chilhoodgames.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"chilhoodgames.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006895; classtype:social-engineering; sid:6006895; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-entry.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-entry.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006896; classtype:social-engineering; sid:6006896; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rare-blue-d4nhaptpng.edgeone.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rare-blue-d4nhaptpng.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006897; classtype:social-engineering; sid:6006897; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mtx-tfdaw.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mtx-tfdaw.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006898; classtype:social-engineering; sid:6006898; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreigpysgznoiy6tpehtfblhvkmg2vb3ihz2t3odeeqkrffv5tyalpwi.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreigpysgznoiy6tpehtfblhvkmg2vb3ihz2t3odeeqkrffv5tyalpwi.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006899; classtype:social-engineering; sid:6006899; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yew-puwx.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yew-puwx.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006900; classtype:social-engineering; sid:6006900; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortkex.lol/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortkex.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006901; classtype:social-engineering; sid:6006901; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (davqorim-biz-zormovura-21t6n26tz.netlify.app/guyywl-fdfscx-lkljhjh)"; flow:established,to_server; http.uri; content:"/guyywl-fdfscx-lkljhjh"; startswith; fast_pattern; http.host; content:"davqorim-biz-zormovura-21t6n26tz.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006902; classtype:social-engineering; sid:6006902; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bagi-bagi-hadiah759.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bagi-bagi-hadiah759.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006903; classtype:social-engineering; sid:6006903; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uu1505.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uu1505.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006904; classtype:social-engineering; sid:6006904; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ehay-uk-login-secures-ww7rwgzs.carremovals247.com.au/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ehay-uk-login-secures-ww7rwgzs.carremovals247.com.au"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006905; classtype:social-engineering; sid:6006905; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreihq2yrezmds7wagyexlpcgkqqkcxmy2szrzvrikbi2hxb6pyg6b64.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreihq2yrezmds7wagyexlpcgkqqkcxmy2szrzvrikbi2hxb6pyg6b64.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006906; classtype:social-engineering; sid:6006906; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a-atendimento-aqui.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a-atendimento-aqui.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006907; classtype:social-engineering; sid:6006907; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ehay-uk-login-secures-ww7rwgzs.carremovals247.com.au/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f)"; flow:established,to_server; http.uri; content:"/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f"; startswith; fast_pattern; http.host; content:"www.ehay-uk-login-secures-ww7rwgzs.carremovals247.com.au"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006908; classtype:social-engineering; sid:6006908; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a-atendimento-portal.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a-atendimento-portal.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006909; classtype:social-engineering; sid:6006909; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p25x.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p25x.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006910; classtype:social-engineering; sid:6006910; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portal-uphold-cdn-com.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"portal-uphold-cdn-com.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006911; classtype:social-engineering; sid:6006911; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kleankelp.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kleankelp.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006912; classtype:social-engineering; sid:6006912; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meditationsmoebel.info/PL-1466-160526/?u=14C1466&e=bogdan_wym%)"; flow:established,to_server; http.uri; content:"/PL-1466-160526/?u=14C1466&e=bogdan_wym%"; startswith; fast_pattern; http.host; content:"meditationsmoebel.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006913; classtype:social-engineering; sid:6006913; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedagiodlgital.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pedagiodlgital.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006914; classtype:social-engineering; sid:6006914; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox.com.et/communities/811227185660/OnlyTheFamily)"; flow:established,to_server; http.uri; content:"/communities/811227185660/OnlyTheFamily"; startswith; fast_pattern; http.host; content:"roblox.com.et"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006915; classtype:social-engineering; sid:6006915; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16153.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16153.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006916; classtype:social-engineering; sid:6006916; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a-atendimenton-online.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a-atendimenton-online.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006917; classtype:social-engineering; sid:6006917; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netmirr.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netmirr.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006918; classtype:social-engineering; sid:6006918; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16089.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16089.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006919; classtype:social-engineering; sid:6006919; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gebyar-shopee62.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.gebyar-shopee62.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006920; classtype:social-engineering; sid:6006920; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portal-uphold-cdn-com.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portal-uphold-cdn-com.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006921; classtype:social-engineering; sid:6006921; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-git-mp-fe-local-chained-actions-earn-uniswap.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-git-mp-fe-local-chained-actions-earn-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006922; classtype:social-engineering; sid:6006922; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (davqorim-biz-zarkequla-21t6n26tz.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"davqorim-biz-zarkequla-21t6n26tz.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006923; classtype:social-engineering; sid:6006923; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chrispraoline.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"chrispraoline.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006924; classtype:social-engineering; sid:6006924; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgervaultshop.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledgervaultshop.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006925; classtype:social-engineering; sid:6006925; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thaibshohan11-max.github.io/Facebook-/)"; flow:established,to_server; http.uri; content:"/Facebook-/"; startswith; fast_pattern; http.host; content:"thaibshohan11-max.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006926; classtype:social-engineering; sid:6006926; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.imchrisp.uk/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.imchrisp.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006927; classtype:social-engineering; sid:6006927; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toshopview.icu/index/user/login.html)"; flow:established,to_server; http.uri; content:"/index/user/login.html"; startswith; fast_pattern; http.host; content:"toshopview.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006928; classtype:social-engineering; sid:6006928; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hub-ledgr-live.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hub-ledgr-live.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006929; classtype:social-engineering; sid:6006929; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (16334.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"16334.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006930; classtype:social-engineering; sid:6006930; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fweink-inspect.wasmer.app/my-site-2)"; flow:established,to_server; http.uri; content:"/my-site-2"; startswith; fast_pattern; http.host; content:"fweink-inspect.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006931; classtype:social-engineering; sid:6006931; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16099.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16099.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006932; classtype:social-engineering; sid:6006932; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zxcvbnmnbwertyuiuytrdfghjk-g86tkbj1i9.edgeone.dev/english.html)"; flow:established,to_server; http.uri; content:"/english.html"; startswith; fast_pattern; http.host; content:"zxcvbnmnbwertyuiuytrdfghjk-g86tkbj1i9.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006933; classtype:social-engineering; sid:6006933; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.vislakotelog.club/login.php)"; flow:established,to_server; http.uri; content:"/login.php"; startswith; fast_pattern; http.host; content:"www.vislakotelog.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006934; classtype:social-engineering; sid:6006934; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store.workshopcosmeticreview.com/sharedfiles/filedetails?id=33)"; flow:established,to_server; http.uri; content:"/sharedfiles/filedetails?id=33"; startswith; fast_pattern; http.host; content:"store.workshopcosmeticreview.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006935; classtype:social-engineering; sid:6006935; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pinjamanmoz.turkeyzi.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pinjamanmoz.turkeyzi.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006936; classtype:social-engineering; sid:6006936; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alert-esl.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"alert-esl.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006937; classtype:social-engineering; sid:6006937; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (davqorim-biz-zarkequla-21t6n26tz.netlify.app/guyywl-fdfscx-lkljhjh)"; flow:established,to_server; http.uri; content:"/guyywl-fdfscx-lkljhjh"; startswith; fast_pattern; http.host; content:"davqorim-biz-zarkequla-21t6n26tz.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006938; classtype:social-engineering; sid:6006938; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (registrasipt1ki.inextart.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"registrasipt1ki.inextart.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006939; classtype:social-engineering; sid:6006939; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clothbrandfas-v7-zlm.vercel.app/login.html)"; flow:established,to_server; http.uri; content:"/login.html"; startswith; fast_pattern; http.host; content:"clothbrandfas-v7-zlm.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006940; classtype:social-engineering; sid:6006940; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16177.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16177.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006941; classtype:social-engineering; sid:6006941; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fromnewxdnaaidn.shineeni.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fromnewxdnaaidn.shineeni.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006942; classtype:social-engineering; sid:6006942; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kvmuab.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kvmuab.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006943; classtype:social-engineering; sid:6006943; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee4678.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopee4678.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006944; classtype:social-engineering; sid:6006944; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dalleimagegenerator.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dalleimagegenerator.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006945; classtype:social-engineering; sid:6006945; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.otyfip.help/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.otyfip.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006946; classtype:social-engineering; sid:6006946; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trustwalletsupport.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trustwalletsupport.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006947; classtype:social-engineering; sid:6006947; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (midastopupplus.putunesimbah.de/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"midastopupplus.putunesimbah.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006948; classtype:social-engineering; sid:6006948; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ashburnunmain.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ashburnunmain.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006949; classtype:social-engineering; sid:6006949; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopeeday-11-11.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopeeday-11-11.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006950; classtype:social-engineering; sid:6006950; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.qnasndnasn.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.qnasndnasn.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006951; classtype:social-engineering; sid:6006951; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6a1368552cfcdbd68ac15c08--cute-sawine-696d4c.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6a1368552cfcdbd68ac15c08--cute-sawine-696d4c.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006952; classtype:social-engineering; sid:6006952; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rekening-ing.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rekening-ing.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006953; classtype:social-engineering; sid:6006953; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-task-one.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-task-one.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006954; classtype:social-engineering; sid:6006954; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toshopview.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"toshopview.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006955; classtype:social-engineering; sid:6006955; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee7547.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.shopee7547.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006956; classtype:social-engineering; sid:6006956; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nextairbnbclone.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nextairbnbclone.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006957; classtype:social-engineering; sid:6006957; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-paiement.info/net/update.php)"; flow:established,to_server; http.uri; content:"/net/update.php"; startswith; fast_pattern; http.host; content:"netflix-paiement.info"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006958; classtype:social-engineering; sid:6006958; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (formulario-digital-2026-apknm.cr-web.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"formulario-digital-2026-apknm.cr-web.workers.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006959; classtype:social-engineering; sid:6006959; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bradesco.netatendimentocorporativo.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bradesco.netatendimentocorporativo.info"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006960; classtype:social-engineering; sid:6006960; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentodesexta.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentodesexta.s3.us-east-005.backblazeb2.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006961; classtype:social-engineering; sid:6006961; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bradesco.pjatualizacao2026.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bradesco.pjatualizacao2026.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006962; classtype:social-engineering; sid:6006962; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (empresasenegociossuporte.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"empresasenegociossuporte.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006963; classtype:social-engineering; sid:6006963; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.store-dofus.fr/mmorpg/actualites/recompenses/grimoires1/succes)"; flow:established,to_server; http.uri; content:"/mmorpg/actualites/recompenses/grimoires1/succes"; startswith; fast_pattern; http.host; content:"www.store-dofus.fr"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006964; classtype:social-engineering; sid:6006964; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mondialrelayredirectioncolis.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mondialrelayredirectioncolis.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006965; classtype:social-engineering; sid:6006965; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qegdh-und-1.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qegdh-und-1.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006966; classtype:social-engineering; sid:6006966; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dkeagical-galileo.91-218-65-223.plesk.page/redirecte.php)"; flow:established,to_server; http.uri; content:"/redirecte.php"; startswith; fast_pattern; http.host; content:"dkeagical-galileo.91-218-65-223.plesk.page"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006967; classtype:social-engineering; sid:6006967; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bradesco.netatendimentocorporativo.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bradesco.netatendimentocorporativo.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006968; classtype:social-engineering; sid:6006968; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (warmhearted-dessert-561882.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"warmhearted-dessert-561882.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006969; classtype:social-engineering; sid:6006969; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (formulario-cita-2026-ajyh.cr-web.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"formulario-cita-2026-ajyh.cr-web.workers.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006970; classtype:social-engineering; sid:6006970; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deutschland-kreditdeutshe.91-218-65-223.plesk.page/redirecte.php)"; flow:established,to_server; http.uri; content:"/redirecte.php"; startswith; fast_pattern; http.host; content:"deutschland-kreditdeutshe.91-218-65-223.plesk.page"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006971; classtype:social-engineering; sid:6006971; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-accounts.info/auth/login.php)"; flow:established,to_server; http.uri; content:"/auth/login.php"; startswith; fast_pattern; http.host; content:"netflix-accounts.info"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006972; classtype:social-engineering; sid:6006972; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gmt-tokens-web.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gmt-tokens-web.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006973; classtype:social-engineering; sid:6006973; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netbradesco-empresas.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netbradesco-empresas.live"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006974; classtype:social-engineering; sid:6006974; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p25v.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p25v.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006975; classtype:social-engineering; sid:6006975; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoja30.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoja30.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006976; classtype:social-engineering; sid:6006976; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p25w.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p25w.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006977; classtype:social-engineering; sid:6006977; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hr-messages.com/PB/?keyname=tIjH36a)"; flow:established,to_server; http.uri; content:"/PB/?keyname=tIjH36a"; startswith; fast_pattern; http.host; content:"hr-messages.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006978; classtype:social-engineering; sid:6006978; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alert-esl.lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"alert-esl.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006979; classtype:social-engineering; sid:6006979; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqtmvxpqll.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqtmvxpqll.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006980; classtype:social-engineering; sid:6006980; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-m1cr0soft-login.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-m1cr0soft-login.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006981; classtype:social-engineering; sid:6006981; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (learn-suitees---app.gitbook.io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"learn-suitees---app.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006982; classtype:social-engineering; sid:6006982; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.gqwmtrxplv.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.gqwmtrxplv.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006983; classtype:social-engineering; sid:6006983; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bolsascreaideas.cl/ElizabethBianco/AcresOfDiamonds.html)"; flow:established,to_server; http.uri; content:"/ElizabethBianco/AcresOfDiamonds.html"; startswith; fast_pattern; http.host; content:"www.bolsascreaideas.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006984; classtype:social-engineering; sid:6006984; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cookcorner.life/asd/index.php)"; flow:established,to_server; http.uri; content:"/asd/index.php"; startswith; fast_pattern; http.host; content:"cookcorner.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006985; classtype:social-engineering; sid:6006985; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.tqpfkp.cc/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.tqpfkp.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006986; classtype:social-engineering; sid:6006986; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jwtxrmvqlp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jwtxrmvqlp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006987; classtype:social-engineering; sid:6006987; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.hjtrvqplxm.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.hjtrvqplxm.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006988; classtype:social-engineering; sid:6006988; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (16062.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"16062.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006989; classtype:social-engineering; sid:6006989; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hyattplacehongqiao.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hyattplacehongqiao.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006990; classtype:social-engineering; sid:6006990; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.empresas.terrazzanealmeida.com.br/.tmb/proses2.php)"; flow:established,to_server; http.uri; content:"/.tmb/proses2.php"; startswith; fast_pattern; http.host; content:"www.empresas.terrazzanealmeida.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006991; classtype:social-engineering; sid:6006991; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (supra.smartistickids.info/?app_vl=ZYFwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=nelynpro@bc02695987de5f7eff59d23b0cf454fc26aa.org&sui=%7Bsui%7D&fn=&ln=&p=&z=PL-PLNONACL-2505-VULTUR8)"; flow:established,to_server; http.uri; content:"/?app_vl=ZYFwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=nelynpro@bc02695987de5f7eff59d23b0cf454fc26aa.org&sui=%7Bsui%7D&fn=&ln=&p=&z=PL-PLNONACL-2505-VULTUR8"; startswith; fast_pattern; http.host; content:"supra.smartistickids.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006992; classtype:social-engineering; sid:6006992; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.ktqufu.help/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.ktqufu.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006993; classtype:social-engineering; sid:6006993; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ortan.ru/vendor/doctrine/vendor/verif1.php)"; flow:established,to_server; http.uri; content:"/vendor/doctrine/vendor/verif1.php"; startswith; fast_pattern; http.host; content:"ortan.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006994; classtype:social-engineering; sid:6006994; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fgjimx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.fgjimx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006995; classtype:social-engineering; sid:6006995; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (murnorex-biz-prenqorami-22t526sd.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"murnorex-biz-prenqorami-22t526sd.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006996; classtype:social-engineering; sid:6006996; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.j67m.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.j67m.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006997; classtype:social-engineering; sid:6006997; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support-mydpd-ch.looksel.com/src/schweiz/lang_DE/person/empfangen/form.html)"; flow:established,to_server; http.uri; content:"/src/schweiz/lang_DE/person/empfangen/form.html"; startswith; fast_pattern; http.host; content:"support-mydpd-ch.looksel.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006998; classtype:social-engineering; sid:6006998; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.fqplznrvtm.icu/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.fqplznrvtm.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006999; classtype:social-engineering; sid:6006999; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (santaclarreshbcf.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"santaclarreshbcf.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007000; classtype:social-engineering; sid:6007000; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aircommunity.live/airlock2.html)"; flow:established,to_server; http.uri; content:"/airlock2.html"; startswith; fast_pattern; http.host; content:"aircommunity.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007001; classtype:social-engineering; sid:6007001; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bellsouth-email-signing.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bellsouth-email-signing.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007002; classtype:social-engineering; sid:6007002; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.hvplqzrntu.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.hvplqzrntu.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007003; classtype:social-engineering; sid:6007003; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.cxmvtrqplv.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.cxmvtrqplv.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007004; classtype:social-engineering; sid:6007004; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (midhunkrishnanm01.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"midhunkrishnanm01.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007005; classtype:social-engineering; sid:6007005; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (r-atendionline-br.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"r-atendionline-br.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007006; classtype:social-engineering; sid:6007006; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wg4apccancelar.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wg4apccancelar.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007007; classtype:social-engineering; sid:6007007; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.71782.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.71782.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007008; classtype:social-engineering; sid:6007008; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bvxtrmqplx.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.bvxtrmqplx.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007009; classtype:social-engineering; sid:6007009; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kznplwxtrx.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kznplwxtrx.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007010; classtype:social-engineering; sid:6007010; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (at-t-communication-bccdb9.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"at-t-communication-bccdb9.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007011; classtype:social-engineering; sid:6007011; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (i3a0-casefb839350.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"i3a0-casefb839350.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007012; classtype:social-engineering; sid:6007012; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.gnwrplzqit.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.gnwrplzqit.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007013; classtype:social-engineering; sid:6007013; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.hvxqtrmplw.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.hvxqtrmplw.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007014; classtype:social-engineering; sid:6007014; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso--hold-uphold-so.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sso--hold-uphold-so.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007015; classtype:social-engineering; sid:6007015; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cloud-get-trezr-io-suite.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cloud-get-trezr-io-suite.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007016; classtype:social-engineering; sid:6007016; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alpahidatakayama.spahotel.guru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"alpahidatakayama.spahotel.guru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007017; classtype:social-engineering; sid:6007017; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.situs-shopee39.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.situs-shopee39.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007018; classtype:social-engineering; sid:6007018; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jplwrznqtx.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jplwrznqtx.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007019; classtype:social-engineering; sid:6007019; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9389m.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9389m.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007020; classtype:social-engineering; sid:6007020; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atualizasuportflix.ddns.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"atualizasuportflix.ddns.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007021; classtype:social-engineering; sid:6007021; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parklngh.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parklngh.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007022; classtype:social-engineering; sid:6007022; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suite-startapptrezr.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"suite-startapptrezr.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007023; classtype:social-engineering; sid:6007023; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (navvurem-biz-zarkequla-22t526sd.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"navvurem-biz-zarkequla-22t526sd.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007024; classtype:social-engineering; sid:6007024; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (co-ukgsuqk.bond/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"co-ukgsuqk.bond"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007025; classtype:social-engineering; sid:6007025; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.gqwmxtrplk.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.gqwmxtrplk.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007026; classtype:social-engineering; sid:6007026; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bvxmqtrpln.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.bvxmqtrpln.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007027; classtype:social-engineering; sid:6007027; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (raushan-k15.github.io/Amazon_Clone)"; flow:established,to_server; http.uri; content:"/Amazon_Clone"; startswith; fast_pattern; http.host; content:"raushan-k15.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007028; classtype:social-engineering; sid:6007028; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shiplusaha995.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"shiplusaha995.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007029; classtype:social-engineering; sid:6007029; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pohl.essentiahm.com/Moja/Sso/csob/loggin.php)"; flow:established,to_server; http.uri; content:"/Moja/Sso/csob/loggin.php"; startswith; fast_pattern; http.host; content:"pohl.essentiahm.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007030; classtype:social-engineering; sid:6007030; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atmaicwaslidz.gitbook.io/atomic)"; flow:established,to_server; http.uri; content:"/atomic"; startswith; fast_pattern; http.host; content:"atmaicwaslidz.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007031; classtype:social-engineering; sid:6007031; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.fxqmvtrplf.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.fxqmvtrplf.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007032; classtype:social-engineering; sid:6007032; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bmvtrxqplk.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.bmvtrxqplk.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007033; classtype:social-engineering; sid:6007033; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kuicomlogxn.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kuicomlogxn.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007034; classtype:social-engineering; sid:6007034; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fls-a1c51f02-c4c7-48d3-b92a-60b482c5e0ef.laravel.cloud/mayor_excel.html)"; flow:established,to_server; http.uri; content:"/mayor_excel.html"; startswith; fast_pattern; http.host; content:"fls-a1c51f02-c4c7-48d3-b92a-60b482c5e0ef.laravel.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007035; classtype:social-engineering; sid:6007035; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sjeamcommunity.life/pending/gifts)"; flow:established,to_server; http.uri; content:"/pending/gifts"; startswith; fast_pattern; http.host; content:"sjeamcommunity.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007036; classtype:social-engineering; sid:6007036; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-responsive-mob-homepage.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-responsive-mob-homepage.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007037; classtype:social-engineering; sid:6007037; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1165nnn.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1165nnn.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007038; classtype:social-engineering; sid:6007038; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.y22x.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.y22x.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007039; classtype:social-engineering; sid:6007039; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kptxmvqrlz.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kptxmvqrlz.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007040; classtype:social-engineering; sid:6007040; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.jnapwv.click/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.jnapwv.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007041; classtype:social-engineering; sid:6007041; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.empresas.terrazzanealmeida.com.br/.tmb/index.php)"; flow:established,to_server; http.uri; content:"/.tmb/index.php"; startswith; fast_pattern; http.host; content:"www.empresas.terrazzanealmeida.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007042; classtype:social-engineering; sid:6007042; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wspdjr.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wspdjr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007043; classtype:social-engineering; sid:6007043; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix.gestion-pagos-es.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix.gestion-pagos-es.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007044; classtype:social-engineering; sid:6007044; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.hvsqml.help/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.hvsqml.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007045; classtype:social-engineering; sid:6007045; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adnaan-developer.github.io/Netflix/)"; flow:established,to_server; http.uri; content:"/Netflix/"; startswith; fast_pattern; http.host; content:"adnaan-developer.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007046; classtype:social-engineering; sid:6007046; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hemlscrotaia.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hemlscrotaia.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007047; classtype:social-engineering; sid:6007047; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.k67d.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.k67d.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007048; classtype:social-engineering; sid:6007048; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pemenang2021.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"pemenang2021.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007049; classtype:social-engineering; sid:6007049; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (situs-shopee39.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"situs-shopee39.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007050; classtype:social-engineering; sid:6007050; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b28l.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b28l.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007051; classtype:social-engineering; sid:6007051; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.jcachineseschool.org/Routledge/Routledge%20audio%20textbook/L32%20Dialogue/verif2.php)"; flow:established,to_server; http.uri; content:"/Routledge/Routledge%20audio%20textbook/L32%20Dialogue/verif2.php"; startswith; fast_pattern; http.host; content:"www.jcachineseschool.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007052; classtype:social-engineering; sid:6007052; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ortan.ru/vendor/doctrine/vendor/otp1.php)"; flow:established,to_server; http.uri; content:"/vendor/doctrine/vendor/otp1.php"; startswith; fast_pattern; http.host; content:"ortan.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007053; classtype:social-engineering; sid:6007053; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pohl.essentiahm.com/Moja/Sso/csob/otp.php)"; flow:established,to_server; http.uri; content:"/Moja/Sso/csob/otp.php"; startswith; fast_pattern; http.host; content:"pohl.essentiahm.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007054; classtype:social-engineering; sid:6007054; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dhl.hvwql-ie.org/track)"; flow:established,to_server; http.uri; content:"/track"; startswith; fast_pattern; http.host; content:"dhl.hvwql-ie.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007055; classtype:social-engineering; sid:6007055; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alert-esl-org.lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"alert-esl-org.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007056; classtype:social-engineering; sid:6007056; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m18a.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m18a.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007057; classtype:social-engineering; sid:6007057; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a-atendimenton-guia.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a-atendimenton-guia.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007058; classtype:social-engineering; sid:6007058; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (plain-dawn-63d3.herberthc88.workers.dev/0x69b19b8be8bfb5d41f021393/o/aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29t-lg/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca)"; flow:established,to_server; http.uri; content:"/0x69b19b8be8bfb5d41f021393/o/aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29t-lg/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca"; startswith; fast_pattern; http.host; content:"plain-dawn-63d3.herberthc88.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007059; classtype:social-engineering; sid:6007059; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deliverybox.48-199-17-44.cpanel.site/eu/)"; flow:established,to_server; http.uri; content:"/eu/"; startswith; fast_pattern; http.host; content:"deliverybox.48-199-17-44.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007060; classtype:social-engineering; sid:6007060; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-es.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-es.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007061; classtype:social-engineering; sid:6007061; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (y22w.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"y22w.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007062; classtype:social-engineering; sid:6007062; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.cnvrpkzqlm.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.cnvrpkzqlm.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007063; classtype:social-engineering; sid:6007063; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aksharabagelikar.github.io/-netflix-clone/)"; flow:established,to_server; http.uri; content:"/-netflix-clone/"; startswith; fast_pattern; http.host; content:"aksharabagelikar.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007064; classtype:social-engineering; sid:6007064; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bvxqtrmplf.icu/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.bvxqtrmplf.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007065; classtype:social-engineering; sid:6007065; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (g13d.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"g13d.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007066; classtype:social-engineering; sid:6007066; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.fqplnrzvgt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.fqplnrzvgt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007067; classtype:social-engineering; sid:6007067; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (diwmfimefkefe.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"diwmfimefkefe.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007068; classtype:social-engineering; sid:6007068; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mwizz.leadsbr.com.br/latest/index.php/campaigns/hk4973aa118b3/track-url/jx7221rb7z49d/2bff58fca0876febb137f0cbba4996173a271f05)"; flow:established,to_server; http.uri; content:"/latest/index.php/campaigns/hk4973aa118b3/track-url/jx7221rb7z49d/2bff58fca0876febb137f0cbba4996173a271f05"; startswith; fast_pattern; http.host; content:"mwizz.leadsbr.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007069; classtype:social-engineering; sid:6007069; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (murnorex-biz-prenqorami-22t526sd.netlify.app/guyywl-fdfscx-lkljhjh)"; flow:established,to_server; http.uri; content:"/guyywl-fdfscx-lkljhjh"; startswith; fast_pattern; http.host; content:"murnorex-biz-prenqorami-22t526sd.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007070; classtype:social-engineering; sid:6007070; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fricktransfer.com/wp-admin/includes/docs)"; flow:established,to_server; http.uri; content:"/wp-admin/includes/docs"; startswith; fast_pattern; http.host; content:"fricktransfer.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007071; classtype:social-engineering; sid:6007071; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (51159944.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"51159944.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007072; classtype:social-engineering; sid:6007072; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j67k.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j67k.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007073; classtype:social-engineering; sid:6007073; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (16074.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"16074.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007074; classtype:social-engineering; sid:6007074; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cctickcoka.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cctickcoka.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007075; classtype:social-engineering; sid:6007075; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (authsibpfnovologin.shop/net/net/)"; flow:established,to_server; http.uri; content:"/net/net/"; startswith; fast_pattern; http.host; content:"authsibpfnovologin.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007076; classtype:social-engineering; sid:6007076; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.ctsary.buzz/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.ctsary.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007077; classtype:social-engineering; sid:6007077; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (slocal.eu/wp-includes/docss/preview/disk/GlobalSources/?email=nelum9@5fc4c1d1c12cdad8ba6517488f5e8399fe8c.net)"; flow:established,to_server; http.uri; content:"/wp-includes/docss/preview/disk/GlobalSources/?email=nelum9@5fc4c1d1c12cdad8ba6517488f5e8399fe8c.net"; startswith; fast_pattern; http.host; content:"slocal.eu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007078; classtype:social-engineering; sid:6007078; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suite-startapptrezr.gitbook.io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"suite-startapptrezr.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007079; classtype:social-engineering; sid:6007079; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jxtrqmvplz.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jxtrqmvplz.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007080; classtype:social-engineering; sid:6007080; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j67l.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j67l.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007081; classtype:social-engineering; sid:6007081; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.cxtrmvpqzl.icu/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.cxtrmvpqzl.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007082; classtype:social-engineering; sid:6007082; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.fycweo.help/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.fycweo.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007083; classtype:social-engineering; sid:6007083; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.k67b.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.k67b.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007084; classtype:social-engineering; sid:6007084; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.69092.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.69092.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007085; classtype:social-engineering; sid:6007085; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dynamite-concave2132.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dynamite-concave2132.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007086; classtype:social-engineering; sid:6007086; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clinicaespacosaude.med.br/citycheckwork/Y2F0ZXJpbmdAZHJ1eHlzLmNvbQ==)"; flow:established,to_server; http.uri; content:"/citycheckwork/Y2F0ZXJpbmdAZHJ1eHlzLmNvbQ=="; startswith; fast_pattern; http.host; content:"clinicaespacosaude.med.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007087; classtype:social-engineering; sid:6007087; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (io-trezor-stcrt.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"io-trezor-stcrt.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007088; classtype:social-engineering; sid:6007088; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aircommunity.live/airlock.html)"; flow:established,to_server; http.uri; content:"/airlock.html"; startswith; fast_pattern; http.host; content:"aircommunity.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007089; classtype:social-engineering; sid:6007089; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.jcachineseschool.org/Routledge/Routledge%20audio%20textbook/L32%20Dialogue/index.php)"; flow:established,to_server; http.uri; content:"/Routledge/Routledge%20audio%20textbook/L32%20Dialogue/index.php"; startswith; fast_pattern; http.host; content:"www.jcachineseschool.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007090; classtype:social-engineering; sid:6007090; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.j68a.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.j68a.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007091; classtype:social-engineering; sid:6007091; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b28k.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b28k.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007092; classtype:social-engineering; sid:6007092; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deeprajchoudhary.github.io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"deeprajchoudhary.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007093; classtype:social-engineering; sid:6007093; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roopal045-cloud.github.io/Amazon-homepage-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-homepage-clone/"; startswith; fast_pattern; http.host; content:"roopal045-cloud.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007094; classtype:social-engineering; sid:6007094; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bet6855.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bet6855.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007095; classtype:social-engineering; sid:6007095; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.jcachineseschool.org/Routledge/Routledge%20audio%20textbook/L32%20Dialogue/verif1.php)"; flow:established,to_server; http.uri; content:"/Routledge/Routledge%20audio%20textbook/L32%20Dialogue/verif1.php"; startswith; fast_pattern; http.host; content:"www.jcachineseschool.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007096; classtype:social-engineering; sid:6007096; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xn--365kperfectplace-3e60bo65otna435b.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xn--365kperfectplace-3e60bo65otna435b.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007097; classtype:social-engineering; sid:6007097; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bvxqrmptla.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.bvxqrmptla.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007098; classtype:social-engineering; sid:6007098; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deliverybox.48-199-17-44.cpanel.site/eu/track.php?f26n8rlz03xm8jlz0mue)"; flow:established,to_server; http.uri; content:"/eu/track.php?f26n8rlz03xm8jlz0mue"; startswith; fast_pattern; http.host; content:"deliverybox.48-199-17-44.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007099; classtype:social-engineering; sid:6007099; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sakmetametsylgn.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sakmetametsylgn.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007100; classtype:social-engineering; sid:6007100; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ayyylolo.github.io/daftaraddyoi.github.io/)"; flow:established,to_server; http.uri; content:"/daftaraddyoi.github.io/"; startswith; fast_pattern; http.host; content:"ayyylolo.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007101; classtype:social-engineering; sid:6007101; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b6nwd.aketi7.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b6nwd.aketi7.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007102; classtype:social-engineering; sid:6007102; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.trust-in-bet365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.trust-in-bet365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007103; classtype:social-engineering; sid:6007103; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (liveinn.pt/.cgi/2026%20Tender%20Documents.html)"; flow:established,to_server; http.uri; content:"/.cgi/2026%20Tender%20Documents.html"; startswith; fast_pattern; http.host; content:"liveinn.pt"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007104; classtype:social-engineering; sid:6007104; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aditimandal6292-web.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"aditimandal6292-web.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007105; classtype:social-engineering; sid:6007105; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parklngl.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parklngl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007106; classtype:social-engineering; sid:6007106; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-pemenangmidyear88.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"info-pemenangmidyear88.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007107; classtype:social-engineering; sid:6007107; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (us-learn-trezor.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"us-learn-trezor.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007108; classtype:social-engineering; sid:6007108; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.gwxmvtrqlt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.gwxmvtrqlt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007109; classtype:social-engineering; sid:6007109; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (69160.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"69160.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007110; classtype:social-engineering; sid:6007110; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p25y.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p25y.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007111; classtype:social-engineering; sid:6007111; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bvnzrqtpcl.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.bvnzrqtpcl.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007112; classtype:social-engineering; sid:6007112; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.alexa.abductist.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"login.alexa.abductist.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007113; classtype:social-engineering; sid:6007113; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (learn-suitees---app.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"learn-suitees---app.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007114; classtype:social-engineering; sid:6007114; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.g13s.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.g13s.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007115; classtype:social-engineering; sid:6007115; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (authsibpfnovologin.shop/net/net/login.php)"; flow:established,to_server; http.uri; content:"/net/net/login.php"; startswith; fast_pattern; http.host; content:"authsibpfnovologin.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007116; classtype:social-engineering; sid:6007116; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kplxtqvmbr.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kplxtqvmbr.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007117; classtype:social-engineering; sid:6007117; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.fohymk.click/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.fohymk.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007118; classtype:social-engineering; sid:6007118; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dribbble.com/playoffs/pubg-mobile/)"; flow:established,to_server; http.uri; content:"/playoffs/pubg-mobile/"; startswith; fast_pattern; http.host; content:"www.dribbble.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007119; classtype:social-engineering; sid:6007119; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pemenang2021.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.pemenang2021.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007120; classtype:social-engineering; sid:6007120; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.i365kvip.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.i365kvip.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007121; classtype:social-engineering; sid:6007121; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parklngd.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parklngd.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007122; classtype:social-engineering; sid:6007122; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.tlhsgq.buzz/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.tlhsgq.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007123; classtype:social-engineering; sid:6007123; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (baobicartonhaingoc.com/wp-content/upgrade/index.html)"; flow:established,to_server; http.uri; content:"/wp-content/upgrade/index.html"; startswith; fast_pattern; http.host; content:"baobicartonhaingoc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007124; classtype:social-engineering; sid:6007124; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoemergecia.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoemergecia.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007125; classtype:social-engineering; sid:6007125; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.fxqmvtrplx.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.fxqmvtrplx.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007126; classtype:social-engineering; sid:6007126; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-verification-e7e.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"account-verification-e7e.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007127; classtype:social-engineering; sid:6007127; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (arpitgoel889.github.io/Instagram/)"; flow:established,to_server; http.uri; content:"/Instagram/"; startswith; fast_pattern; http.host; content:"arpitgoel889.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007128; classtype:social-engineering; sid:6007128; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalne.ssid-id71929293.top/211282086)"; flow:established,to_server; http.uri; content:"/211282086"; startswith; fast_pattern; http.host; content:"allegrolokalne.ssid-id71929293.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007129; classtype:social-engineering; sid:6007129; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clinicaespacosaude.med.br/citycheckwork/aGVscGRlc2tAYnJhbmRvbnUuY2E=)"; flow:established,to_server; http.uri; content:"/citycheckwork/aGVscGRlc2tAYnJhbmRvbnUuY2E="; startswith; fast_pattern; http.host; content:"clinicaespacosaude.med.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007130; classtype:social-engineering; sid:6007130; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mercadolibre-challenge-jki9bqmwa-florabril.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mercadolibre-challenge-jki9bqmwa-florabril.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007131; classtype:social-engineering; sid:6007131; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (able-line-962735.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"able-line-962735.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007132; classtype:social-engineering; sid:6007132; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.hvplrqznmt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.hvplrqznmt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007133; classtype:social-engineering; sid:6007133; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aircommunity.live/host-with-problem/claim/404218/)"; flow:established,to_server; http.uri; content:"/host-with-problem/claim/404218/"; startswith; fast_pattern; http.host; content:"aircommunity.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007134; classtype:social-engineering; sid:6007134; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.m18c.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.m18c.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007135; classtype:social-engineering; sid:6007135; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-pemenangmidyear88.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.info-pemenangmidyear88.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007136; classtype:social-engineering; sid:6007136; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (focus-bet365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"focus-bet365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007137; classtype:social-engineering; sid:6007137; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.royalmail.com.ekcfme.com/gcgaToXk7v)"; flow:established,to_server; http.uri; content:"/gcgaToXk7v"; startswith; fast_pattern; http.host; content:"www.royalmail.com.ekcfme.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007138; classtype:social-engineering; sid:6007138; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (start-ledge-en.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"start-ledge-en.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007139; classtype:social-engineering; sid:6007139; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (backup-wallet.info/connect/backup/)"; flow:established,to_server; http.uri; content:"/connect/backup/"; startswith; fast_pattern; http.host; content:"backup-wallet.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007140; classtype:social-engineering; sid:6007140; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.fqplwrnqtx.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.fqplwrnqtx.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007141; classtype:social-engineering; sid:6007141; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j67z.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j67z.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007142; classtype:social-engineering; sid:6007142; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (g13t.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"g13t.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007143; classtype:social-engineering; sid:6007143; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (click5.wezxrsdfanch.info/ga/click/2-6829210-9-8098-15855-8701-a0e68848e6-17ff7511ba)"; flow:established,to_server; http.uri; content:"/ga/click/2-6829210-9-8098-15855-8701-a0e68848e6-17ff7511ba"; startswith; fast_pattern; http.host; content:"click5.wezxrsdfanch.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007144; classtype:social-engineering; sid:6007144; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.fxqtmvpqlr.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.fxqtmvpqlr.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007145; classtype:social-engineering; sid:6007145; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alpinahidatakayama.spahotel.guru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"alpinahidatakayama.spahotel.guru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007146; classtype:social-engineering; sid:6007146; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.teamcommunity-friends.com/p/yres-fgs/gfht)"; flow:established,to_server; http.uri; content:"/p/yres-fgs/gfht"; startswith; fast_pattern; http.host; content:"s.teamcommunity-friends.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007147; classtype:social-engineering; sid:6007147; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verifynow-esl-org.lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"verifynow-esl-org.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007148; classtype:social-engineering; sid:6007148; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jplwnrqztb.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jplwnrqztb.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007149; classtype:social-engineering; sid:6007149; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (u17k.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"u17k.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007150; classtype:social-engineering; sid:6007150; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (666666213489437.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"666666213489437.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007151; classtype:social-engineering; sid:6007151; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (voluntary-posterity-851564.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"voluntary-posterity-851564.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007152; classtype:social-engineering; sid:6007152; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.ptlhyy.buzz/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.ptlhyy.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007153; classtype:social-engineering; sid:6007153; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (connexion-mabanque-bnpparibas-nq8b.onrender.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"connexion-mabanque-bnpparibas-nq8b.onrender.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007154; classtype:social-engineering; sid:6007154; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tnrzqpltrx.icu/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tnrzqpltrx.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007155; classtype:social-engineering; sid:6007155; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.cxmvtrqplx.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.cxmvtrqplx.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007156; classtype:social-engineering; sid:6007156; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.edgy-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.edgy-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007157; classtype:social-engineering; sid:6007157; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stale-rose-139957.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"stale-rose-139957.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007158; classtype:social-engineering; sid:6007158; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (empresas.terrazzanealmeida.com.br/.tmb/index.php)"; flow:established,to_server; http.uri; content:"/.tmb/index.php"; startswith; fast_pattern; http.host; content:"empresas.terrazzanealmeida.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007159; classtype:social-engineering; sid:6007159; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.gnwrzplqtx.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.gnwrzplqtx.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007160; classtype:social-engineering; sid:6007160; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ku-football.bet/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ku-football.bet"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007161; classtype:social-engineering; sid:6007161; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.jcachineseschool.org/Routledge/Routledge%20audio%20textbook/L32%20Dialogue/otp1.php)"; flow:established,to_server; http.uri; content:"/Routledge/Routledge%20audio%20textbook/L32%20Dialogue/otp1.php"; startswith; fast_pattern; http.host; content:"www.jcachineseschool.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007162; classtype:social-engineering; sid:6007162; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (steamcomummnlty.com/tradeoffer/new/partner=783662133token=l4hhebGA21839)"; flow:established,to_server; http.uri; content:"/tradeoffer/new/partner=783662133token=l4hhebGA21839"; startswith; fast_pattern; http.host; content:"steamcomummnlty.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007163; classtype:social-engineering; sid:6007163; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (elitee.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"elitee.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007164; classtype:social-engineering; sid:6007164; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (santander-portugal-demo.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"santander-portugal-demo.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007165; classtype:social-engineering; sid:6007165; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ristek.link/backupbase)"; flow:established,to_server; http.uri; content:"/backupbase"; startswith; fast_pattern; http.host; content:"ristek.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007166; classtype:social-engineering; sid:6007166; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xioamigpscar.cheetahcar.shop/.well-known/jufjjf/)"; flow:established,to_server; http.uri; content:"/.well-known/jufjjf/"; startswith; fast_pattern; http.host; content:"xioamigpscar.cheetahcar.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007167; classtype:social-engineering; sid:6007167; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.hvxqrmpltw.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.hvxqrmpltw.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007168; classtype:social-engineering; sid:6007168; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dftyjt.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.dftyjt.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007169; classtype:social-engineering; sid:6007169; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (navvurem-biz-zarkequla-22t526sd.netlify.app/guyywl-fdfscx-lkljhjh)"; flow:established,to_server; http.uri; content:"/guyywl-fdfscx-lkljhjh"; startswith; fast_pattern; http.host; content:"navvurem-biz-zarkequla-22t526sd.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007170; classtype:social-engineering; sid:6007170; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bcfxdp.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bcfxdp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007171; classtype:social-engineering; sid:6007171; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whatsappweb-news.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whatsappweb-news.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007172; classtype:social-engineering; sid:6007172; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.brqwnptlzd.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.brqwnptlzd.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007173; classtype:social-engineering; sid:6007173; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (novachancesparatodos.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"novachancesparatodos.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007174; classtype:social-engineering; sid:6007174; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kuc.fmr-max789.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kuc.fmr-max789.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007175; classtype:social-engineering; sid:6007175; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gemini-balance.jiangqing.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gemini-balance.jiangqing.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007176; classtype:social-engineering; sid:6007176; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledhgych-zbch-9d62fe2cbd99.herokuapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledhgych-zbch-9d62fe2cbd99.herokuapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007177; classtype:social-engineering; sid:6007177; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (studio.kiinoasnacks.info/ga/click/2-9093787-10-8365-16357-8963-5da5843d04-e9be0325b5)"; flow:established,to_server; http.uri; content:"/ga/click/2-9093787-10-8365-16357-8963-5da5843d04-e9be0325b5"; startswith; fast_pattern; http.host; content:"studio.kiinoasnacks.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007178; classtype:social-engineering; sid:6007178; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bvnrzqtplx.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.bvnrzqtplx.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007179; classtype:social-engineering; sid:6007179; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwvv-roblox.co/users/1661825611/profile)"; flow:established,to_server; http.uri; content:"/users/1661825611/profile"; startswith; fast_pattern; http.host; content:"wwvv-roblox.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007180; classtype:social-engineering; sid:6007180; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gooddybucket444.s3.eu-north-1.amazonaws.com/alldomain_hab.html)"; flow:established,to_server; http.uri; content:"/alldomain_hab.html"; startswith; fast_pattern; http.host; content:"gooddybucket444.s3.eu-north-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007181; classtype:social-engineering; sid:6007181; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.santanderabogados.co/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.santanderabogados.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007182; classtype:social-engineering; sid:6007182; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parklngc.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parklngc.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007183; classtype:social-engineering; sid:6007183; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kplxqtmvrb.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kplxqtmvrb.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007184; classtype:social-engineering; sid:6007184; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.plxvqtrmzn.icu/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.plxvqtrmzn.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007185; classtype:social-engineering; sid:6007185; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amex-doc.short.gy/k2D7Dm/)"; flow:established,to_server; http.uri; content:"/k2D7Dm/"; startswith; fast_pattern; http.host; content:"amex-doc.short.gy"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007186; classtype:social-engineering; sid:6007186; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alert-esl.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"alert-esl.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007187; classtype:social-engineering; sid:6007187; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.camaradecomercioush.com.ar/gghnvd/)"; flow:established,to_server; http.uri; content:"/gghnvd/"; startswith; fast_pattern; http.host; content:"www.camaradecomercioush.com.ar"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007188; classtype:social-engineering; sid:6007188; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktifkaanpaylatters4.yzeb.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktifkaanpaylatters4.yzeb.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007189; classtype:social-engineering; sid:6007189; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atmaicwaslidz.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"atmaicwaslidz.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007190; classtype:social-engineering; sid:6007190; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (u17l.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"u17l.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007191; classtype:social-engineering; sid:6007191; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (g13u.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"g13u.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007192; classtype:social-engineering; sid:6007192; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ortan.ru/vendor/doctrine/vendor/verif2.php)"; flow:established,to_server; http.uri; content:"/vendor/doctrine/vendor/verif2.php"; startswith; fast_pattern; http.host; content:"ortan.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007193; classtype:social-engineering; sid:6007193; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f27o.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f27o.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007194; classtype:social-engineering; sid:6007194; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bvnwqrzply.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.bvnwqrzply.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007195; classtype:social-engineering; sid:6007195; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f27n.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f27n.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007196; classtype:social-engineering; sid:6007196; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mrvxqtplnc.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mrvxqtplnc.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007197; classtype:social-engineering; sid:6007197; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ortan.ru/vendor/doctrine/vendor/)"; flow:established,to_server; http.uri; content:"/vendor/doctrine/vendor/"; startswith; fast_pattern; http.host; content:"ortan.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007198; classtype:social-engineering; sid:6007198; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tsdnkx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tsdnkx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007199; classtype:social-engineering; sid:6007199; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pt-shopee7557.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"pt-shopee7557.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007200; classtype:social-engineering; sid:6007200; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqtmvlxpzr.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqtmvlxpzr.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007201; classtype:social-engineering; sid:6007201; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.empresas.terrazzanealmeida.com.br/.tmb/proses.php)"; flow:established,to_server; http.uri; content:"/.tmb/proses.php"; startswith; fast_pattern; http.host; content:"www.empresas.terrazzanealmeida.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007202; classtype:social-engineering; sid:6007202; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verification-azf.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"verification-azf.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007203; classtype:social-engineering; sid:6007203; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jplznwqtrm.icu/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jplznwqtrm.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007204; classtype:social-engineering; sid:6007204; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parklngx.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parklngx.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007205; classtype:social-engineering; sid:6007205; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sdytu.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sdytu.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007206; classtype:social-engineering; sid:6007206; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoja37.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoja37.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007207; classtype:social-engineering; sid:6007207; rev:1; metadata: signature_severity Major, created_et 2026_05_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cpanel.129-121-102-216.cprapid.com/signin?c_ds_na=RWNASBj7OYaJs5wY2lkPc38mpYlIBsPCEJGrZFjLP4&c_ds_no=%2A%2F%2A)"; flow:established,to_server; http.uri; content:"/signin?c_ds_na=RWNASBj7OYaJs5wY2lkPc38mpYlIBsPCEJGrZFjLP4&c_ds_no=%2A%2F%2A"; startswith; fast_pattern; http.host; content:"cpanel.129-121-102-216.cprapid.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007208; classtype:social-engineering; sid:6007208; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (h1cfjr47pth218.pages.dev/site4.sbisec.co.jp?_x_tr_sch&\;_x_tr_sl=monex&\;_x_tr_tl=ja)"; flow:established,to_server; http.uri; content:"/site4.sbisec.co.jp?_x_tr_sch&|3b|_x_tr_sl=monex&|3b|_x_tr_tl=ja"; startswith; fast_pattern; http.host; content:"h1cfjr47pth218.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007209; classtype:social-engineering; sid:6007209; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (545665654.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"545665654.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007210; classtype:social-engineering; sid:6007210; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klelnanzeigen-deutch.theorthogonist.com/receive/order/360)"; flow:established,to_server; http.uri; content:"/receive/order/360"; startswith; fast_pattern; http.host; content:"klelnanzeigen-deutch.theorthogonist.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007211; classtype:social-engineering; sid:6007211; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smartactionflow.com/corn/)"; flow:established,to_server; http.uri; content:"/corn/"; startswith; fast_pattern; http.host; content:"smartactionflow.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007212; classtype:social-engineering; sid:6007212; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klelnanzeigen-deutch.theorthogonist.com/receive/order/Xr01NFpFIiE?r=0x15&__cf_chl_rt_tk=sBdpZW6Fn0ufbd05DB5B4eqZFx1VOQwJgVKmTwhU59U-1779793569-1.0.1.1-N6MZMSztINr_rhz8lM7JspowzVQjVjuSjPyVDaQD7rs)"; flow:established,to_server; http.uri; content:"/receive/order/Xr01NFpFIiE?r=0x15&__cf_chl_rt_tk=sBdpZW6Fn0ufbd05DB5B4eqZFx1VOQwJgVKmTwhU59U-1779793569-1.0.1.1-N6MZMSztINr_rhz8lM7JspowzVQjVjuSjPyVDaQD7rs"; startswith; fast_pattern; http.host; content:"klelnanzeigen-deutch.theorthogonist.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007213; classtype:social-engineering; sid:6007213; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.aldero.com/en/aldero-industrial-supplies-product.php?id=%22%2F%3E%3Cimg%20src%3D%22https%3A%2F%2Fgoogle.com%2FEybwATgZSJEDL.jpg%22%20onerror%3D%22window.location%3DdecodeURIComponent%28atob%28%27Njg3NDc0NzA3MzNhMmYyZjZiNzc2YjYxNjg2OTZhNzM2YTJlNjM2MTM2NjEzODYyMzczNDJkMzMzMjYxNjMyZDM0MzU2NTYxMmQzODM0NjYzMDJkNjY2MjM2MzAzNzYyMzgzNzM4Mzk2MTYyMmU2MzZjNjk2MzZiMmYzNjM0NjM2NDY1MzAzNDMwMmQzMjMyMzMzNTJkMzQzNTYyNjUyZDYxMzM2NjM2MmQzNDY0NjM2NDM2NjMzODM4MzY2NDYyNjUyZTcwNjg3MA%3D%3D%27%29.replace%28%2F%28..%29%2Fg%2C%20%27%25%241%27%29%29%3B%22%3E)"; flow:established,to_server; http.uri; content:"/en/aldero-industrial-supplies-product.php?id=%22%2F%3E%3Cimg%20src%3D%22https%3A%2F%2Fgoogle.com%2FEybwATgZSJEDL.jpg%22%20onerror%3D%22window.location%3DdecodeURIComponent%28atob%28%27Njg3NDc0NzA3MzNhMmYyZjZiNzc2YjYxNjg2OTZhNzM2YTJlNjM2MTM2NjEzODYyMzczNDJkMzMzMjYxNjMyZDM0MzU2NTYxMmQzODM0NjYzMDJkNjY2MjM2MzAzNzYyMzgzNzM4Mzk2MTYyMmU2MzZjNjk2MzZiMmYzNjM0NjM2NDY1MzAzNDMwMmQzMjMyMzMzNTJkMzQzNTYyNjUyZDYxMzM2NjM2MmQzNDY0NjM2NDM2NjMzODM4MzY2NDYyNjUyZTcwNjg3MA%3D%3D%27%29.replace%28%2F%28..%29%2Fg%2C%20%27%25%241%27%29%29%3B%22%3E"; startswith; fast_pattern; http.host; content:"www.aldero.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007214; classtype:social-engineering; sid:6007214; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (disney.meinkonto-gmbh.com/captcha.php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"disney.meinkonto-gmbh.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007215; classtype:social-engineering; sid:6007215; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (startseite-xzooryrhl2.live-website.com/home/index.php)"; flow:established,to_server; http.uri; content:"/home/index.php"; startswith; fast_pattern; http.host; content:"startseite-xzooryrhl2.live-website.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007216; classtype:social-engineering; sid:6007216; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (posta-uwwkgc.com/UHK23rUOI.html?token=bXe3OqIR6htpr0BU&\;_v=1779797939730&\;_s=s2xnqxys3p)"; flow:established,to_server; http.uri; content:"/UHK23rUOI.html?token=bXe3OqIR6htpr0BU&|3b|_v=1779797939730&|3b|_s=s2xnqxys3p"; startswith; fast_pattern; http.host; content:"posta-uwwkgc.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007217; classtype:social-engineering; sid:6007217; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klelnanzeigen-deutch.desmoinestrailers.com/receive/order/06GCHhCCZka?r=0x14)"; flow:established,to_server; http.uri; content:"/receive/order/06GCHhCCZka?r=0x14"; startswith; fast_pattern; http.host; content:"klelnanzeigen-deutch.desmoinestrailers.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007218; classtype:social-engineering; sid:6007218; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.83dl.cn/home)"; flow:established,to_server; http.uri; content:"/home"; startswith; fast_pattern; http.host; content:"www.83dl.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007219; classtype:social-engineering; sid:6007219; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kunedenservice-pu1os37ybz.live-website.com/kundenservice/content/login.php)"; flow:established,to_server; http.uri; content:"/kundenservice/content/login.php"; startswith; fast_pattern; http.host; content:"kunedenservice-pu1os37ybz.live-website.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007220; classtype:social-engineering; sid:6007220; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (avalencia.com/wp-includes/assets/admin-red/)"; flow:established,to_server; http.uri; content:"/wp-includes/assets/admin-red/"; startswith; fast_pattern; http.host; content:"avalencia.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007221; classtype:social-engineering; sid:6007221; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (grupo-controles-whatsapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"grupo-controles-whatsapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007222; classtype:social-engineering; sid:6007222; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.web-git-03-30-fixwebrefactorscrollhandlingforpor-de5ef4-uniswap.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.web-git-03-30-fixwebrefactorscrollhandlingforpor-de5ef4-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007223; classtype:social-engineering; sid:6007223; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fine-follow-753626.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fine-follow-753626.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007224; classtype:social-engineering; sid:6007224; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (regitrate-credi-emprende.gt.tc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"regitrate-credi-emprende.gt.tc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007225; classtype:social-engineering; sid:6007225; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mybluecheck-verify-cpls.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mybluecheck-verify-cpls.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007226; classtype:social-engineering; sid:6007226; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pending-hotdoc-rf.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pending-hotdoc-rf.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007227; classtype:social-engineering; sid:6007227; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (forten.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"forten.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007228; classtype:social-engineering; sid:6007228; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vip3656w.com/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"vip3656w.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007229; classtype:social-engineering; sid:6007229; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bvxqtrmpla.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.bvxqtrmpla.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007230; classtype:social-engineering; sid:6007230; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16070.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16070.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007231; classtype:social-engineering; sid:6007231; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oxcsnetworksemail-qikxtfvd.4everland.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"oxcsnetworksemail-qikxtfvd.4everland.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007232; classtype:social-engineering; sid:6007232; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netsol-0twdj6dl.4everland.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netsol-0twdj6dl.4everland.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007233; classtype:social-engineering; sid:6007233; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (llk.qqk.mybluehost.me/KZP/log.php)"; flow:established,to_server; http.uri; content:"/KZP/log.php"; startswith; fast_pattern; http.host; content:"llk.qqk.mybluehost.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007234; classtype:social-engineering; sid:6007234; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rlzmb.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rlzmb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007235; classtype:social-engineering; sid:6007235; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.padisahbeetgir.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.padisahbeetgir.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007236; classtype:social-engineering; sid:6007236; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mustdygmuniserrrieue.org/login/fr/login.php)"; flow:established,to_server; http.uri; content:"/login/fr/login.php"; startswith; fast_pattern; http.host; content:"mustdygmuniserrrieue.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007237; classtype:social-engineering; sid:6007237; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (new-update-xfty.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"new-update-xfty.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007238; classtype:social-engineering; sid:6007238; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (crese-con-tu-aliado.xo.je/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"crese-con-tu-aliado.xo.je"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007239; classtype:social-engineering; sid:6007239; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faq-uphold-web-sso.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"faq-uphold-web-sso.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007240; classtype:social-engineering; sid:6007240; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (onbit.pro/29si4.pptx)"; flow:established,to_server; http.uri; content:"/29si4.pptx"; startswith; fast_pattern; http.host; content:"onbit.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007241; classtype:social-engineering; sid:6007241; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iqm-hgxp.wasmer.app/truelemon)"; flow:established,to_server; http.uri; content:"/truelemon"; startswith; fast_pattern; http.host; content:"iqm-hgxp.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007242; classtype:social-engineering; sid:6007242; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pt-shopee7557.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pt-shopee7557.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007243; classtype:social-engineering; sid:6007243; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rohith-santhosh.github.io/Amazon_Clone)"; flow:established,to_server; http.uri; content:"/Amazon_Clone"; startswith; fast_pattern; http.host; content:"rohith-santhosh.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007244; classtype:social-engineering; sid:6007244; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bet365-casinoau.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bet365-casinoau.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007245; classtype:social-engineering; sid:6007245; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bvxqtrmplx.icu/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.bvxqtrmplx.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007246; classtype:social-engineering; sid:6007246; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rax-fewqa.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rax-fewqa.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007247; classtype:social-engineering; sid:6007247; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kranthi-kumar-2004.github.io/demo2)"; flow:established,to_server; http.uri; content:"/demo2"; startswith; fast_pattern; http.host; content:"kranthi-kumar-2004.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007248; classtype:social-engineering; sid:6007248; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16055.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16055.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007249; classtype:social-engineering; sid:6007249; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prime-frvideo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"prime-frvideo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007250; classtype:social-engineering; sid:6007250; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sameer98176.github.io/apple-webiste)"; flow:established,to_server; http.uri; content:"/apple-webiste"; startswith; fast_pattern; http.host; content:"sameer98176.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007251; classtype:social-engineering; sid:6007251; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mybluecheck-verify-cpl.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mybluecheck-verify-cpl.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007252; classtype:social-engineering; sid:6007252; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parklngb.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parklngb.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007253; classtype:social-engineering; sid:6007253; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreibwb7r7akl53y6ck6b4oiswxkrch3hkodlyf6t576dyd5g33hhxji.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreibwb7r7akl53y6ck6b4oiswxkrch3hkodlyf6t576dyd5g33hhxji.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007254; classtype:social-engineering; sid:6007254; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jovial-hand-418359.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jovial-hand-418359.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007255; classtype:social-engineering; sid:6007255; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ldgr-live-io.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ldgr-live-io.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007256; classtype:social-engineering; sid:6007256; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portalcredensialonline.zya.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"portalcredensialonline.zya.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007257; classtype:social-engineering; sid:6007257; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hjelectrics.com/co/Korea.html)"; flow:established,to_server; http.uri; content:"/co/Korea.html"; startswith; fast_pattern; http.host; content:"hjelectrics.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007258; classtype:social-engineering; sid:6007258; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pending-hotdoc-rf.com/pages/login.php)"; flow:established,to_server; http.uri; content:"/pages/login.php"; startswith; fast_pattern; http.host; content:"pending-hotdoc-rf.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007259; classtype:social-engineering; sid:6007259; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (n3656vip.com/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"n3656vip.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007260; classtype:social-engineering; sid:6007260; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-sepia-nine.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-sepia-nine.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007261; classtype:social-engineering; sid:6007261; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lnpl705p01-godu14.p4eels.cfd/i/37xf1/1779725878274#selectedban)"; flow:established,to_server; http.uri; content:"/i/37xf1/1779725878274#selectedban"; startswith; fast_pattern; http.host; content:"lnpl705p01-godu14.p4eels.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007262; classtype:social-engineering; sid:6007262; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (renovacoestodosdias.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"renovacoestodosdias.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007263; classtype:social-engineering; sid:6007263; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deleted.protechmetafanpage.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"deleted.protechmetafanpage.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007264; classtype:social-engineering; sid:6007264; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jaenolimiti.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"jaenolimiti.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007265; classtype:social-engineering; sid:6007265; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ddndizzz.ibizcol.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ddndizzz.ibizcol.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007266; classtype:social-engineering; sid:6007266; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (subinsholiday.com//R7/Login/)"; flow:established,to_server; http.uri; content:"//R7/Login/"; startswith; fast_pattern; http.host; content:"subinsholiday.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007267; classtype:social-engineering; sid:6007267; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.nl-bet365.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.nl-bet365.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007268; classtype:social-engineering; sid:6007268; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (infoiss.com/Shaw2022service/)"; flow:established,to_server; http.uri; content:"/Shaw2022service/"; startswith; fast_pattern; http.host; content:"infoiss.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007269; classtype:social-engineering; sid:6007269; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pestapemenangshopee.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"pestapemenangshopee.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007270; classtype:social-engineering; sid:6007270; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hoangnguyen275.github.io/amazon-clone-website/)"; flow:established,to_server; http.uri; content:"/amazon-clone-website/"; startswith; fast_pattern; http.host; content:"hoangnguyen275.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007271; classtype:social-engineering; sid:6007271; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nutty-data-325734.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nutty-data-325734.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007272; classtype:social-engineering; sid:6007272; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cooinbase-pro_logn8.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cooinbase-pro_logn8.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007273; classtype:social-engineering; sid:6007273; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (padisahbet.casinobet-giris.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"padisahbet.casinobet-giris.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007274; classtype:social-engineering; sid:6007274; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pemenangshopee39.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"pemenangshopee39.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007275; classtype:social-engineering; sid:6007275; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16066.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16066.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007276; classtype:social-engineering; sid:6007276; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.wg4apccancelar.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.wg4apccancelar.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007277; classtype:social-engineering; sid:6007277; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hemlscrotaia.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hemlscrotaia.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007278; classtype:social-engineering; sid:6007278; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mg-hildisrieden.ch/KundenService1/index.php)"; flow:established,to_server; http.uri; content:"/KundenService1/index.php"; startswith; fast_pattern; http.host; content:"mg-hildisrieden.ch"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007279; classtype:social-engineering; sid:6007279; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nobukojapan.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nobukojapan.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007280; classtype:social-engineering; sid:6007280; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (servx-auth.s-drc2.cloud.gcore.lu/mrw/inte.html)"; flow:established,to_server; http.uri; content:"/mrw/inte.html"; startswith; fast_pattern; http.host; content:"servx-auth.s-drc2.cloud.gcore.lu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007281; classtype:social-engineering; sid:6007281; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (swami-ram.github.io/amazon)"; flow:established,to_server; http.uri; content:"/amazon"; startswith; fast_pattern; http.host; content:"swami-ram.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007282; classtype:social-engineering; sid:6007282; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.robloxc.cam/share?code=94050746079446129028163405338943&gameid=16116270224&source=ProfileShare&type=Profile)"; flow:established,to_server; http.uri; content:"/share?code=94050746079446129028163405338943&gameid=16116270224&source=ProfileShare&type=Profile"; startswith; fast_pattern; http.host; content:"www.robloxc.cam"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007283; classtype:social-engineering; sid:6007283; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spectacular-bookings-101872.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spectacular-bookings-101872.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007284; classtype:social-engineering; sid:6007284; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (news.agenziaesattoriale.it/?rid=LlFXcfQ)"; flow:established,to_server; http.uri; content:"/?rid=LlFXcfQ"; startswith; fast_pattern; http.host; content:"news.agenziaesattoriale.it"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007285; classtype:social-engineering; sid:6007285; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alegosel.eu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"alegosel.eu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007286; classtype:social-engineering; sid:6007286; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16061.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16061.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007287; classtype:social-engineering; sid:6007287; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (saibo110aa.com:8989/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"saibo110aa.com:8989"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007288; classtype:social-engineering; sid:6007288; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.fqplwrnqto.cloud/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.fqplwrnqto.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007289; classtype:social-engineering; sid:6007289; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (demtrestnunmain.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"demtrestnunmain.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007290; classtype:social-engineering; sid:6007290; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth-dhl-shipping-eight.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auth-dhl-shipping-eight.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007291; classtype:social-engineering; sid:6007291; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appweb-online-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"appweb-online-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007292; classtype:social-engineering; sid:6007292; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (codexygaurav.github.io/Amazon-clone)"; flow:established,to_server; http.uri; content:"/Amazon-clone"; startswith; fast_pattern; http.host; content:"codexygaurav.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007293; classtype:social-engineering; sid:6007293; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16077.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16077.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007294; classtype:social-engineering; sid:6007294; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netmirr.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netmirr.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007295; classtype:social-engineering; sid:6007295; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.545665654.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.545665654.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007296; classtype:social-engineering; sid:6007296; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.01122200.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.01122200.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007297; classtype:social-engineering; sid:6007297; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.3643622835.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.3643622835.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007298; classtype:social-engineering; sid:6007298; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (security-server-page--andydickssonahs.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"security-server-page--andydickssonahs.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007299; classtype:social-engineering; sid:6007299; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kistok.com/sherris/)"; flow:established,to_server; http.uri; content:"/sherris/"; startswith; fast_pattern; http.host; content:"www.kistok.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007300; classtype:social-engineering; sid:6007300; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (biiiing.at/?r=ba6269e1-366b-495e-b655-fc1e573abea2&rg=eu)"; flow:established,to_server; http.uri; content:"/?r=ba6269e1-366b-495e-b655-fc1e573abea2&rg=eu"; startswith; fast_pattern; http.host; content:"biiiing.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007301; classtype:social-engineering; sid:6007301; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebooktechnicalsupportnumber123.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebooktechnicalsupportnumber123.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007302; classtype:social-engineering; sid:6007302; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (awsapprunner.standard.us-east-1.oortstorages.com/us-east-m12.awsapprunner.com)"; flow:established,to_server; http.uri; content:"/us-east-m12.awsapprunner.com"; startswith; fast_pattern; http.host; content:"awsapprunner.standard.us-east-1.oortstorages.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007303; classtype:social-engineering; sid:6007303; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (infura-ipfs.io/ipfs/bafkreiajhospkgsegtnkh7hoht4nobuc4hhgklxbihvm4lbqj2dwqkgchi)"; flow:established,to_server; http.uri; content:"/ipfs/bafkreiajhospkgsegtnkh7hoht4nobuc4hhgklxbihvm4lbqj2dwqkgchi"; startswith; fast_pattern; http.host; content:"infura-ipfs.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007304; classtype:social-engineering; sid:6007304; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.666666213489437.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.666666213489437.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007305; classtype:social-engineering; sid:6007305; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.location.tjcszy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.location.tjcszy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007306; classtype:social-engineering; sid:6007306; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maimunasabir.github.io/Amazon-Clone)"; flow:established,to_server; http.uri; content:"/Amazon-Clone"; startswith; fast_pattern; http.host; content:"maimunasabir.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007307; classtype:social-engineering; sid:6007307; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4879283.s3.us-east-2.amazonaws.com/83762683839223.html)"; flow:established,to_server; http.uri; content:"/83762683839223.html"; startswith; fast_pattern; http.host; content:"4879283.s3.us-east-2.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007308; classtype:social-engineering; sid:6007308; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (surajsahu26.github.io/Amazon-clone)"; flow:established,to_server; http.uri; content:"/Amazon-clone"; startswith; fast_pattern; http.host; content:"surajsahu26.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007309; classtype:social-engineering; sid:6007309; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.robux90k.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.robux90k.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007310; classtype:social-engineering; sid:6007310; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (r3novacion365.web1337.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"r3novacion365.web1337.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007311; classtype:social-engineering; sid:6007311; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (specific-page-387363.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"specific-page-387363.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007312; classtype:social-engineering; sid:6007312; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16083.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16083.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007313; classtype:social-engineering; sid:6007313; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ayodejiojooba-ux.github.io/facebook-login-clone/)"; flow:established,to_server; http.uri; content:"/facebook-login-clone/"; startswith; fast_pattern; http.host; content:"ayodejiojooba-ux.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007314; classtype:social-engineering; sid:6007314; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365verifica.fwh.is/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"365verifica.fwh.is"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007315; classtype:social-engineering; sid:6007315; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bybit-exchange.github.io/docs/v5/user/page-subuid)"; flow:established,to_server; http.uri; content:"/docs/v5/user/page-subuid"; startswith; fast_pattern; http.host; content:"bybit-exchange.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007316; classtype:social-engineering; sid:6007316; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (streamcami.net/index.php?lang=en)"; flow:established,to_server; http.uri; content:"/index.php?lang=en"; startswith; fast_pattern; http.host; content:"streamcami.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007317; classtype:social-engineering; sid:6007317; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my.7-11.com.basery.top/cart?id=2386)"; flow:established,to_server; http.uri; content:"/cart?id=2386"; startswith; fast_pattern; http.host; content:"my.7-11.com.basery.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007318; classtype:social-engineering; sid:6007318; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tjaoyk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tjaoyk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007319; classtype:social-engineering; sid:6007319; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dizzy-future-601701.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dizzy-future-601701.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007320; classtype:social-engineering; sid:6007320; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.auth-dhl-shipping-eight.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.auth-dhl-shipping-eight.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007321; classtype:social-engineering; sid:6007321; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tjaoyk.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.tjaoyk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007322; classtype:social-engineering; sid:6007322; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9-160-105-19.cprapid.com/de/)"; flow:established,to_server; http.uri; content:"/de/"; startswith; fast_pattern; http.host; content:"9-160-105-19.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007323; classtype:social-engineering; sid:6007323; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebooktechnicalsupportnumber123.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebooktechnicalsupportnumber123.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007324; classtype:social-engineering; sid:6007324; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (northernlighting.ca/herme)"; flow:established,to_server; http.uri; content:"/herme"; startswith; fast_pattern; http.host; content:"northernlighting.ca"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007325; classtype:social-engineering; sid:6007325; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (conbaseu-logrn.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"conbaseu-logrn.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007326; classtype:social-engineering; sid:6007326; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trxweb3.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trxweb3.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007327; classtype:social-engineering; sid:6007327; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mybluecheck-verify-compls.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mybluecheck-verify-compls.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007328; classtype:social-engineering; sid:6007328; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parklngm.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parklngm.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007329; classtype:social-engineering; sid:6007329; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (steamcommumnmity.com/tradeoffer/new/partner=04413852token=w6ttqnGS51009)"; flow:established,to_server; http.uri; content:"/tradeoffer/new/partner=04413852token=w6ttqnGS51009"; startswith; fast_pattern; http.host; content:"steamcommumnmity.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007330; classtype:social-engineering; sid:6007330; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acn-awards.com/01KSGW6T15DQDEAHF3WEF50EA8)"; flow:established,to_server; http.uri; content:"/01KSGW6T15DQDEAHF3WEF50EA8"; startswith; fast_pattern; http.host; content:"acn-awards.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007331; classtype:social-engineering; sid:6007331; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m4nasw1.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"m4nasw1.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007332; classtype:social-engineering; sid:6007332; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aj3ql8ofrsgmpwpt-bbb0nnom2nwsyv552carnn.vercel.app/fgs45hbnsdf3hsdsry7uj6sdgf)"; flow:established,to_server; http.uri; content:"/fgs45hbnsdf3hsdsry7uj6sdgf"; startswith; fast_pattern; http.host; content:"aj3ql8ofrsgmpwpt-bbb0nnom2nwsyv552carnn.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007333; classtype:social-engineering; sid:6007333; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chase.pcj-group.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"chase.pcj-group.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007334; classtype:social-engineering; sid:6007334; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (baxizai.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"baxizai.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007335; classtype:social-engineering; sid:6007335; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kkuiionlog-iim.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kkuiionlog-iim.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007336; classtype:social-engineering; sid:6007336; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3656766.com/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"3656766.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007337; classtype:social-engineering; sid:6007337; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3643622835.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3643622835.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007338; classtype:social-engineering; sid:6007338; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmailkthsenew.us-iad-10.linodeobjects.com/kthse.html?%7Bmd5%7D)"; flow:established,to_server; http.uri; content:"/kthse.html?%7Bmd5%7D"; startswith; fast_pattern; http.host; content:"webmailkthsenew.us-iad-10.linodeobjects.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007339; classtype:social-engineering; sid:6007339; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.diwmfimefkefe.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.diwmfimefkefe.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007340; classtype:social-engineering; sid:6007340; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bybit8.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bybit8.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007341; classtype:social-engineering; sid:6007341; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aj3ql8ofrsgmpwpt-bbb0nnom2nwsyv552carnn.vercel.app/fgs45hbnsdf3hsdsry7uj6sdgf.html)"; flow:established,to_server; http.uri; content:"/fgs45hbnsdf3hsdsry7uj6sdgf.html"; startswith; fast_pattern; http.host; content:"aj3ql8ofrsgmpwpt-bbb0nnom2nwsyv552carnn.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007342; classtype:social-engineering; sid:6007342; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f005.backblazeb2.com/b2api/v1/b2_download_file_by_id?fileId=4_z9de51dcfcd4a551e96e50712_f103b93e7241420d5_d20260525_m134159_c005_v0501008_t0009_u01779716519576)"; flow:established,to_server; http.uri; content:"/b2api/v1/b2_download_file_by_id?fileId=4_z9de51dcfcd4a551e96e50712_f103b93e7241420d5_d20260525_m134159_c005_v0501008_t0009_u01779716519576"; startswith; fast_pattern; http.host; content:"f005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007343; classtype:social-engineering; sid:6007343; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sore-indigo-cf1xx4cwja.edgeone.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sore-indigo-cf1xx4cwja.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007344; classtype:social-engineering; sid:6007344; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-clone-sepia-nine.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-sepia-nine.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007345; classtype:social-engineering; sid:6007345; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paypaypay.cards/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paypaypay.cards"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007346; classtype:social-engineering; sid:6007346; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (satisfied-trip-575716.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"satisfied-trip-575716.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007347; classtype:social-engineering; sid:6007347; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hjjg.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hjjg.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007348; classtype:social-engineering; sid:6007348; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoja31.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoja31.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007349; classtype:social-engineering; sid:6007349; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mettaum-miskelgin8.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mettaum-miskelgin8.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007350; classtype:social-engineering; sid:6007350; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazing-dusk-c118b7.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazing-dusk-c118b7.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007351; classtype:social-engineering; sid:6007351; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (buksh-alee.github.io/azan)"; flow:established,to_server; http.uri; content:"/azan"; startswith; fast_pattern; http.host; content:"buksh-alee.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007352; classtype:social-engineering; sid:6007352; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lakshya0736.github.io/Netflix_Clone)"; flow:established,to_server; http.uri; content:"/Netflix_Clone"; startswith; fast_pattern; http.host; content:"lakshya0736.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007353; classtype:social-engineering; sid:6007353; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trannnhoulanasopa.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trannnhoulanasopa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007354; classtype:social-engineering; sid:6007354; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9-160-105-19.cprapid.com/de/update.php?ziwpbmnaztw6rgn1w5ft)"; flow:established,to_server; http.uri; content:"/de/update.php?ziwpbmnaztw6rgn1w5ft"; startswith; fast_pattern; http.host; content:"9-160-105-19.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007355; classtype:social-engineering; sid:6007355; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rss3.readles.at/go/y2c4w274/y274x274)"; flow:established,to_server; http.uri; content:"/go/y2c4w274/y274x274"; startswith; fast_pattern; http.host; content:"rss3.readles.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007356; classtype:social-engineering; sid:6007356; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (document-n004.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"document-n004.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007357; classtype:social-engineering; sid:6007357; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wertyuioiuyt.shop/Wetranfer/Share-Files/wetrlists.html?email=salumz@87ac74f90e236f49b2dcb2d3139ef07ea1e6.net)"; flow:established,to_server; http.uri; content:"/Wetranfer/Share-Files/wetrlists.html?email=salumz@87ac74f90e236f49b2dcb2d3139ef07ea1e6.net"; startswith; fast_pattern; http.host; content:"wertyuioiuyt.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007358; classtype:social-engineering; sid:6007358; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rudrapatel7100.github.io/Amazon_ui)"; flow:established,to_server; http.uri; content:"/Amazon_ui"; startswith; fast_pattern; http.host; content:"rudrapatel7100.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007359; classtype:social-engineering; sid:6007359; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (die-swiss.bolt.host/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"die-swiss.bolt.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007360; classtype:social-engineering; sid:6007360; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (u3656vip.com/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"u3656vip.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007361; classtype:social-engineering; sid:6007361; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bbigches.com/Shaw2022service/)"; flow:established,to_server; http.uri; content:"/Shaw2022service/"; startswith; fast_pattern; http.host; content:"bbigches.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007362; classtype:social-engineering; sid:6007362; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vip3656m.com/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"vip3656m.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007363; classtype:social-engineering; sid:6007363; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (golink.id/roblox-com-games-2753549-Fisch-privateserverlinkcode-812315421565488816512365546)"; flow:established,to_server; http.uri; content:"/roblox-com-games-2753549-Fisch-privateserverlinkcode-812315421565488816512365546"; startswith; fast_pattern; http.host; content:"golink.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007364; classtype:social-engineering; sid:6007364; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (novasconsultas.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"novasconsultas.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007365; classtype:social-engineering; sid:6007365; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.lighousconsulting.com/Shaw2022service/)"; flow:established,to_server; http.uri; content:"/Shaw2022service/"; startswith; fast_pattern; http.host; content:"www.lighousconsulting.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007366; classtype:social-engineering; sid:6007366; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (akankshanetkar-ux.github.io/Amazon-Clone)"; flow:established,to_server; http.uri; content:"/Amazon-Clone"; startswith; fast_pattern; http.host; content:"akankshanetkar-ux.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007367; classtype:social-engineering; sid:6007367; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.0991saibo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.0991saibo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007368; classtype:social-engineering; sid:6007368; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mustdygmuniserrrieue.org/login/index.php?id=KQ5sMk70KQa5czj9oxfkQOjpg6f0RVzsU614XXgWmwUuXnK9PiJnnjZX7BEBaeVAVLgD8bOdN649gThjjgAH75c5m&token=zAInsBzcB1qcALcVldOIBWWxLjLAXeiGhGXxtnabsZ69hxABIHAM7tCyPqV3TVK13psehHlUPjf42shd4mvMbh1c8dWbJfYecK)"; flow:established,to_server; http.uri; content:"/login/index.php?id=KQ5sMk70KQa5czj9oxfkQOjpg6f0RVzsU614XXgWmwUuXnK9PiJnnjZX7BEBaeVAVLgD8bOdN649gThjjgAH75c5m&token=zAInsBzcB1qcALcVldOIBWWxLjLAXeiGhGXxtnabsZ69hxABIHAM7tCyPqV3TVK13psehHlUPjf42shd4mvMbh1c8dWbJfYecK"; startswith; fast_pattern; http.host; content:"mustdygmuniserrrieue.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007369; classtype:social-engineering; sid:6007369; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (online-appweb-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"online-appweb-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007370; classtype:social-engineering; sid:6007370; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (polanimachines.com/kr/invoice_kr.html)"; flow:established,to_server; http.uri; content:"/kr/invoice_kr.html"; startswith; fast_pattern; http.host; content:"polanimachines.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007371; classtype:social-engineering; sid:6007371; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3656v5.com/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"3656v5.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007372; classtype:social-engineering; sid:6007372; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16068.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16068.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007373; classtype:social-engineering; sid:6007373; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prime-frvideo.com/captcha.php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"prime-frvideo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007374; classtype:social-engineering; sid:6007374; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eworku2024-alt.github.io/apple-clone/)"; flow:established,to_server; http.uri; content:"/apple-clone/"; startswith; fast_pattern; http.host; content:"eworku2024-alt.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007375; classtype:social-engineering; sid:6007375; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adarshpanchal.github.io/netfllix-clone)"; flow:established,to_server; http.uri; content:"/netfllix-clone"; startswith; fast_pattern; http.host; content:"adarshpanchal.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007376; classtype:social-engineering; sid:6007376; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tejalmca202588-rgb.github.io/my-website)"; flow:established,to_server; http.uri; content:"/my-website"; startswith; fast_pattern; http.host; content:"tejalmca202588-rgb.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007377; classtype:social-engineering; sid:6007377; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b7dlgxvbswqj8uvie4o.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b7dlgxvbswqj8uvie4o.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007378; classtype:social-engineering; sid:6007378; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (llk.qqk.mybluehost.me/KZP/index.php)"; flow:established,to_server; http.uri; content:"/KZP/index.php"; startswith; fast_pattern; http.host; content:"llk.qqk.mybluehost.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007379; classtype:social-engineering; sid:6007379; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spotlstreamingonline.sviluppo.host/QAZCVBNMJKLLGFDSSFH/ZABIESSHGDSDNGGNNNNHRMUT/auth/login.php)"; flow:established,to_server; http.uri; content:"/QAZCVBNMJKLLGFDSSFH/ZABIESSHGDSDNGGNNNNHRMUT/auth/login.php"; startswith; fast_pattern; http.host; content:"spotlstreamingonline.sviluppo.host"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007380; classtype:social-engineering; sid:6007380; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (unired-ca.top/cl)"; flow:established,to_server; http.uri; content:"/cl"; startswith; fast_pattern; http.host; content:"unired-ca.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007381; classtype:social-engineering; sid:6007381; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (notadocumentcsn.alwaysdata.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"notadocumentcsn.alwaysdata.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007382; classtype:social-engineering; sid:6007382; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vnj.cfl.mybluehost.me/AG/DKB/)"; flow:established,to_server; http.uri; content:"/AG/DKB/"; startswith; fast_pattern; http.host; content:"vnj.cfl.mybluehost.me"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007383; classtype:social-engineering; sid:6007383; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-ab4d230c757644f882096516863cf8f2.r2.dev/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-ab4d230c757644f882096516863cf8f2.r2.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007384; classtype:social-engineering; sid:6007384; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mailsystempage.pages.dev/Free_email)"; flow:established,to_server; http.uri; content:"/Free_email"; startswith; fast_pattern; http.host; content:"mailsystempage.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007385; classtype:social-engineering; sid:6007385; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chirno.grv846316.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"chirno.grv846316.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007386; classtype:social-engineering; sid:6007386; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (internacional.zufsu.com/ec)"; flow:established,to_server; http.uri; content:"/ec"; startswith; fast_pattern; http.host; content:"internacional.zufsu.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007387; classtype:social-engineering; sid:6007387; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anteloper-hj72j.ondigitalocean.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"anteloper-hj72j.ondigitalocean.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007388; classtype:social-engineering; sid:6007388; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.maivangdaycare.com/263c607d-1759-4b2c-8ff5-3adb9ac3de7b)"; flow:established,to_server; http.uri; content:"/263c607d-1759-4b2c-8ff5-3adb9ac3de7b"; startswith; fast_pattern; http.host; content:"www.maivangdaycare.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007389; classtype:social-engineering; sid:6007389; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pimco-drk.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pimco-drk.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007390; classtype:social-engineering; sid:6007390; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.uriwac.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.uriwac.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007391; classtype:social-engineering; sid:6007391; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vqxpltrmzk.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.vqxpltrmzk.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007392; classtype:social-engineering; sid:6007392; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nimra13045.github.io/Amazon-project)"; flow:established,to_server; http.uri; content:"/Amazon-project"; startswith; fast_pattern; http.host; content:"nimra13045.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007393; classtype:social-engineering; sid:6007393; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cm.in.th/.tmb/proses2.php)"; flow:established,to_server; http.uri; content:"/.tmb/proses2.php"; startswith; fast_pattern; http.host; content:"cm.in.th"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007394; classtype:social-engineering; sid:6007394; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.doiwlg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.doiwlg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007395; classtype:social-engineering; sid:6007395; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aboutmattlaw.github.io/payment-methods-prototype/)"; flow:established,to_server; http.uri; content:"/payment-methods-prototype/"; startswith; fast_pattern; http.host; content:"aboutmattlaw.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007396; classtype:social-engineering; sid:6007396; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.xpj18960.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.xpj18960.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007397; classtype:social-engineering; sid:6007397; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-taupe-two.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-taupe-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007398; classtype:social-engineering; sid:6007398; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (de-trusted.net/?rid=ZVY0exr)"; flow:established,to_server; http.uri; content:"/?rid=ZVY0exr"; startswith; fast_pattern; http.host; content:"de-trusted.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007399; classtype:social-engineering; sid:6007399; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.grlbtn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.grlbtn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007400; classtype:social-engineering; sid:6007400; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dervi-credi-pichincha.page.gd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dervi-credi-pichincha.page.gd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007401; classtype:social-engineering; sid:6007401; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m18b.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m18b.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007402; classtype:social-engineering; sid:6007402; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gestionregtrodtosht.fwh.is/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"gestionregtrodtosht.fwh.is"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007403; classtype:social-engineering; sid:6007403; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kwrpsu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kwrpsu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007404; classtype:social-engineering; sid:6007404; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metainslagram.github.io/inslagram)"; flow:established,to_server; http.uri; content:"/inslagram"; startswith; fast_pattern; http.host; content:"metainslagram.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007405; classtype:social-engineering; sid:6007405; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1862.ee/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1862.ee"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007406; classtype:social-engineering; sid:6007406; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tplxrmqzvn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tplxrmqzvn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007407; classtype:social-engineering; sid:6007407; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gqudbk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gqudbk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007408; classtype:social-engineering; sid:6007408; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (understanding-topic-369832.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"understanding-topic-369832.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007409; classtype:social-engineering; sid:6007409; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.luxegeer.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.luxegeer.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007410; classtype:social-engineering; sid:6007410; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9-160-161-38.cprapid.com/eu/track.php?1mh033elmmk40huk2r1f)"; flow:established,to_server; http.uri; content:"/eu/track.php?1mh033elmmk40huk2r1f"; startswith; fast_pattern; http.host; content:"9-160-161-38.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007411; classtype:social-engineering; sid:6007411; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (demo-dd-login.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"demo-dd-login.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007412; classtype:social-engineering; sid:6007412; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.snaply-git-main-khadir-salims-projects.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.snaply-git-main-khadir-salims-projects.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007413; classtype:social-engineering; sid:6007413; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rkxmfg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rkxmfg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007414; classtype:social-engineering; sid:6007414; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ochbjk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ochbjk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007415; classtype:social-engineering; sid:6007415; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (insert-trezorr-hardware-cloud-wallet.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"insert-trezorr-hardware-cloud-wallet.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007416; classtype:social-engineering; sid:6007416; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.uzithv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.uzithv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007417; classtype:social-engineering; sid:6007417; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gmcqku.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gmcqku.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007418; classtype:social-engineering; sid:6007418; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ztarcm.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ztarcm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007419; classtype:social-engineering; sid:6007419; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.loiczg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.loiczg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007420; classtype:social-engineering; sid:6007420; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.sxuhlt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.sxuhlt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007421; classtype:social-engineering; sid:6007421; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.k67f.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.k67f.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007422; classtype:social-engineering; sid:6007422; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parklngv.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parklngv.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007423; classtype:social-engineering; sid:6007423; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (durstone-tech.com/ap/signin)"; flow:established,to_server; http.uri; content:"/ap/signin"; startswith; fast_pattern; http.host; content:"durstone-tech.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007424; classtype:social-engineering; sid:6007424; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nbylsj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nbylsj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007425; classtype:social-engineering; sid:6007425; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.alexa.abductist.duckdns.org:443/alexa.amazon.com/about)"; flow:established,to_server; http.uri; content:"/alexa.amazon.com/about"; startswith; fast_pattern; http.host; content:"login.alexa.abductist.duckdns.org:443"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007426; classtype:social-engineering; sid:6007426; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jjake001.github.io/microsoftoffice/)"; flow:established,to_server; http.uri; content:"/microsoftoffice/"; startswith; fast_pattern; http.host; content:"jjake001.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007427; classtype:social-engineering; sid:6007427; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cm.in.th/.tmb/proses3.php)"; flow:established,to_server; http.uri; content:"/.tmb/proses3.php"; startswith; fast_pattern; http.host; content:"cm.in.th"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007428; classtype:social-engineering; sid:6007428; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tbpdge.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tbpdge.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007429; classtype:social-engineering; sid:6007429; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.matamak-sex-logi.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.matamak-sex-logi.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007430; classtype:social-engineering; sid:6007430; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tugjek.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tugjek.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007431; classtype:social-engineering; sid:6007431; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mitkcz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mitkcz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007432; classtype:social-engineering; sid:6007432; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.b28m.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.b28m.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007433; classtype:social-engineering; sid:6007433; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortnitev.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortnitev.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007434; classtype:social-engineering; sid:6007434; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.surl.li/zvysxc/)"; flow:established,to_server; http.uri; content:"/zvysxc/"; startswith; fast_pattern; http.host; content:"www.surl.li"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007435; classtype:social-engineering; sid:6007435; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (monia1801.github.io/Amazon_clone/)"; flow:established,to_server; http.uri; content:"/Amazon_clone/"; startswith; fast_pattern; http.host; content:"monia1801.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007436; classtype:social-engineering; sid:6007436; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqznpl.ink/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqznpl.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007437; classtype:social-engineering; sid:6007437; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coiuboseprxlugix.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coiuboseprxlugix.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007438; classtype:social-engineering; sid:6007438; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kqnwzp.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kqnwzp.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007439; classtype:social-engineering; sid:6007439; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xqtrmvplzk.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xqtrmvplzk.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007440; classtype:social-engineering; sid:6007440; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tplxqvrmzn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tplxqvrmzn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007441; classtype:social-engineering; sid:6007441; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vrmztqplxn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.vrmztqplxn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007442; classtype:social-engineering; sid:6007442; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.elite-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.elite-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007443; classtype:social-engineering; sid:6007443; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (worthy-pentagon-845762.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"worthy-pentagon-845762.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007444; classtype:social-engineering; sid:6007444; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tafsmk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tafsmk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007445; classtype:social-engineering; sid:6007445; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.qtrzplvmxn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.qtrzplvmxn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007446; classtype:social-engineering; sid:6007446; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imajinandfusion.com/iafp)"; flow:established,to_server; http.uri; content:"/iafp"; startswith; fast_pattern; http.host; content:"imajinandfusion.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007447; classtype:social-engineering; sid:6007447; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appchat-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"appchat-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007448; classtype:social-engineering; sid:6007448; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ilxdcw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ilxdcw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007449; classtype:social-engineering; sid:6007449; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kzuhoy.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kzuhoy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007450; classtype:social-engineering; sid:6007450; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ulzbdq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ulzbdq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007451; classtype:social-engineering; sid:6007451; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tricky-clicks-320788.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tricky-clicks-320788.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007452; classtype:social-engineering; sid:6007452; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cm.in.th/.tmb/?/p/service.meta-noreply.com/account/login=)"; flow:established,to_server; http.uri; content:"/.tmb/?/p/service.meta-noreply.com/account/login="; startswith; fast_pattern; http.host; content:"cm.in.th"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007453; classtype:social-engineering; sid:6007453; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (saibovip12.cc:8989/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"saibovip12.cc:8989"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007454; classtype:social-engineering; sid:6007454; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (statuesque-cannoli-79b5fb.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"statuesque-cannoli-79b5fb.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007455; classtype:social-engineering; sid:6007455; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3656922.com/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"3656922.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007456; classtype:social-engineering; sid:6007456; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedagiodigital.xo.je/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"pedagiodigital.xo.je"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007457; classtype:social-engineering; sid:6007457; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflixclone-ui.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflixclone-ui.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007458; classtype:social-engineering; sid:6007458; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (famila.x10.mx/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"famila.x10.mx"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007459; classtype:social-engineering; sid:6007459; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ship-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ship-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007460; classtype:social-engineering; sid:6007460; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (diyaagrawal495.github.io/css-htmlproject2/)"; flow:established,to_server; http.uri; content:"/css-htmlproject2/"; startswith; fast_pattern; http.host; content:"diyaagrawal495.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007461; classtype:social-engineering; sid:6007461; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mitha-imascko-llgin.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mitha-imascko-llgin.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007462; classtype:social-engineering; sid:6007462; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metai-iau-mskmask-logijin.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metai-iau-mskmask-logijin.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007463; classtype:social-engineering; sid:6007463; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nhiupz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nhiupz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007464; classtype:social-engineering; sid:6007464; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zfcaki.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zfcaki.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007465; classtype:social-engineering; sid:6007465; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (destraveseupotencial.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"destraveseupotencial.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007466; classtype:social-engineering; sid:6007466; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-mushkglog.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta-mushkglog.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007467; classtype:social-engineering; sid:6007467; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (snaply-git-main-khadir-salims-projects.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"snaply-git-main-khadir-salims-projects.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007468; classtype:social-engineering; sid:6007468; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robloxn.cam/users/559211103/profile)"; flow:established,to_server; http.uri; content:"/users/559211103/profile"; startswith; fast_pattern; http.host; content:"robloxn.cam"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007469; classtype:social-engineering; sid:6007469; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nmufbr.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nmufbr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007470; classtype:social-engineering; sid:6007470; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lgnvok.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lgnvok.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007471; classtype:social-engineering; sid:6007471; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5456656.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"5456656.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007472; classtype:social-engineering; sid:6007472; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (certificates-nathan-timber-lifetime.trycloudflare.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"certificates-nathan-timber-lifetime.trycloudflare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007473; classtype:social-engineering; sid:6007473; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.biradarswapnilproject.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.biradarswapnilproject.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007474; classtype:social-engineering; sid:6007474; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.new-update-xfty.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.new-update-xfty.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007475; classtype:social-engineering; sid:6007475; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.meta-mushkglog.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.meta-mushkglog.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007476; classtype:social-engineering; sid:6007476; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-voiceservice-juno-com.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"account-voiceservice-juno-com.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007477; classtype:social-engineering; sid:6007477; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (krakenllogins.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"krakenllogins.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007478; classtype:social-engineering; sid:6007478; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gemniclogic_officaa.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.gemniclogic_officaa.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007479; classtype:social-engineering; sid:6007479; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (preocupacaoacaboumelhoriaja.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"preocupacaoacaboumelhoriaja.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007480; classtype:social-engineering; sid:6007480; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.surl.li/egyzch/)"; flow:established,to_server; http.uri; content:"/egyzch/"; startswith; fast_pattern; http.host; content:"www.surl.li"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007481; classtype:social-engineering; sid:6007481; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dqbtjg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dqbtjg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007482; classtype:social-engineering; sid:6007482; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atharvanagvekar18-coder.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"atharvanagvekar18-coder.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007483; classtype:social-engineering; sid:6007483; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.edtmnw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.edtmnw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007484; classtype:social-engineering; sid:6007484; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tbxpsm.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tbxpsm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007485; classtype:social-engineering; sid:6007485; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www-att-bellsouth-verifier-a77c5f.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www-att-bellsouth-verifier-a77c5f.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007486; classtype:social-engineering; sid:6007486; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jklhuo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jklhuo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007487; classtype:social-engineering; sid:6007487; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lucky-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lucky-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007488; classtype:social-engineering; sid:6007488; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my-messaging.com/?uuid=X3QfaB2)"; flow:established,to_server; http.uri; content:"/?uuid=X3QfaB2"; startswith; fast_pattern; http.host; content:"my-messaging.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007489; classtype:social-engineering; sid:6007489; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atlascapitalsolutions.sg/Crewsinsure)"; flow:established,to_server; http.uri; content:"/Crewsinsure"; startswith; fast_pattern; http.host; content:"atlascapitalsolutions.sg"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007490; classtype:social-engineering; sid:6007490; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zxirwq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zxirwq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007491; classtype:social-engineering; sid:6007491; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cm.in.th/.tmb/verif1.php)"; flow:established,to_server; http.uri; content:"/.tmb/verif1.php"; startswith; fast_pattern; http.host; content:"cm.in.th"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007492; classtype:social-engineering; sid:6007492; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (melhoriasemprealcance.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"melhoriasemprealcance.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007493; classtype:social-engineering; sid:6007493; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reandsy.github.io/ATTACHEDMENT/Pushase%20Projects%20PTY%20LTD)"; flow:established,to_server; http.uri; content:"/ATTACHEDMENT/Pushase%20Projects%20PTY%20LTD"; startswith; fast_pattern; http.host; content:"reandsy.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007494; classtype:social-engineering; sid:6007494; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (salman-developer-747757.github.io/Amazon-clone)"; flow:established,to_server; http.uri; content:"/Amazon-clone"; startswith; fast_pattern; http.host; content:"salman-developer-747757.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007495; classtype:social-engineering; sid:6007495; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apgamin.github.io/Amazon/)"; flow:established,to_server; http.uri; content:"/Amazon/"; startswith; fast_pattern; http.host; content:"apgamin.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007496; classtype:social-engineering; sid:6007496; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (validecgobec.iceiy.com/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"validecgobec.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007497; classtype:social-engineering; sid:6007497; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.icroxw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.icroxw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007498; classtype:social-engineering; sid:6007498; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fclaxj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.fclaxj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007499; classtype:social-engineering; sid:6007499; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.biasrc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.biasrc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007500; classtype:social-engineering; sid:6007500; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help-trezeer-io-start.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"help-trezeer-io-start.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007501; classtype:social-engineering; sid:6007501; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cancelarla-ahora-bdbweb-2026co.iceiy.com/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"cancelarla-ahora-bdbweb-2026co.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007502; classtype:social-engineering; sid:6007502; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (birjumardi-git.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"birjumardi-git.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007503; classtype:social-engineering; sid:6007503; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booking.hotel-stayse87401.com/1905082301/)"; flow:established,to_server; http.uri; content:"/1905082301/"; startswith; fast_pattern; http.host; content:"booking.hotel-stayse87401.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007504; classtype:social-engineering; sid:6007504; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aadityashrivastava25-dot.github.io/spotify-ui-clone)"; flow:established,to_server; http.uri; content:"/spotify-ui-clone"; startswith; fast_pattern; http.host; content:"aadityashrivastava25-dot.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007505; classtype:social-engineering; sid:6007505; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloudmails.sviluppo.host/Login/120B4FG1JTY4HJ14E1RFEZ0000000ZEG41RE4JY401UK110ZE0D0E000SDV2S0GB000000SDG4110/)"; flow:established,to_server; http.uri; content:"/Login/120B4FG1JTY4HJ14E1RFEZ0000000ZEG41RE4JY401UK110ZE0D0E000SDV2S0GB000000SDG4110/"; startswith; fast_pattern; http.host; content:"icloudmails.sviluppo.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007506; classtype:social-engineering; sid:6007506; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mx8.luxegeer.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mx8.luxegeer.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007507; classtype:social-engineering; sid:6007507; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aislingsoflife.info/PL-1466-160526/?e=Czenar1@37bb31224d0f5b75d23755f025d72fa6a1ab.com&s3=Craig&s4=Condit&s5=&s6=&s7=&s8=&u=14C1466)"; flow:established,to_server; http.uri; content:"/PL-1466-160526/?e=Czenar1@37bb31224d0f5b75d23755f025d72fa6a1ab.com&s3=Craig&s4=Condit&s5=&s6=&s7=&s8=&u=14C1466"; startswith; fast_pattern; http.host; content:"aislingsoflife.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007508; classtype:social-engineering; sid:6007508; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dxfswa.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dxfswa.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007509; classtype:social-engineering; sid:6007509; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vnrpot.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vnrpot.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007510; classtype:social-engineering; sid:6007510; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.alexa.abductist-alt.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"login.alexa.abductist-alt.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007511; classtype:social-engineering; sid:6007511; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kkuiionlog-iim.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kkuiionlog-iim.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007512; classtype:social-engineering; sid:6007512; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zubsqa.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zubsqa.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007513; classtype:social-engineering; sid:6007513; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-ndaax.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"account-ndaax.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007514; classtype:social-engineering; sid:6007514; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (handsome-communication-053785.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"handsome-communication-053785.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007515; classtype:social-engineering; sid:6007515; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.sctzal.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.sctzal.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007516; classtype:social-engineering; sid:6007516; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kucoin-logg_usa.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kucoin-logg_usa.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007517; classtype:social-engineering; sid:6007517; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (possible-artboard-693647.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"possible-artboard-693647.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007518; classtype:social-engineering; sid:6007518; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pemenangshopee39.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pemenangshopee39.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007519; classtype:social-engineering; sid:6007519; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.uehtvy.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.uehtvy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007520; classtype:social-engineering; sid:6007520; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.opufag.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.opufag.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007521; classtype:social-engineering; sid:6007521; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ganimne_walllate.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ganimne_walllate.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007522; classtype:social-engineering; sid:6007522; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3656v66.com/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"3656v66.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007523; classtype:social-engineering; sid:6007523; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.x17o.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.x17o.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007524; classtype:social-engineering; sid:6007524; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.micntd.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.micntd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007525; classtype:social-engineering; sid:6007525; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.learn-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.learn-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007526; classtype:social-engineering; sid:6007526; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kfselt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kfselt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007527; classtype:social-engineering; sid:6007527; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xjebdk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xjebdk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007528; classtype:social-engineering; sid:6007528; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.metai-iau-mskmask-logijin.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.metai-iau-mskmask-logijin.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007529; classtype:social-engineering; sid:6007529; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bd-digital.store/confirmation/)"; flow:established,to_server; http.uri; content:"/confirmation/"; startswith; fast_pattern; http.host; content:"www.bd-digital.store"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007530; classtype:social-engineering; sid:6007530; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ihqyfl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ihqyfl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007531; classtype:social-engineering; sid:6007531; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ijudrn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ijudrn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007532; classtype:social-engineering; sid:6007532; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.stkqgi.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.stkqgi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007533; classtype:social-engineering; sid:6007533; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3656v11.com/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"3656v11.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007534; classtype:social-engineering; sid:6007534; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fgpevu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.fgpevu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007535; classtype:social-engineering; sid:6007535; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0203656.com/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"0203656.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007536; classtype:social-engineering; sid:6007536; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lkxvai.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lkxvai.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007537; classtype:social-engineering; sid:6007537; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kucoin-logg_usa.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kucoin-logg_usa.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007538; classtype:social-engineering; sid:6007538; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.web-git-05-20-featwebshowread-onlytokeninfoforex-4642a4-uniswap.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.web-git-05-20-featwebshowread-onlytokeninfoforex-4642a4-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007539; classtype:social-engineering; sid:6007539; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ptshopee507.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ptshopee507.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007540; classtype:social-engineering; sid:6007540; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vrmzqtplxn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.vrmzqtplxn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007541; classtype:social-engineering; sid:6007541; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sssimransingh26-bit.github.io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"sssimransingh26-bit.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007542; classtype:social-engineering; sid:6007542; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ihttps-roblox.com/users/526766287/profile)"; flow:established,to_server; http.uri; content:"/users/526766287/profile"; startswith; fast_pattern; http.host; content:"ihttps-roblox.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007543; classtype:social-engineering; sid:6007543; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.asnokb.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.asnokb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007544; classtype:social-engineering; sid:6007544; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (twezygamer.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"twezygamer.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007545; classtype:social-engineering; sid:6007545; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thinklz.info/PL-1466-160526/?u=162C1466&e=delar9@cc7b1bd10b18c0c8f5579d465f4cf649d685.org&s3=&s4=&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/PL-1466-160526/?u=162C1466&e=delar9@cc7b1bd10b18c0c8f5579d465f4cf649d685.org&s3=&s4=&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"thinklz.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007546; classtype:social-engineering; sid:6007546; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pushkarmishra1.github.io/spotify-clone)"; flow:established,to_server; http.uri; content:"/spotify-clone"; startswith; fast_pattern; http.host; content:"pushkarmishra1.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007547; classtype:social-engineering; sid:6007547; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.938g.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.938g.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007548; classtype:social-engineering; sid:6007548; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365k13.com/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"365k13.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007549; classtype:social-engineering; sid:6007549; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (samikshagupta-png.github.io/first_project)"; flow:established,to_server; http.uri; content:"/first_project"; startswith; fast_pattern; http.host; content:"samikshagupta-png.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007550; classtype:social-engineering; sid:6007550; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.epftrz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.epftrz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007551; classtype:social-engineering; sid:6007551; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledjh-ajfhe-3a3efe6aa6b2.herokuapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledjh-ajfhe-3a3efe6aa6b2.herokuapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007552; classtype:social-engineering; sid:6007552; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mdofxa.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mdofxa.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007553; classtype:social-engineering; sid:6007553; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xqpltrvmzn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xqpltrvmzn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007554; classtype:social-engineering; sid:6007554; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.sginyz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.sginyz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007555; classtype:social-engineering; sid:6007555; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lhgjxf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lhgjxf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007556; classtype:social-engineering; sid:6007556; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dhl.cmvwp-ie.org/track)"; flow:established,to_server; http.uri; content:"/track"; startswith; fast_pattern; http.host; content:"dhl.cmvwp-ie.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007557; classtype:social-engineering; sid:6007557; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.clone-project-omega.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.clone-project-omega.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007558; classtype:social-engineering; sid:6007558; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0293656.com/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"0293656.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007559; classtype:social-engineering; sid:6007559; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tvplqrmznx.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tvplqrmznx.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007560; classtype:social-engineering; sid:6007560; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bkgpjy.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bkgpjy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007561; classtype:social-engineering; sid:6007561; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (es-gestiondetucuenta.dimtom.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"es-gestiondetucuenta.dimtom.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007562; classtype:social-engineering; sid:6007562; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roundcubesupport.relatetoviewintothizxfinitidocstoviewslkaiojjdb.online/en/wemai.html)"; flow:established,to_server; http.uri; content:"/en/wemai.html"; startswith; fast_pattern; http.host; content:"roundcubesupport.relatetoviewintothizxfinitidocstoviewslkaiojjdb.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007563; classtype:social-engineering; sid:6007563; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ktdfyu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ktdfyu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007564; classtype:social-engineering; sid:6007564; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (travelalrets.com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"travelalrets.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007565; classtype:social-engineering; sid:6007565; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tvplqzrmxn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tvplqzrmxn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007566; classtype:social-engineering; sid:6007566; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (consultar-pedagio.dns.navy/sistema/consulta-online/ver-debitos)"; flow:established,to_server; http.uri; content:"/sistema/consulta-online/ver-debitos"; startswith; fast_pattern; http.host; content:"consultar-pedagio.dns.navy"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007567; classtype:social-engineering; sid:6007567; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ngwbdh.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ngwbdh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007568; classtype:social-engineering; sid:6007568; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gydwtq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gydwtq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007569; classtype:social-engineering; sid:6007569; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ridddhi-ai.github.io/netflix-ui-clone/)"; flow:established,to_server; http.uri; content:"/netflix-ui-clone/"; startswith; fast_pattern; http.host; content:"ridddhi-ai.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007570; classtype:social-engineering; sid:6007570; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gpwdok.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gpwdok.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007571; classtype:social-engineering; sid:6007571; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bfa-lkcxz.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bfa-lkcxz.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007572; classtype:social-engineering; sid:6007572; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mlkrai.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mlkrai.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007573; classtype:social-engineering; sid:6007573; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.igslcf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.igslcf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007574; classtype:social-engineering; sid:6007574; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (americanexpress-portalsite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"americanexpress-portalsite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007575; classtype:social-engineering; sid:6007575; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (soumyariq.github.io/An-Ecommerce-Website-Amazon-Clone)"; flow:established,to_server; http.uri; content:"/An-Ecommerce-Website-Amazon-Clone"; startswith; fast_pattern; http.host; content:"soumyariq.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007576; classtype:social-engineering; sid:6007576; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cm.in.th/.tmb/done.php)"; flow:established,to_server; http.uri; content:"/.tmb/done.php"; startswith; fast_pattern; http.host; content:"cm.in.th"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007577; classtype:social-engineering; sid:6007577; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dngkqf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dngkqf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007578; classtype:social-engineering; sid:6007578; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (biradarswapnilproject.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"biradarswapnilproject.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007579; classtype:social-engineering; sid:6007579; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yadacorp.tv/AMber)"; flow:established,to_server; http.uri; content:"/AMber"; startswith; fast_pattern; http.host; content:"yadacorp.tv"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007580; classtype:social-engineering; sid:6007580; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.f27q.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.f27q.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007581; classtype:social-engineering; sid:6007581; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jwfeua.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jwfeua.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007582; classtype:social-engineering; sid:6007582; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9-160-161-38.cprapid.com/eu/)"; flow:established,to_server; http.uri; content:"/eu/"; startswith; fast_pattern; http.host; content:"9-160-161-38.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007583; classtype:social-engineering; sid:6007583; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jsyldc.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jsyldc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007584; classtype:social-engineering; sid:6007584; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (folks-chief-commission-engaged.trycloudflare.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"folks-chief-commission-engaged.trycloudflare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007585; classtype:social-engineering; sid:6007585; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.arsvxo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.arsvxo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007586; classtype:social-engineering; sid:6007586; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pxfdcq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pxfdcq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007587; classtype:social-engineering; sid:6007587; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dtysfp.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dtysfp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007588; classtype:social-engineering; sid:6007588; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3656v22.com/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"3656v22.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007589; classtype:social-engineering; sid:6007589; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ineuqv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ineuqv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007590; classtype:social-engineering; sid:6007590; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bfa-lkcxz.wasmer.app/recontrustco)"; flow:established,to_server; http.uri; content:"/recontrustco"; startswith; fast_pattern; http.host; content:"bfa-lkcxz.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007591; classtype:social-engineering; sid:6007591; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parklngs.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parklngs.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007592; classtype:social-engineering; sid:6007592; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.smvuqy.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.smvuqy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007593; classtype:social-engineering; sid:6007593; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iniciar-sesion-empresas2026.zya.me/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"iniciar-sesion-empresas2026.zya.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007594; classtype:social-engineering; sid:6007594; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kdntzm.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kdntzm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007595; classtype:social-engineering; sid:6007595; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (happier-village-403312.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"happier-village-403312.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007596; classtype:social-engineering; sid:6007596; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ezrskq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ezrskq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007597; classtype:social-engineering; sid:6007597; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cm.in.th/.tmb/proses4.php)"; flow:established,to_server; http.uri; content:"/.tmb/proses4.php"; startswith; fast_pattern; http.host; content:"cm.in.th"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007598; classtype:social-engineering; sid:6007598; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ganimne_walllate.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ganimne_walllate.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007599; classtype:social-engineering; sid:6007599; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3656v55.com/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"3656v55.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007600; classtype:social-engineering; sid:6007600; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kpjrlvbnq.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kpjrlvbnq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007601; classtype:social-engineering; sid:6007601; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pzqywr.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pzqywr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007602; classtype:social-engineering; sid:6007602; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.koxgmy.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.koxgmy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007603; classtype:social-engineering; sid:6007603; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zqwmko.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zqwmko.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007604; classtype:social-engineering; sid:6007604; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vrqmplztwk.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.vrqmplztwk.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007605; classtype:social-engineering; sid:6007605; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rxdnbu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rxdnbu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007606; classtype:social-engineering; sid:6007606; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wcdjrl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wcdjrl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007607; classtype:social-engineering; sid:6007607; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tnqzvw.ink/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tnqzvw.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007608; classtype:social-engineering; sid:6007608; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365k17.com/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"365k17.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007609; classtype:social-engineering; sid:6007609; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gwww.accounts.mywallet.help/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gwww.accounts.mywallet.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007610; classtype:social-engineering; sid:6007610; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fgpxum.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.fgpxum.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007611; classtype:social-engineering; sid:6007611; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ptshopee507.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ptshopee507.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007612; classtype:social-engineering; sid:6007612; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xkjfzv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xkjfzv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007613; classtype:social-engineering; sid:6007613; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (500vip07.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"500vip07.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007614; classtype:social-engineering; sid:6007614; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rdxsuy.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rdxsuy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007615; classtype:social-engineering; sid:6007615; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rezemon.biz/fabmgt)"; flow:established,to_server; http.uri; content:"/fabmgt"; startswith; fast_pattern; http.host; content:"rezemon.biz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007616; classtype:social-engineering; sid:6007616; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nowkxh.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nowkxh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007617; classtype:social-engineering; sid:6007617; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cm.in.th/.tmb/verif2.php)"; flow:established,to_server; http.uri; content:"/.tmb/verif2.php"; startswith; fast_pattern; http.host; content:"cm.in.th"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007618; classtype:social-engineering; sid:6007618; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dkyuwq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dkyuwq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007619; classtype:social-engineering; sid:6007619; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clone-project-omega.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"clone-project-omega.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007620; classtype:social-engineering; sid:6007620; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jqzuml.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jqzuml.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007621; classtype:social-engineering; sid:6007621; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.cjagps.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.cjagps.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007622; classtype:social-engineering; sid:6007622; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (extraspraquemprecisa.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"extraspraquemprecisa.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007623; classtype:social-engineering; sid:6007623; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (novasoportunidadesterca.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"novasoportunidadesterca.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007624; classtype:social-engineering; sid:6007624; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sbs.logincorporate.com/c/p/tc/4488/8928f1dc-4fc5-42be-b660-7305f31e3660-82701ebd-333c-4fd4-a487-0390e216c8bb/)"; flow:established,to_server; http.uri; content:"/c/p/tc/4488/8928f1dc-4fc5-42be-b660-7305f31e3660-82701ebd-333c-4fd4-a487-0390e216c8bb/"; startswith; fast_pattern; http.host; content:"sbs.logincorporate.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007625; classtype:social-engineering; sid:6007625; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vrqtmplzxn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.vrqtmplzxn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007626; classtype:social-engineering; sid:6007626; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vrplqtxmzn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.vrplqtxmzn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007627; classtype:social-engineering; sid:6007627; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dtjkla.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dtjkla.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007628; classtype:social-engineering; sid:6007628; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yds-gewg.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yds-gewg.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007629; classtype:social-engineering; sid:6007629; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.logininstagram.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.logininstagram.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007630; classtype:social-engineering; sid:6007630; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.qtrzvmplxn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.qtrzvmplxn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007631; classtype:social-engineering; sid:6007631; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lwbsta.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lwbsta.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007632; classtype:social-engineering; sid:6007632; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.oqghiy.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.oqghiy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007633; classtype:social-engineering; sid:6007633; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cm.in.th/.tmb/otp.php)"; flow:established,to_server; http.uri; content:"/.tmb/otp.php"; startswith; fast_pattern; http.host; content:"cm.in.th"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007634; classtype:social-engineering; sid:6007634; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ginninni_lggmn.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ginninni_lggmn.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007635; classtype:social-engineering; sid:6007635; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.f27r.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.f27r.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007636; classtype:social-engineering; sid:6007636; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xptqrlvmzn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xptqrlvmzn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007637; classtype:social-engineering; sid:6007637; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafybeiaarhbvin775u4sbagaasf7d22yntl7olnablp4ukwngh63akafxi.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafybeiaarhbvin775u4sbagaasf7d22yntl7olnablp4ukwngh63akafxi.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007638; classtype:social-engineering; sid:6007638; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-ledger-live.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app-ledger-live.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007639; classtype:social-engineering; sid:6007639; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sksudhanshusingh-arch.github.io/spotify-clone)"; flow:established,to_server; http.uri; content:"/spotify-clone"; startswith; fast_pattern; http.host; content:"sksudhanshusingh-arch.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007640; classtype:social-engineering; sid:6007640; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robotiikka-dialogo-sociedade-asuminen.pages.dev/cloud.html/)"; flow:established,to_server; http.uri; content:"/cloud.html/"; startswith; fast_pattern; http.host; content:"robotiikka-dialogo-sociedade-asuminen.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007641; classtype:social-engineering; sid:6007641; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.g09o.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.g09o.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007642; classtype:social-engineering; sid:6007642; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ebisnk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ebisnk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007643; classtype:social-engineering; sid:6007643; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wingsproducts.com/opay/)"; flow:established,to_server; http.uri; content:"/opay/"; startswith; fast_pattern; http.host; content:"wingsproducts.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007644; classtype:social-engineering; sid:6007644; rev:1; metadata: signature_severity Major, created_et 2026_05_26, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bridgera-io.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"bridgera-io.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007645; classtype:social-engineering; sid:6007645; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (plum-flexibility-759015.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"plum-flexibility-759015.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007646; classtype:social-engineering; sid:6007646; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appstart-trzzor.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"appstart-trzzor.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007647; classtype:social-engineering; sid:6007647; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (astound-webmail-support.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"astound-webmail-support.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007648; classtype:social-engineering; sid:6007648; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (different-majority-200956.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"different-majority-200956.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007649; classtype:social-engineering; sid:6007649; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (homestart-bridges.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"homestart-bridges.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007650; classtype:social-engineering; sid:6007650; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcast-108616.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcast-108616.square.site"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007651; classtype:social-engineering; sid:6007651; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (voluntary-dance-668287.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"voluntary-dance-668287.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007652; classtype:social-engineering; sid:6007652; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwwen-trezsuiteus.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"wwwen-trezsuiteus.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007653; classtype:social-engineering; sid:6007653; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suiteshelp.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"suiteshelp.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007654; classtype:social-engineering; sid:6007654; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clemensantikvariat.dk/music/search.php?categoryId=%22%2F%3E%3Cimg%20src%3D%22https%3A%2F%2Fgoogle.com%2F0Krrq3Pn9aijG.jpg%22%20onerror%3D%22window.location%3DdecodeURIComponent%28atob%28%27Njg3NDc0NzA3MzNhMmYyZjc0Nzc3Mjc2NjQ2NTc4NmU2ZDY2NzMyZTYzNjEzNjYxMzg2MjM3MzQyZDMzMzI2MTYzMmQzNDM1NjU2MTJkMzgzNDY2MzAyZDY2NjIzNjMwMzc2MjM4MzczODM5NjE2MjJlNjM2YzY5NjM2YjJmMzYzNDYzNjQ2NTMwMzQzMDJkMzIzMjMzMzUyZDM0MzU2MjY1MmQ2MTMzNjYzNjJkMzQ2NDYzNjQzNjYzMzgzODM2NjQ2MjY1MmU3MDY4NzA%3D%27%29.replace%28%2F%28..%29%2Fg%2C%20%27%25%241%27%29%29%3B%22%3E)"; flow:established,to_server; http.uri; content:"/music/search.php?categoryId=%22%2F%3E%3Cimg%20src%3D%22https%3A%2F%2Fgoogle.com%2F0Krrq3Pn9aijG.jpg%22%20onerror%3D%22window.location%3DdecodeURIComponent%28atob%28%27Njg3NDc0NzA3MzNhMmYyZjc0Nzc3Mjc2NjQ2NTc4NmU2ZDY2NzMyZTYzNjEzNjYxMzg2MjM3MzQyZDMzMzI2MTYzMmQzNDM1NjU2MTJkMzgzNDY2MzAyZDY2NjIzNjMwMzc2MjM4MzczODM5NjE2MjJlNjM2YzY5NjM2YjJmMzYzNDYzNjQ2NTMwMzQzMDJkMzIzMjMzMzUyZDM0MzU2MjY1MmQ2MTMzNjYzNjJkMzQ2NDYzNjQzNjYzMzgzODM2NjQ2MjY1MmU3MDY4NzA%3D%27%29.replace%28%2F%28..%29%2Fg%2C%20%27%25%241%27%29%29%3B%22%3E"; startswith; fast_pattern; http.host; content:"clemensantikvariat.dk"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007655; classtype:social-engineering; sid:6007655; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tpg-pilot-platform.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tpg-pilot-platform.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007656; classtype:social-engineering; sid:6007656; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rzkvd.ca6a8b74-32ac-45ea-84f0-fb607b8789ab.click/64cde040-2235-45be-a3f6-4dcd6c886dbe.php)"; flow:established,to_server; http.uri; content:"/64cde040-2235-45be-a3f6-4dcd6c886dbe.php"; startswith; fast_pattern; http.host; content:"rzkvd.ca6a8b74-32ac-45ea-84f0-fb607b8789ab.click"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007657; classtype:social-engineering; sid:6007657; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mrmyhqrcwq.ca6a8b74-32ac-45ea-84f0-fb607b8789ab.click/64cde040-2235-45be-a3f6-4dcd6c886dbe.php)"; flow:established,to_server; http.uri; content:"/64cde040-2235-45be-a3f6-4dcd6c886dbe.php"; startswith; fast_pattern; http.host; content:"mrmyhqrcwq.ca6a8b74-32ac-45ea-84f0-fb607b8789ab.click"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007658; classtype:social-engineering; sid:6007658; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jismiggo.ca6a8b74-32ac-45ea-84f0-fb607b8789ab.click/64cde040-2235-45be-a3f6-4dcd6c886dbe.php)"; flow:established,to_server; http.uri; content:"/64cde040-2235-45be-a3f6-4dcd6c886dbe.php"; startswith; fast_pattern; http.host; content:"jismiggo.ca6a8b74-32ac-45ea-84f0-fb607b8789ab.click"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007659; classtype:social-engineering; sid:6007659; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mobwfugmzwdu.ca6a8b74-32ac-45ea-84f0-fb607b8789ab.click/64cde040-2235-45be-a3f6-4dcd6c886dbe.php)"; flow:established,to_server; http.uri; content:"/64cde040-2235-45be-a3f6-4dcd6c886dbe.php"; startswith; fast_pattern; http.host; content:"mobwfugmzwdu.ca6a8b74-32ac-45ea-84f0-fb607b8789ab.click"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007660; classtype:social-engineering; sid:6007660; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tpg-pilot-platform.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tpg-pilot-platform.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007661; classtype:social-engineering; sid:6007661; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qr.fm/0PGAb6)"; flow:established,to_server; http.uri; content:"/0PGAb6"; startswith; fast_pattern; http.host; content:"qr.fm"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007662; classtype:social-engineering; sid:6007662; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (miraculous-orca-663548.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"miraculous-orca-663548.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007663; classtype:social-engineering; sid:6007663; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.office365spainlog.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.office365spainlog.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007664; classtype:social-engineering; sid:6007664; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (refreshed-jaguar-794242.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"refreshed-jaguar-794242.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007665; classtype:social-engineering; sid:6007665; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.prwhue.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.prwhue.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007666; classtype:social-engineering; sid:6007666; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mgdrwg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mgdrwg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007667; classtype:social-engineering; sid:6007667; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allrbxscrpt.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allrbxscrpt.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007668; classtype:social-engineering; sid:6007668; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.jeddtp.help/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.jeddtp.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007669; classtype:social-engineering; sid:6007669; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (upholidlognee.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"upholidlognee.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007670; classtype:social-engineering; sid:6007670; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.roztnv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.roztnv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007671; classtype:social-engineering; sid:6007671; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tvxplrmqzn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tvxplrmqzn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007672; classtype:social-engineering; sid:6007672; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jywkhc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jywkhc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007673; classtype:social-engineering; sid:6007673; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqtmzplxvn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqtmzplxvn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007674; classtype:social-engineering; sid:6007674; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mjpigh.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mjpigh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007675; classtype:social-engineering; sid:6007675; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.swpnxu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.swpnxu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007676; classtype:social-engineering; sid:6007676; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (significant-board-444852.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"significant-board-444852.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007677; classtype:social-engineering; sid:6007677; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aviralvishwakarma.github.io/AmazonClone)"; flow:established,to_server; http.uri; content:"/AmazonClone"; startswith; fast_pattern; http.host; content:"aviralvishwakarma.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007678; classtype:social-engineering; sid:6007678; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (divine-sea-8f82.jernzen26.workers.dev/a8a9c72f90c5b1409e0b0ef7/394d8863e3ed32)"; flow:established,to_server; http.uri; content:"/a8a9c72f90c5b1409e0b0ef7/394d8863e3ed32"; startswith; fast_pattern; http.host; content:"divine-sea-8f82.jernzen26.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007679; classtype:social-engineering; sid:6007679; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.armups.help/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.armups.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007680; classtype:social-engineering; sid:6007680; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hyattregencydubaicorniche.spahotel.guru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hyattregencydubaicorniche.spahotel.guru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007681; classtype:social-engineering; sid:6007681; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.owdcsj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.owdcsj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007682; classtype:social-engineering; sid:6007682; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kcuicoinlogoio.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kcuicoinlogoio.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007683; classtype:social-engineering; sid:6007683; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ijsyot.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ijsyot.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007684; classtype:social-engineering; sid:6007684; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bcjhxt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bcjhxt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007685; classtype:social-engineering; sid:6007685; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wxpejt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wxpejt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007686; classtype:social-engineering; sid:6007686; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.qtrmvzplxn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.qtrmvzplxn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007687; classtype:social-engineering; sid:6007687; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (89betlc.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"89betlc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007688; classtype:social-engineering; sid:6007688; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nflx-cdn6747.konta-portal.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nflx-cdn6747.konta-portal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007689; classtype:social-engineering; sid:6007689; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mdfwgj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mdfwgj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007690; classtype:social-engineering; sid:6007690; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (postch-deliveryinfo.com/pages/login.php)"; flow:established,to_server; http.uri; content:"/pages/login.php"; startswith; fast_pattern; http.host; content:"postch-deliveryinfo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007691; classtype:social-engineering; sid:6007691; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (segamarcos.info/?app_vl=ZYFwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYs)"; flow:established,to_server; http.uri; content:"/?app_vl=ZYFwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYs"; startswith; fast_pattern; http.host; content:"segamarcos.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007692; classtype:social-engineering; sid:6007692; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smilepant.com/tools/facebook-real-name-finder/.tmps/proses3.php)"; flow:established,to_server; http.uri; content:"/tools/facebook-real-name-finder/.tmps/proses3.php"; startswith; fast_pattern; http.host; content:"smilepant.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007693; classtype:social-engineering; sid:6007693; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vatshalupadhyay.github.io/netflix-ui-clone/)"; flow:established,to_server; http.uri; content:"/netflix-ui-clone/"; startswith; fast_pattern; http.host; content:"vatshalupadhyay.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007694; classtype:social-engineering; sid:6007694; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (goto.now/aRop5)"; flow:established,to_server; http.uri; content:"/aRop5"; startswith; fast_pattern; http.host; content:"goto.now"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007695; classtype:social-engineering; sid:6007695; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pzuyfg.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.pzuyfg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007696; classtype:social-engineering; sid:6007696; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.qznvpltrmx.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.qznvpltrmx.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007697; classtype:social-engineering; sid:6007697; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (forhat.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"forhat.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007698; classtype:social-engineering; sid:6007698; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8riyashil.github.io/amazon.com-front-page)"; flow:established,to_server; http.uri; content:"/amazon.com-front-page"; startswith; fast_pattern; http.host; content:"8riyashil.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007699; classtype:social-engineering; sid:6007699; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kzplnrqwjt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kzplnrqwjt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007700; classtype:social-engineering; sid:6007700; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.bulxzx.click/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.bulxzx.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007701; classtype:social-engineering; sid:6007701; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.cnvrzpkqlh.cloud/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.cnvrzpkqlh.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007702; classtype:social-engineering; sid:6007702; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.mxvkxb.help/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.mxvkxb.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007703; classtype:social-engineering; sid:6007703; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lzynfw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lzynfw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007704; classtype:social-engineering; sid:6007704; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bopdav.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bopdav.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007705; classtype:social-engineering; sid:6007705; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.apliqn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.apliqn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007706; classtype:social-engineering; sid:6007706; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wugpvq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wugpvq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007707; classtype:social-engineering; sid:6007707; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (more-resources-316303.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"more-resources-316303.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007708; classtype:social-engineering; sid:6007708; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.plzqvmtrxn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.plzqvmtrxn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007709; classtype:social-engineering; sid:6007709; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lrivzp.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lrivzp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007710; classtype:social-engineering; sid:6007710; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ranjithakaranam.github.io/Netflix-Homepage-Project/)"; flow:established,to_server; http.uri; content:"/Netflix-Homepage-Project/"; startswith; fast_pattern; http.host; content:"ranjithakaranam.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007711; classtype:social-engineering; sid:6007711; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.plztrvmqxn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.plztrvmqxn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007712; classtype:social-engineering; sid:6007712; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.site-w6vzhq5av.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.site-w6vzhq5av.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007713; classtype:social-engineering; sid:6007713; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mhulgw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mhulgw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007714; classtype:social-engineering; sid:6007714; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (omkilkarihospital.com/aeromechanism/southpointindustrial.html)"; flow:established,to_server; http.uri; content:"/aeromechanism/southpointindustrial.html"; startswith; fast_pattern; http.host; content:"omkilkarihospital.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007715; classtype:social-engineering; sid:6007715; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ixlqmt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ixlqmt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007716; classtype:social-engineering; sid:6007716; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dc.tensgpt.com/discovery/applications)"; flow:established,to_server; http.uri; content:"/discovery/applications"; startswith; fast_pattern; http.host; content:"dc.tensgpt.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007717; classtype:social-engineering; sid:6007717; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.regpqy.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.regpqy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007718; classtype:social-engineering; sid:6007718; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreihctaezguqlfsq5x7ofrhs5ncg3itwnasqmo2n3hanim5izwd3dzu.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreihctaezguqlfsq5x7ofrhs5ncg3itwnasqmo2n3hanim5izwd3dzu.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007719; classtype:social-engineering; sid:6007719; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lbynmg.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.lbynmg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007720; classtype:social-engineering; sid:6007720; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gdss23.github.io/Caixa-economica/)"; flow:established,to_server; http.uri; content:"/Caixa-economica/"; startswith; fast_pattern; http.host; content:"gdss23.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007721; classtype:social-engineering; sid:6007721; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rxgzfj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rxgzfj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007722; classtype:social-engineering; sid:6007722; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smilepant.com/tools/facebook-real-name-finder/.tmps/proses4.php)"; flow:established,to_server; http.uri; content:"/tools/facebook-real-name-finder/.tmps/proses4.php"; startswith; fast_pattern; http.host; content:"smilepant.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007723; classtype:social-engineering; sid:6007723; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.tolyyk.help/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.tolyyk.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007724; classtype:social-engineering; sid:6007724; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bhuwanyogii.github.io/AmazonFrontPage-html-css-)"; flow:established,to_server; http.uri; content:"/AmazonFrontPage-html-css-"; startswith; fast_pattern; http.host; content:"bhuwanyogii.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007725; classtype:social-engineering; sid:6007725; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (powerful-head-270268.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"powerful-head-270268.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007726; classtype:social-engineering; sid:6007726; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.oqxpcc.cc/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.oqxpcc.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007727; classtype:social-engineering; sid:6007727; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vrqtplmzxn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.vrqtplmzxn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007728; classtype:social-engineering; sid:6007728; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bwqjrh.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.bwqjrh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007729; classtype:social-engineering; sid:6007729; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tnrzqpltrs.cloud/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tnrzqpltrs.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007730; classtype:social-engineering; sid:6007730; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hcmugv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hcmugv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007731; classtype:social-engineering; sid:6007731; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqtplvmznx.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqtplvmznx.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007732; classtype:social-engineering; sid:6007732; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xvnpltrqmz.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xvnpltrqmz.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007733; classtype:social-engineering; sid:6007733; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.qqgelx.buzz/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.qqgelx.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007734; classtype:social-engineering; sid:6007734; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.egvxog.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.egvxog.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007735; classtype:social-engineering; sid:6007735; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smaller-interface-460480.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"smaller-interface-460480.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007736; classtype:social-engineering; sid:6007736; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hyirny.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hyirny.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007737; classtype:social-engineering; sid:6007737; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.3659b.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.3659b.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007738; classtype:social-engineering; sid:6007738; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.gnwrzplqti.cloud/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.gnwrzplqti.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007739; classtype:social-engineering; sid:6007739; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vedang830.github.io/amazone-clon)"; flow:established,to_server; http.uri; content:"/amazone-clon"; startswith; fast_pattern; http.host; content:"vedang830.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007740; classtype:social-engineering; sid:6007740; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cherokeeconstructioncompany.com/PAY526-2026)"; flow:established,to_server; http.uri; content:"/PAY526-2026"; startswith; fast_pattern; http.host; content:"cherokeeconstructioncompany.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007741; classtype:social-engineering; sid:6007741; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reactivar-microsoft-365.iceiy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"reactivar-microsoft-365.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007742; classtype:social-engineering; sid:6007742; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mnwysd.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.mnwysd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007743; classtype:social-engineering; sid:6007743; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (govauinboxmsg-clientsecure.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"govauinboxmsg-clientsecure.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007744; classtype:social-engineering; sid:6007744; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox.com.bn/communities/213814584506/Triple-T)"; flow:established,to_server; http.uri; content:"/communities/213814584506/Triple-T"; startswith; fast_pattern; http.host; content:"roblox.com.bn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007745; classtype:social-engineering; sid:6007745; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xplmvrqztn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xplmvrqztn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007746; classtype:social-engineering; sid:6007746; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.nhphfj.buzz/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.nhphfj.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007747; classtype:social-engineering; sid:6007747; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (huld-lgn-up-home.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"huld-lgn-up-home.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007748; classtype:social-engineering; sid:6007748; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (platinium-tv.com/wp-content/plugins/wp-security-helper/p/Verifiera_din_leveransadress/)"; flow:established,to_server; http.uri; content:"/wp-content/plugins/wp-security-helper/p/Verifiera_din_leveransadress/"; startswith; fast_pattern; http.host; content:"platinium-tv.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007749; classtype:social-engineering; sid:6007749; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.avrwbn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.avrwbn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007750; classtype:social-engineering; sid:6007750; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp-bayerjohnathan132.pages.dev/help/contact/4666)"; flow:established,to_server; http.uri; content:"/help/contact/4666"; startswith; fast_pattern; http.host; content:"sp-bayerjohnathan132.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007751; classtype:social-engineering; sid:6007751; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (storneren-knab.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"storneren-knab.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007752; classtype:social-engineering; sid:6007752; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pagamentos-freeflow.lovable.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pagamentos-freeflow.lovable.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007753; classtype:social-engineering; sid:6007753; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robloxr.de/users/14085142931/profile)"; flow:established,to_server; http.uri; content:"/users/14085142931/profile"; startswith; fast_pattern; http.host; content:"robloxr.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007754; classtype:social-engineering; sid:6007754; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazonaccount-recovery.rosemarycasarotti.com/desktop?auth_max_open=0&ref=do697t6ot0nl7jkGcQuzD7VJGJw0ps5kX9O6OiE3YCS7aAEqvF6lLR97Z5yB9PyUXj36KHrZhzUAMveF9DZObaT7v5xGAUhmHhkS)"; flow:established,to_server; http.uri; content:"/desktop?auth_max_open=0&ref=do697t6ot0nl7jkGcQuzD7VJGJw0ps5kX9O6OiE3YCS7aAEqvF6lLR97Z5yB9PyUXj36KHrZhzUAMveF9DZObaT7v5xGAUhmHhkS"; startswith; fast_pattern; http.host; content:"amazonaccount-recovery.rosemarycasarotti.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007755; classtype:social-engineering; sid:6007755; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.egktmu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.egktmu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007756; classtype:social-engineering; sid:6007756; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tplxrmzqvn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tplxrmzqvn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007757; classtype:social-engineering; sid:6007757; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (left-tenure-611508.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"left-tenure-611508.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007758; classtype:social-engineering; sid:6007758; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tajatlaswellnessboutique.spahotel.guru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tajatlaswellnessboutique.spahotel.guru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007759; classtype:social-engineering; sid:6007759; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.linktr.ee/jasminesyt/)"; flow:established,to_server; http.uri; content:"/jasminesyt/"; startswith; fast_pattern; http.host; content:"www.linktr.ee"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007760; classtype:social-engineering; sid:6007760; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.uhboav.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.uhboav.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007761; classtype:social-engineering; sid:6007761; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (good-concept-072523.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"good-concept-072523.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007762; classtype:social-engineering; sid:6007762; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ubwroy.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ubwroy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007763; classtype:social-engineering; sid:6007763; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aprovacoestododia.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aprovacoestododia.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007764; classtype:social-engineering; sid:6007764; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.ptznrqvlmx.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.ptznrqvlmx.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007765; classtype:social-engineering; sid:6007765; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jzwdbn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jzwdbn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007766; classtype:social-engineering; sid:6007766; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xqtrmvzlpn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xqtrmvzlpn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007767; classtype:social-engineering; sid:6007767; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jgiqhf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jgiqhf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007768; classtype:social-engineering; sid:6007768; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (phutunghanquoc.net/ckeditor/skins/santander/login.php)"; flow:established,to_server; http.uri; content:"/ckeditor/skins/santander/login.php"; startswith; fast_pattern; http.host; content:"phutunghanquoc.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007769; classtype:social-engineering; sid:6007769; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jbhkeq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jbhkeq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007770; classtype:social-engineering; sid:6007770; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pvmyuo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pvmyuo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007771; classtype:social-engineering; sid:6007771; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kznqwpltrv.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kznqwpltrv.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007772; classtype:social-engineering; sid:6007772; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mnywqx.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.mnywqx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007773; classtype:social-engineering; sid:6007773; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sglp80al.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sglp80al.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007774; classtype:social-engineering; sid:6007774; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4598765432943749.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4598765432943749.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007775; classtype:social-engineering; sid:6007775; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tvplxqrmzn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tvplxqrmzn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007776; classtype:social-engineering; sid:6007776; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazonaccount-recovery.rosemarycasarotti.com/mobile?auth_max_open=0&ref=KXxIRZ4m3iQwEIBvZZjQkAT7zSuJXC6Laq1HkEydGmIX3pnpBIVPo5fDXcG4FIiWrmc6z14JQuzxOrsw5za2MBbA2fbRFs8gq5iM)"; flow:established,to_server; http.uri; content:"/mobile?auth_max_open=0&ref=KXxIRZ4m3iQwEIBvZZjQkAT7zSuJXC6Laq1HkEydGmIX3pnpBIVPo5fDXcG4FIiWrmc6z14JQuzxOrsw5za2MBbA2fbRFs8gq5iM"; startswith; fast_pattern; http.host; content:"amazonaccount-recovery.rosemarycasarotti.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007777; classtype:social-engineering; sid:6007777; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smilepant.com/tools/facebook-real-name-finder/.tmps/otp.php)"; flow:established,to_server; http.uri; content:"/tools/facebook-real-name-finder/.tmps/otp.php"; startswith; fast_pattern; http.host; content:"smilepant.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007778; classtype:social-engineering; sid:6007778; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkimgf.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkimgf.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007779; classtype:social-engineering; sid:6007779; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (asscheeks.tumblr.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"asscheeks.tumblr.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007780; classtype:social-engineering; sid:6007780; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.j70g.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.j70g.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007781; classtype:social-engineering; sid:6007781; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mybbtelecomms.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mybbtelecomms.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007782; classtype:social-engineering; sid:6007782; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qdxhue.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.qdxhue.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007783; classtype:social-engineering; sid:6007783; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.11659922.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.11659922.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007784; classtype:social-engineering; sid:6007784; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (saibovip144.cc/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"saibovip144.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007785; classtype:social-engineering; sid:6007785; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nksvgy.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nksvgy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007786; classtype:social-engineering; sid:6007786; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pass-11ff5348dd69.s3.amazonaws.com/9cd217dee28e8c9d.html)"; flow:established,to_server; http.uri; content:"/9cd217dee28e8c9d.html"; startswith; fast_pattern; http.host; content:"pass-11ff5348dd69.s3.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007787; classtype:social-engineering; sid:6007787; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dafi.biz.id/bmcc/R1Y9YE8368.php?ryb=amltQHRoZWppbWJ1cmtlZmFtaWx5LmNvbQ==&d6194aa1029e75a5e36d03e43ee054060f1684ec26b37e1796d5fa1a6233979988e5c4bfa277d3728f87510a1394dcf53cddc20a0648eaefa489f5bf67bf791536c8584b5b18e4dcb74dab2bccc712ef626c5002df90d9ad8232=)"; flow:established,to_server; http.uri; content:"/bmcc/R1Y9YE8368.php?ryb=amltQHRoZWppbWJ1cmtlZmFtaWx5LmNvbQ==&d6194aa1029e75a5e36d03e43ee054060f1684ec26b37e1796d5fa1a6233979988e5c4bfa277d3728f87510a1394dcf53cddc20a0648eaefa489f5bf67bf791536c8584b5b18e4dcb74dab2bccc712ef626c5002df90d9ad8232="; startswith; fast_pattern; http.host; content:"dafi.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007788; classtype:social-engineering; sid:6007788; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wkjdcg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wkjdcg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007789; classtype:social-engineering; sid:6007789; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (platinium-tv.com/wp-content/plugins/wp-security-helper/p/Verifiera_din_leveransadress/wrong_sms_otp.php)"; flow:established,to_server; http.uri; content:"/wp-content/plugins/wp-security-helper/p/Verifiera_din_leveransadress/wrong_sms_otp.php"; startswith; fast_pattern; http.host; content:"platinium-tv.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007790; classtype:social-engineering; sid:6007790; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.yhlabt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.yhlabt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007791; classtype:social-engineering; sid:6007791; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tnxicl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tnxicl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007792; classtype:social-engineering; sid:6007792; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.umdhjy.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.umdhjy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007793; classtype:social-engineering; sid:6007793; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.uwhotu.buzz/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.uwhotu.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007794; classtype:social-engineering; sid:6007794; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dilkesh01.github.io/N)"; flow:established,to_server; http.uri; content:"/N"; startswith; fast_pattern; http.host; content:"dilkesh01.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007795; classtype:social-engineering; sid:6007795; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3656v9.com:8989/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"3656v9.com:8989"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007796; classtype:social-engineering; sid:6007796; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yintsed007.github.io/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"yintsed007.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007797; classtype:social-engineering; sid:6007797; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.uoxlvd.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.uoxlvd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007798; classtype:social-engineering; sid:6007798; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hypkeu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hypkeu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007799; classtype:social-engineering; sid:6007799; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site22387277.fo.team/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site22387277.fo.team"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007800; classtype:social-engineering; sid:6007800; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wattever.com/klenzac)"; flow:established,to_server; http.uri; content:"/klenzac"; startswith; fast_pattern; http.host; content:"wattever.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007801; classtype:social-engineering; sid:6007801; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkimgj.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkimgj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007802; classtype:social-engineering; sid:6007802; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.lqxvpmtrka.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.lqxvpmtrka.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007803; classtype:social-engineering; sid:6007803; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jhansibharath-n.github.io/Netflix-Clone)"; flow:established,to_server; http.uri; content:"/Netflix-Clone"; startswith; fast_pattern; http.host; content:"jhansibharath-n.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007804; classtype:social-engineering; sid:6007804; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-11d577e12813445bad862b39ec2c7cb4.r2.dev/index.html?id=dulc9hk0w5)"; flow:established,to_server; http.uri; content:"/index.html?id=dulc9hk0w5"; startswith; fast_pattern; http.host; content:"pub-11d577e12813445bad862b39ec2c7cb4.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007805; classtype:social-engineering; sid:6007805; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mybbtelecomms.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mybbtelecomms.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007806; classtype:social-engineering; sid:6007806; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.amryfs.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.amryfs.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007807; classtype:social-engineering; sid:6007807; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ppp63.028426.com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/"; startswith; fast_pattern; http.host; content:"ppp63.028426.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007808; classtype:social-engineering; sid:6007808; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mbwqrk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mbwqrk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007809; classtype:social-engineering; sid:6007809; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smilepant.com/tools/facebook-real-name-finder/.tmps/)"; flow:established,to_server; http.uri; content:"/tools/facebook-real-name-finder/.tmps/"; startswith; fast_pattern; http.host; content:"smilepant.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007810; classtype:social-engineering; sid:6007810; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smbc-bank.designerhomeandgarden.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"smbc-bank.designerhomeandgarden.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007811; classtype:social-engineering; sid:6007811; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.czplqwntrx.cloud/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.czplqwntrx.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007812; classtype:social-engineering; sid:6007812; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (il.inner.website/q7d5c6461pf198452c1bdf3b1232c2d2bdb8.html)"; flow:established,to_server; http.uri; content:"/q7d5c6461pf198452c1bdf3b1232c2d2bdb8.html"; startswith; fast_pattern; http.host; content:"il.inner.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007813; classtype:social-engineering; sid:6007813; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (platinium-tv.com/wp-content/plugins/wp-security-helper/p/Verifiera_din_leveransadress/sms_otp.php)"; flow:established,to_server; http.uri; content:"/wp-content/plugins/wp-security-helper/p/Verifiera_din_leveransadress/sms_otp.php"; startswith; fast_pattern; http.host; content:"platinium-tv.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007814; classtype:social-engineering; sid:6007814; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.dggwnt.help/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.dggwnt.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007815; classtype:social-engineering; sid:6007815; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xvnplztrmq.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xvnplztrmq.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007816; classtype:social-engineering; sid:6007816; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8riyashil.github.io/amazon.com-front-page/)"; flow:established,to_server; http.uri; content:"/amazon.com-front-page/"; startswith; fast_pattern; http.host; content:"8riyashil.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007817; classtype:social-engineering; sid:6007817; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gmotkshop.com/h5/#/pages/register/register?code=MHKDE6)"; flow:established,to_server; http.uri; content:"/h5/#/pages/register/register?code=MHKDE6"; startswith; fast_pattern; http.host; content:"gmotkshop.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007818; classtype:social-engineering; sid:6007818; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robloxaffice.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"robloxaffice.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007819; classtype:social-engineering; sid:6007819; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kelvyn.digital/fonts/mnx/index.php)"; flow:established,to_server; http.uri; content:"/fonts/mnx/index.php"; startswith; fast_pattern; http.host; content:"kelvyn.digital"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007820; classtype:social-engineering; sid:6007820; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smilepant.com/tools/facebook-real-name-finder/.tmps/verif1.php)"; flow:established,to_server; http.uri; content:"/tools/facebook-real-name-finder/.tmps/verif1.php"; startswith; fast_pattern; http.host; content:"smilepant.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007821; classtype:social-engineering; sid:6007821; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (regencyhealthspa.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"regencyhealthspa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007822; classtype:social-engineering; sid:6007822; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazonaccount-recovery.rosemarycasarotti.com/?verify)"; flow:established,to_server; http.uri; content:"/?verify"; startswith; fast_pattern; http.host; content:"amazonaccount-recovery.rosemarycasarotti.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007823; classtype:social-engineering; sid:6007823; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.j70f.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.j70f.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007824; classtype:social-engineering; sid:6007824; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.rybrvm.cc/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.rybrvm.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007825; classtype:social-engineering; sid:6007825; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wbfxcz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wbfxcz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007826; classtype:social-engineering; sid:6007826; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smbc-bank.thetoyboxshop.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"smbc-bank.thetoyboxshop.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007827; classtype:social-engineering; sid:6007827; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nmuesh.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nmuesh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007828; classtype:social-engineering; sid:6007828; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.cmygep.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.cmygep.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007829; classtype:social-engineering; sid:6007829; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.hvplznqtrq.cloud/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.hvplznqtrq.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007830; classtype:social-engineering; sid:6007830; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mgijtk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mgijtk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007831; classtype:social-engineering; sid:6007831; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gmotkshop.com/s/MHKDE6)"; flow:established,to_server; http.uri; content:"/s/MHKDE6"; startswith; fast_pattern; http.host; content:"gmotkshop.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007832; classtype:social-engineering; sid:6007832; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xtrqplmvzn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xtrqplmvzn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007833; classtype:social-engineering; sid:6007833; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member-space.partner-programhub.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member-space.partner-programhub.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007834; classtype:social-engineering; sid:6007834; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dreptate.info/?app_vl=ZoRwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=janarpro@092ccbf33693a0c6951ce789a97b1882e88d.com&sui=%7Bsui%7D&fn=&ln=&p=1&z=PLNONACL-2505-Dig07)"; flow:established,to_server; http.uri; content:"/?app_vl=ZoRwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=janarpro@092ccbf33693a0c6951ce789a97b1882e88d.com&sui=%7Bsui%7D&fn=&ln=&p=1&z=PLNONACL-2505-Dig07"; startswith; fast_pattern; http.host; content:"dreptate.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007835; classtype:social-engineering; sid:6007835; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dropboxfolder.docusignfile.workers.dev/app)"; flow:established,to_server; http.uri; content:"/app"; startswith; fast_pattern; http.host; content:"dropboxfolder.docusignfile.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007836; classtype:social-engineering; sid:6007836; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rmhrestopmain.wasmer.app/preweb/js/libs/statistics/listening)"; flow:established,to_server; http.uri; content:"/preweb/js/libs/statistics/listening"; startswith; fast_pattern; http.host; content:"rmhrestopmain.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007837; classtype:social-engineering; sid:6007837; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.snikby.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.snikby.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007838; classtype:social-engineering; sid:6007838; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ojlgkv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ojlgkv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007839; classtype:social-engineering; sid:6007839; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.lsuszb.cc/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.lsuszb.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007840; classtype:social-engineering; sid:6007840; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gilded-macaron-79e0e2.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gilded-macaron-79e0e2.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007841; classtype:social-engineering; sid:6007841; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tvplzqrmxn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tvplzqrmxn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007842; classtype:social-engineering; sid:6007842; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.dhyhde.buzz/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.dhyhde.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007843; classtype:social-engineering; sid:6007843; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.fqrttv.click/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.fqrttv.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007844; classtype:social-engineering; sid:6007844; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (postch-deliveryinfo.com/pages/ban.php)"; flow:established,to_server; http.uri; content:"/pages/ban.php"; startswith; fast_pattern; http.host; content:"postch-deliveryinfo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007845; classtype:social-engineering; sid:6007845; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s25e.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"s25e.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007846; classtype:social-engineering; sid:6007846; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bvnrzqtplc.cloud/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.bvnrzqtplc.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007847; classtype:social-engineering; sid:6007847; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gzjdef.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.gzjdef.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007848; classtype:social-engineering; sid:6007848; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.rbvntn.buzz/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.rbvntn.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007849; classtype:social-engineering; sid:6007849; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s13sp.mjt.lu/lnk/CAAACLSYxvkAAAAAAAAAAXbuW1MAAAABmxgAAAAAACbaFgBqFeFSI6tnqthUThC_DvO_rjIJgAADfos/1/CC0-Y096DZCwY6HRPFK5eg/aHR0cHM6Ly9wYXNzLTExZmY1MzQ4ZGQ2OS5zMy5hbWF6b25hd3MuY29tLzljZDIxN2RlZTI4ZThjOWQuaHRtbD9lbWFpbD1zdGVmYW4uZW5nbGVyQGJsdWV3aW4uY2g)"; flow:established,to_server; http.uri; content:"/lnk/CAAACLSYxvkAAAAAAAAAAXbuW1MAAAABmxgAAAAAACbaFgBqFeFSI6tnqthUThC_DvO_rjIJgAADfos/1/CC0-Y096DZCwY6HRPFK5eg/aHR0cHM6Ly9wYXNzLTExZmY1MzQ4ZGQ2OS5zMy5hbWF6b25hd3MuY29tLzljZDIxN2RlZTI4ZThjOWQuaHRtbD9lbWFpbD1zdGVmYW4uZW5nbGVyQGJsdWV3aW4uY2g"; startswith; fast_pattern; http.host; content:"s13sp.mjt.lu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007850; classtype:social-engineering; sid:6007850; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kucoin_x_logi9.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kucoin_x_logi9.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007851; classtype:social-engineering; sid:6007851; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qjmdpi.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qjmdpi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007852; classtype:social-engineering; sid:6007852; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (organic.eyeliteglasses.info/ga/click/2-10104564-10-8140-16139-8832-529e184c31-fec5c68e98)"; flow:established,to_server; http.uri; content:"/ga/click/2-10104564-10-8140-16139-8832-529e184c31-fec5c68e98"; startswith; fast_pattern; http.host; content:"organic.eyeliteglasses.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007853; classtype:social-engineering; sid:6007853; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (swissborg-loogin.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"swissborg-loogin.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007854; classtype:social-engineering; sid:6007854; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.robiox.co/users/1092230912/profile/)"; flow:established,to_server; http.uri; content:"/users/1092230912/profile/"; startswith; fast_pattern; http.host; content:"www.robiox.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007855; classtype:social-engineering; sid:6007855; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.recwum.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.recwum.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007856; classtype:social-engineering; sid:6007856; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.vmwfhs.cc/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.vmwfhs.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007857; classtype:social-engineering; sid:6007857; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lmyvrc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lmyvrc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007858; classtype:social-engineering; sid:6007858; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.kzkkxf.click/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.kzkkxf.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007859; classtype:social-engineering; sid:6007859; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shravni2614.github.io/Basic-Netflix-clone-using-css-and-html)"; flow:established,to_server; http.uri; content:"/Basic-Netflix-clone-using-css-and-html"; startswith; fast_pattern; http.host; content:"shravni2614.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007860; classtype:social-engineering; sid:6007860; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (srinitha132030.github.io/amazon-page)"; flow:established,to_server; http.uri; content:"/amazon-page"; startswith; fast_pattern; http.host; content:"srinitha132030.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007861; classtype:social-engineering; sid:6007861; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kucoin_x_logi9.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kucoin_x_logi9.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007862; classtype:social-engineering; sid:6007862; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bkpego.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bkpego.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007863; classtype:social-engineering; sid:6007863; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vrmzqplxtn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.vrmzqplxtn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007864; classtype:social-engineering; sid:6007864; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bixtgq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bixtgq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007865; classtype:social-engineering; sid:6007865; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smilepant.com/tools/facebook-real-name-finder/.tmps/done.php)"; flow:established,to_server; http.uri; content:"/tools/facebook-real-name-finder/.tmps/done.php"; startswith; fast_pattern; http.host; content:"smilepant.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007866; classtype:social-engineering; sid:6007866; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nekpci.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.nekpci.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007867; classtype:social-engineering; sid:6007867; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.4598765432943749.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.4598765432943749.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007868; classtype:social-engineering; sid:6007868; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j56a.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j56a.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007869; classtype:social-engineering; sid:6007869; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smilepant.com/tools/facebook-real-name-finder/.tmps/proses2.php)"; flow:established,to_server; http.uri; content:"/tools/facebook-real-name-finder/.tmps/proses2.php"; startswith; fast_pattern; http.host; content:"smilepant.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007870; classtype:social-engineering; sid:6007870; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (office365spainlog.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"office365spainlog.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007871; classtype:social-engineering; sid:6007871; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vrqtplxznm.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.vrqtplxznm.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007872; classtype:social-engineering; sid:6007872; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gdg65hgfh85fs23sjl9hg5.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gdg65hgfh85fs23sjl9hg5.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007873; classtype:social-engineering; sid:6007873; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.eprghb.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.eprghb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007874; classtype:social-engineering; sid:6007874; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rongros.uk.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rongros.uk.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007875; classtype:social-engineering; sid:6007875; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.spfkwr.click/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.spfkwr.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007876; classtype:social-engineering; sid:6007876; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.abevhk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.abevhk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007877; classtype:social-engineering; sid:6007877; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-alert.net/2fb8071a-0463-4603-8a2a-b8859236a0b1/a/3b51b002-3d6a-4d60-8b3b-8ec246359ffc/ccp?lid=0273fb96-c6ad-449e-a000-740db2e72941)"; flow:established,to_server; http.uri; content:"/2fb8071a-0463-4603-8a2a-b8859236a0b1/a/3b51b002-3d6a-4d60-8b3b-8ec246359ffc/ccp?lid=0273fb96-c6ad-449e-a000-740db2e72941"; startswith; fast_pattern; http.host; content:"info-alert.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007878; classtype:social-engineering; sid:6007878; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.noxiku.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.noxiku.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007879; classtype:social-engineering; sid:6007879; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pfkmbn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pfkmbn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007880; classtype:social-engineering; sid:6007880; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5115-aa.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"5115-aa.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007881; classtype:social-engineering; sid:6007881; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.oxlpkb.help/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.oxlpkb.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007882; classtype:social-engineering; sid:6007882; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (social-evidence-566515.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"social-evidence-566515.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007883; classtype:social-engineering; sid:6007883; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.cdmytn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.cdmytn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007884; classtype:social-engineering; sid:6007884; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bunmainnf.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bunmainnf.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007885; classtype:social-engineering; sid:6007885; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lymvpw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lymvpw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007886; classtype:social-engineering; sid:6007886; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hpkozt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hpkozt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007887; classtype:social-engineering; sid:6007887; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kybvhc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kybvhc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007888; classtype:social-engineering; sid:6007888; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zajqyk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zajqyk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007889; classtype:social-engineering; sid:6007889; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.opyyuf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.opyyuf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007890; classtype:social-engineering; sid:6007890; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.sgmfnl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.sgmfnl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007891; classtype:social-engineering; sid:6007891; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yobet-gov.games/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yobet-gov.games"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007892; classtype:social-engineering; sid:6007892; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9000-firebase-deskcrypt0011-1773850667186.cluster-2nmnojxdmnfh2vwda4kd7uoumu.cloudworkstations.dev/?eta=solorhub@76de844719405efb8b6c1cdeab1bb9b5ac86.com)"; flow:established,to_server; http.uri; content:"/?eta=solorhub@76de844719405efb8b6c1cdeab1bb9b5ac86.com"; startswith; fast_pattern; http.host; content:"9000-firebase-deskcrypt0011-1773850667186.cluster-2nmnojxdmnfh2vwda4kd7uoumu.cloudworkstations.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007893; classtype:social-engineering; sid:6007893; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bet7956.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bet7956.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007894; classtype:social-engineering; sid:6007894; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiawyyc2pgtshm2wsgvfenbevky7btr2rd3qat3gcbcneijhappyjq.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiawyyc2pgtshm2wsgvfenbevky7btr2rd3qat3gcbcneijhappyjq.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007895; classtype:social-engineering; sid:6007895; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (marlonalvees.github.io/Netflix-Accordion-List/)"; flow:established,to_server; http.uri; content:"/Netflix-Accordion-List/"; startswith; fast_pattern; http.host; content:"marlonalvees.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007896; classtype:social-engineering; sid:6007896; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.idywtz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.idywtz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007897; classtype:social-engineering; sid:6007897; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-page-builder--rmohnmr1380.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-page-builder--rmohnmr1380.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007898; classtype:social-engineering; sid:6007898; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pratick-script.github.io/Amazon-FrontPage-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-FrontPage-Clone/"; startswith; fast_pattern; http.host; content:"pratick-script.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007899; classtype:social-engineering; sid:6007899; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kbeqfs.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.kbeqfs.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007900; classtype:social-engineering; sid:6007900; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robloxr.de/users/1106943092/profileye)"; flow:established,to_server; http.uri; content:"/users/1106943092/profileye"; startswith; fast_pattern; http.host; content:"robloxr.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007901; classtype:social-engineering; sid:6007901; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nhloli.co.za/vmaqxzl/solcjqa/vqxfsht/newnaver.html)"; flow:established,to_server; http.uri; content:"/vmaqxzl/solcjqa/vqxfsht/newnaver.html"; startswith; fast_pattern; http.host; content:"nhloli.co.za"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007902; classtype:social-engineering; sid:6007902; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apl-bootstrap-olyad-clone.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"apl-bootstrap-olyad-clone.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007903; classtype:social-engineering; sid:6007903; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bitesr.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bitesr.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007904; classtype:social-engineering; sid:6007904; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (arindampatra506.github.io/Amazon-page-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-page-clone/"; startswith; fast_pattern; http.host; content:"arindampatra506.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007905; classtype:social-engineering; sid:6007905; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ofghyl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ofghyl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007906; classtype:social-engineering; sid:6007906; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqtmxplzvn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqtmxplzvn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007907; classtype:social-engineering; sid:6007907; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kzauha.github.io/netflix)"; flow:established,to_server; http.uri; content:"/netflix"; startswith; fast_pattern; http.host; content:"kzauha.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007908; classtype:social-engineering; sid:6007908; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jyktpa.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jyktpa.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007909; classtype:social-engineering; sid:6007909; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.agrtkc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.agrtkc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007910; classtype:social-engineering; sid:6007910; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gumini-loggnius.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gumini-loggnius.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007911; classtype:social-engineering; sid:6007911; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jvncbm.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jvncbm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007912; classtype:social-engineering; sid:6007912; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (active-guest-139029.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"active-guest-139029.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007913; classtype:social-engineering; sid:6007913; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (program-resmi115.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"program-resmi115.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007914; classtype:social-engineering; sid:6007914; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ubsbankingmock.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ubsbankingmock.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007915; classtype:social-engineering; sid:6007915; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.plztrqvmxn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.plztrqvmxn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007916; classtype:social-engineering; sid:6007916; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uas2-www-connect.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uas2-www-connect.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007917; classtype:social-engineering; sid:6007917; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (97fe6b1c.23eee.pages.dev/company/)"; flow:established,to_server; http.uri; content:"/company/"; startswith; fast_pattern; http.host; content:"97fe6b1c.23eee.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007918; classtype:social-engineering; sid:6007918; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vrmzptqlxn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.vrmzptqlxn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007919; classtype:social-engineering; sid:6007919; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (celestica.cam/oauthy/dhl/admin/?_kx=pCeI3LGQZv82MbS0IfgjQg.V3VjnU?alt=271e95bf-d723-44a5-b87a-04324d148e8b)"; flow:established,to_server; http.uri; content:"/oauthy/dhl/admin/?_kx=pCeI3LGQZv82MbS0IfgjQg.V3VjnU?alt=271e95bf-d723-44a5-b87a-04324d148e8b"; startswith; fast_pattern; http.host; content:"celestica.cam"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007920; classtype:social-engineering; sid:6007920; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tbgumy.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tbgumy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007921; classtype:social-engineering; sid:6007921; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hieswg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hieswg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007922; classtype:social-engineering; sid:6007922; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (macscheese.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"macscheese.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007923; classtype:social-engineering; sid:6007923; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kqaymv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kqaymv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007924; classtype:social-engineering; sid:6007924; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.efoykv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.efoykv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007925; classtype:social-engineering; sid:6007925; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.smgzow.buzz/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.smgzow.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007926; classtype:social-engineering; sid:6007926; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (masson.juicybits.info/ga/click/2-17730949-34-8201-16046-8801-a2f83ecbb3-2c6cdf602d)"; flow:established,to_server; http.uri; content:"/ga/click/2-17730949-34-8201-16046-8801-a2f83ecbb3-2c6cdf602d"; startswith; fast_pattern; http.host; content:"masson.juicybits.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007927; classtype:social-engineering; sid:6007927; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smilepant.com/tools/facebook-real-name-finder/.tmps/verif2.php)"; flow:established,to_server; http.uri; content:"/tools/facebook-real-name-finder/.tmps/verif2.php"; startswith; fast_pattern; http.host; content:"smilepant.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007928; classtype:social-engineering; sid:6007928; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.orbitrader.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.orbitrader.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007929; classtype:social-engineering; sid:6007929; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (track5.wezxrsdfanch.info/ga/click/2-6817817-9-8099-15856-8702-5d68d983b9-48fb4a1114)"; flow:established,to_server; http.uri; content:"/ga/click/2-6817817-9-8099-15856-8702-5d68d983b9-48fb4a1114"; startswith; fast_pattern; http.host; content:"track5.wezxrsdfanch.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007930; classtype:social-engineering; sid:6007930; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jxrahl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jxrahl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007931; classtype:social-engineering; sid:6007931; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (steamnconmnmunity.com/rust2026)"; flow:established,to_server; http.uri; content:"/rust2026"; startswith; fast_pattern; http.host; content:"steamnconmnmunity.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007932; classtype:social-engineering; sid:6007932; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.raqtbxv.cn/home)"; flow:established,to_server; http.uri; content:"/home"; startswith; fast_pattern; http.host; content:"www.raqtbxv.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007933; classtype:social-engineering; sid:6007933; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eficienciaecu12.fwh.is/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eficienciaecu12.fwh.is"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007934; classtype:social-engineering; sid:6007934; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.zt-dasha.com/?L6xfGHI8wGGV&\;type=rakuten)"; flow:established,to_server; http.uri; content:"/?L6xfGHI8wGGV&|3b|type=rakuten"; startswith; fast_pattern; http.host; content:"login.zt-dasha.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007935; classtype:social-engineering; sid:6007935; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paypay-card.lmljujl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paypay-card.lmljujl.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007936; classtype:social-engineering; sid:6007936; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sannicolasprestaciones.com.ar/MEIL/aruba/)"; flow:established,to_server; http.uri; content:"/MEIL/aruba/"; startswith; fast_pattern; http.host; content:"sannicolasprestaciones.com.ar"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007937; classtype:social-engineering; sid:6007937; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (home-exoduc.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"home-exoduc.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007938; classtype:social-engineering; sid:6007938; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acessosuportenetempresa.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"acessosuportenetempresa.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007939; classtype:social-engineering; sid:6007939; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klelnanzeigen-deutch.austinarearoofing.com/receive/order/7sFUnBxHEoJ?r=0x15)"; flow:established,to_server; http.uri; content:"/receive/order/7sFUnBxHEoJ?r=0x15"; startswith; fast_pattern; http.host; content:"klelnanzeigen-deutch.austinarearoofing.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007940; classtype:social-engineering; sid:6007940; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.brwoficial.com.br/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.brwoficial.com.br"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007941; classtype:social-engineering; sid:6007941; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dg9ap7khcvgko20xxhta.s3.eu-central-1.amazonaws.com/0xN0C7hPf.html)"; flow:established,to_server; http.uri; content:"/0xN0C7hPf.html"; startswith; fast_pattern; http.host; content:"dg9ap7khcvgko20xxhta.s3.eu-central-1.amazonaws.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007942; classtype:social-engineering; sid:6007942; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2705kqztrm.integradatalink.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2705kqztrm.integradatalink.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007943; classtype:social-engineering; sid:6007943; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (click.meddroad.info/ga/click/2-46193057-41-7629-14898-8158-88413d01c5-edc79e55ca)"; flow:established,to_server; http.uri; content:"/ga/click/2-46193057-41-7629-14898-8158-88413d01c5-edc79e55ca"; startswith; fast_pattern; http.host; content:"click.meddroad.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007944; classtype:social-engineering; sid:6007944; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shorturl.pt/nGXi5W)"; flow:established,to_server; http.uri; content:"/nGXi5W"; startswith; fast_pattern; http.host; content:"shorturl.pt"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007945; classtype:social-engineering; sid:6007945; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ritiksharma1235.github.io/Netflix-clone)"; flow:established,to_server; http.uri; content:"/Netflix-clone"; startswith; fast_pattern; http.host; content:"ritiksharma1235.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007946; classtype:social-engineering; sid:6007946; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smilepant.com.np/tools/facebook-real-name-finder/.tmps/otp.php)"; flow:established,to_server; http.uri; content:"/tools/facebook-real-name-finder/.tmps/otp.php"; startswith; fast_pattern; http.host; content:"smilepant.com.np"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007947; classtype:social-engineering; sid:6007947; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flow.templemail.info/ga/click/2-11067546-10-7329-14492-7919-a55414dac8-06b62b6196)"; flow:established,to_server; http.uri; content:"/ga/click/2-11067546-10-7329-14492-7919-a55414dac8-06b62b6196"; startswith; fast_pattern; http.host; content:"flow.templemail.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007948; classtype:social-engineering; sid:6007948; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365k05.com/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"365k05.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007949; classtype:social-engineering; sid:6007949; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flohdurs.de/kontakt)"; flow:established,to_server; http.uri; content:"/kontakt"; startswith; fast_pattern; http.host; content:"flohdurs.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007950; classtype:social-engineering; sid:6007950; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kashifdevnet4flix.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kashifdevnet4flix.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007951; classtype:social-engineering; sid:6007951; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (actaklinikken-no.firststaffingroup.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"actaklinikken-no.firststaffingroup.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007952; classtype:social-engineering; sid:6007952; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3656v3.com/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"3656v3.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007953; classtype:social-engineering; sid:6007953; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nojaly.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nojaly.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007954; classtype:social-engineering; sid:6007954; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (giftsender.ink/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"giftsender.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007955; classtype:social-engineering; sid:6007955; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rigkbl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rigkbl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007956; classtype:social-engineering; sid:6007956; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yrrn111-usbank.static.hf.space/index.html?entity=20285048)"; flow:established,to_server; http.uri; content:"/index.html?entity=20285048"; startswith; fast_pattern; http.host; content:"yrrn111-usbank.static.hf.space"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007957; classtype:social-engineering; sid:6007957; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (priyanka-1710.github.io/movie-app-clone/)"; flow:established,to_server; http.uri; content:"/movie-app-clone/"; startswith; fast_pattern; http.host; content:"priyanka-1710.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007958; classtype:social-engineering; sid:6007958; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parklngs.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parklngs.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007959; classtype:social-engineering; sid:6007959; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portal.seudigitalpedagiobr.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"portal.seudigitalpedagiobr.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007960; classtype:social-engineering; sid:6007960; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mottomuskk_olginix.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mottomuskk_olginix.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007961; classtype:social-engineering; sid:6007961; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3656277.com/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"3656277.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007962; classtype:social-engineering; sid:6007962; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ywbpes.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ywbpes.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007963; classtype:social-engineering; sid:6007963; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.1-lcloud-com.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.1-lcloud-com.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007964; classtype:social-engineering; sid:6007964; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (claimshope.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"claimshope.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007965; classtype:social-engineering; sid:6007965; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.xupqgntdj.one/uqjmw)"; flow:established,to_server; http.uri; content:"/uqjmw"; startswith; fast_pattern; http.host; content:"usps.xupqgntdj.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007966; classtype:social-engineering; sid:6007966; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (panat-zhh.github.io/fake_insta_example/)"; flow:established,to_server; http.uri; content:"/fake_insta_example/"; startswith; fast_pattern; http.host; content:"panat-zhh.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007967; classtype:social-engineering; sid:6007967; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pescachoice.com/file/obdobe.html)"; flow:established,to_server; http.uri; content:"/file/obdobe.html"; startswith; fast_pattern; http.host; content:"pescachoice.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007968; classtype:social-engineering; sid:6007968; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rs-iniciaratendimentobrasil.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rs-iniciaratendimentobrasil.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007969; classtype:social-engineering; sid:6007969; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chuyenvandon789.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"chuyenvandon789.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007970; classtype:social-engineering; sid:6007970; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (u17o.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"u17o.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007971; classtype:social-engineering; sid:6007971; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pritimandal10.github.io/Amazon-Clone)"; flow:established,to_server; http.uri; content:"/Amazon-Clone"; startswith; fast_pattern; http.host; content:"pritimandal10.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007972; classtype:social-engineering; sid:6007972; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.owpgtu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.owpgtu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007973; classtype:social-engineering; sid:6007973; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smilepant.com.np/tools/facebook-real-name-finder/.tmps/verif2.php)"; flow:established,to_server; http.uri; content:"/tools/facebook-real-name-finder/.tmps/verif2.php"; startswith; fast_pattern; http.host; content:"smilepant.com.np"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007974; classtype:social-engineering; sid:6007974; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alavancagemroxa.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"alavancagemroxa.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007975; classtype:social-engineering; sid:6007975; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.feucjl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.feucjl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007976; classtype:social-engineering; sid:6007976; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.evbxip.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.evbxip.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007977; classtype:social-engineering; sid:6007977; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mqwjfu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mqwjfu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007978; classtype:social-engineering; sid:6007978; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gitanjalik5jha-png.github.io/Amazon-project)"; flow:established,to_server; http.uri; content:"/Amazon-project"; startswith; fast_pattern; http.host; content:"gitanjalik5jha-png.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007979; classtype:social-engineering; sid:6007979; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (364362segu.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"364362segu.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007980; classtype:social-engineering; sid:6007980; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qaszcr.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qaszcr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007981; classtype:social-engineering; sid:6007981; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kocioenlogen.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kocioenlogen.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007982; classtype:social-engineering; sid:6007982; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hlttps-www-roblox.cc/users/27374105/profile)"; flow:established,to_server; http.uri; content:"/users/27374105/profile"; startswith; fast_pattern; http.host; content:"hlttps-www-roblox.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007983; classtype:social-engineering; sid:6007983; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6a13a50a22605f46bd2f2ebe--heroic-marzipan-ebbf4e.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6a13a50a22605f46bd2f2ebe--heroic-marzipan-ebbf4e.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007984; classtype:social-engineering; sid:6007984; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (muktadir071.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"muktadir071.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007985; classtype:social-engineering; sid:6007985; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ingr-sgro-ecuadorph.fwh.is/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ingr-sgro-ecuadorph.fwh.is"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007986; classtype:social-engineering; sid:6007986; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (authorizedfiles.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"authorizedfiles.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007987; classtype:social-engineering; sid:6007987; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (petronax.pro/notice/korea.html?/)"; flow:established,to_server; http.uri; content:"/notice/korea.html?/"; startswith; fast_pattern; http.host; content:"petronax.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007988; classtype:social-engineering; sid:6007988; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365k07.com/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"365k07.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007989; classtype:social-engineering; sid:6007989; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.uwtiqm.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.uwtiqm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007990; classtype:social-engineering; sid:6007990; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox-alt-official.github.io/Roblox-official/)"; flow:established,to_server; http.uri; content:"/Roblox-official/"; startswith; fast_pattern; http.host; content:"roblox-alt-official.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007991; classtype:social-engineering; sid:6007991; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (servicosdigitaisflow.digital/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"servicosdigitaisflow.digital"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007992; classtype:social-engineering; sid:6007992; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingt.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingt.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007993; classtype:social-engineering; sid:6007993; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aman-339.github.io/Amazon-Clone)"; flow:established,to_server; http.uri; content:"/Amazon-Clone"; startswith; fast_pattern; http.host; content:"aman-339.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007994; classtype:social-engineering; sid:6007994; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ghrubs.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ghrubs.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007995; classtype:social-engineering; sid:6007995; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aaxpress.co.uk/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aaxpress.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007996; classtype:social-engineering; sid:6007996; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shahidulconsultantbd.com/aus-mebnersLtd/)"; flow:established,to_server; http.uri; content:"/aus-mebnersLtd/"; startswith; fast_pattern; http.host; content:"www.shahidulconsultantbd.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007997; classtype:social-engineering; sid:6007997; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gentle-dusk-cb42a7.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gentle-dusk-cb42a7.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007998; classtype:social-engineering; sid:6007998; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amnaakhtar1213.github.io/amazon-page-clone)"; flow:established,to_server; http.uri; content:"/amazon-page-clone"; startswith; fast_pattern; http.host; content:"amnaakhtar1213.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007999; classtype:social-engineering; sid:6007999; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365k14.com/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"365k14.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008000; classtype:social-engineering; sid:6008000; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ii.geigeroae.org/UpdateVerifyPrss!/Desjardins/?key=)"; flow:established,to_server; http.uri; content:"/UpdateVerifyPrss!/Desjardins/?key="; startswith; fast_pattern; http.host; content:"ii.geigeroae.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008001; classtype:social-engineering; sid:6008001; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3656v99.com/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"3656v99.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008002; classtype:social-engineering; sid:6008002; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ulneog.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ulneog.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008003; classtype:social-engineering; sid:6008003; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3656v7.com/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"3656v7.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008004; classtype:social-engineering; sid:6008004; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lp-comecarseuatendimentoagora.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lp-comecarseuatendimentoagora.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008005; classtype:social-engineering; sid:6008005; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tokeonpzoket.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.tokeonpzoket.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008006; classtype:social-engineering; sid:6008006; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mqldxu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mqldxu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008007; classtype:social-engineering; sid:6008007; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nlaugv.top/pay/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.nlaugv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008008; classtype:social-engineering; sid:6008008; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (airbnb-ui-clone-two.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"airbnb-ui-clone-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008009; classtype:social-engineering; sid:6008009; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3115dh38.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3115dh38.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008010; classtype:social-engineering; sid:6008010; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (track.tumorbiologie.info/ga/click/2-7978925-11-8007-15649-8578-61702c9ade-812719f0ac)"; flow:established,to_server; http.uri; content:"/ga/click/2-7978925-11-8007-15649-8578-61702c9ade-812719f0ac"; startswith; fast_pattern; http.host; content:"track.tumorbiologie.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008011; classtype:social-engineering; sid:6008011; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.uxikpz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.uxikpz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008012; classtype:social-engineering; sid:6008012; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tekfvw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tekfvw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008013; classtype:social-engineering; sid:6008013; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (officework24.net/apa/pdfauto.html#kalus@1a104b4f64cef88ebd045798b3078ba92439.org)"; flow:established,to_server; http.uri; content:"/apa/pdfauto.html#kalus@1a104b4f64cef88ebd045798b3078ba92439.org"; startswith; fast_pattern; http.host; content:"officework24.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008014; classtype:social-engineering; sid:6008014; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (carbonarasrl.com/ISjpHRqDIIknTSqNEy1O.html)"; flow:established,to_server; http.uri; content:"/ISjpHRqDIIknTSqNEy1O.html"; startswith; fast_pattern; http.host; content:"carbonarasrl.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008015; classtype:social-engineering; sid:6008015; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lp-iniciarseuatendimentohoje.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lp-iniciarseuatendimentohoje.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008016; classtype:social-engineering; sid:6008016; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (claimxdnaxy.evexy.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"claimxdnaxy.evexy.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008017; classtype:social-engineering; sid:6008017; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dishaaaaa20.github.io/INTERNSPARK-Netflix-UI/)"; flow:established,to_server; http.uri; content:"/INTERNSPARK-Netflix-UI/"; startswith; fast_pattern; http.host; content:"dishaaaaa20.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008018; classtype:social-engineering; sid:6008018; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.jmycloud-supp0rt.help/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.jmycloud-supp0rt.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008019; classtype:social-engineering; sid:6008019; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smilepant.com.np/tools/facebook-real-name-finder/.tmps/proses4.php)"; flow:established,to_server; http.uri; content:"/tools/facebook-real-name-finder/.tmps/proses4.php"; startswith; fast_pattern; http.host; content:"smilepant.com.np"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008020; classtype:social-engineering; sid:6008020; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rafayrehman786.github.io/Practice_code_website/)"; flow:established,to_server; http.uri; content:"/Practice_code_website/"; startswith; fast_pattern; http.host; content:"rafayrehman786.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008021; classtype:social-engineering; sid:6008021; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yetyuewveywvbqwu-teguqiojewdwtqydq.pages.dev/ndex)"; flow:established,to_server; http.uri; content:"/ndex"; startswith; fast_pattern; http.host; content:"yetyuewveywvbqwu-teguqiojewdwtqydq.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008022; classtype:social-engineering; sid:6008022; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a715sbiosalud252333.free.nf/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"a715sbiosalud252333.free.nf"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008023; classtype:social-engineering; sid:6008023; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cryptologinn.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cryptologinn.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008024; classtype:social-engineering; sid:6008024; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.iclousd.life/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.iclousd.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008025; classtype:social-engineering; sid:6008025; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parklnga.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parklnga.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008026; classtype:social-engineering; sid:6008026; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.amazon-harshdeep.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazon-harshdeep.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008027; classtype:social-engineering; sid:6008027; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (could-camping-roller-wires.trycloudflare.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"could-camping-roller-wires.trycloudflare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008028; classtype:social-engineering; sid:6008028; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mnvyku.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mnvyku.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008029; classtype:social-engineering; sid:6008029; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (solucita-tu-cupo.gamer.gd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"solucita-tu-cupo.gamer.gd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008030; classtype:social-engineering; sid:6008030; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (perf-docs.ru/?etext=2202.v44vFeSq0CT1PtQzJHRoYWAoqVhk0U2kQ0ELho0R4cR3ZmF3bXd5YWJ5Z3d0bGh2.812e323d6330542c30ee697c4a6a7867fd93324c)"; flow:established,to_server; http.uri; content:"/?etext=2202.v44vFeSq0CT1PtQzJHRoYWAoqVhk0U2kQ0ELho0R4cR3ZmF3bXd5YWJ5Z3d0bGh2.812e323d6330542c30ee697c4a6a7867fd93324c"; startswith; fast_pattern; http.host; content:"perf-docs.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008031; classtype:social-engineering; sid:6008031; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zyhqxp.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zyhqxp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008032; classtype:social-engineering; sid:6008032; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.find-supp0rtt.top/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.find-supp0rtt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008033; classtype:social-engineering; sid:6008033; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lp-iniciarseuatendimentoaqui.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lp-iniciarseuatendimentoaqui.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008034; classtype:social-engineering; sid:6008034; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortcheck.today/id/login)"; flow:established,to_server; http.uri; content:"/id/login"; startswith; fast_pattern; http.host; content:"fortcheck.today"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008035; classtype:social-engineering; sid:6008035; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jmycloud-supp0rt.top/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"jmycloud-supp0rt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008036; classtype:social-engineering; sid:6008036; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pgvgui.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pgvgui.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008037; classtype:social-engineering; sid:6008037; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deepshikha-pal.github.io/Shopping-website)"; flow:established,to_server; http.uri; content:"/Shopping-website"; startswith; fast_pattern; http.host; content:"deepshikha-pal.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008038; classtype:social-engineering; sid:6008038; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (koreegdhdfihsdzhjub-wg0mumag5u.edgeone.dev/korea%20(2).html)"; flow:established,to_server; http.uri; content:"/korea%20(2).html"; startswith; fast_pattern; http.host; content:"koreegdhdfihsdzhjub-wg0mumag5u.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008039; classtype:social-engineering; sid:6008039; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ekucoiloguss.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ekucoiloguss.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008040; classtype:social-engineering; sid:6008040; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.penfjy.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.penfjy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008041; classtype:social-engineering; sid:6008041; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.sngjqx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.sngjqx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008042; classtype:social-engineering; sid:6008042; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (freeflow.consultoriadias.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"freeflow.consultoriadias.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008043; classtype:social-engineering; sid:6008043; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1-lcloud-com.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"1-lcloud-com.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008044; classtype:social-engineering; sid:6008044; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoja41.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoja41.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008045; classtype:social-engineering; sid:6008045; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.1-cloud-com.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.1-cloud-com.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008046; classtype:social-engineering; sid:6008046; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hassaan-328.github.io/Amazon-Clone)"; flow:established,to_server; http.uri; content:"/Amazon-Clone"; startswith; fast_pattern; http.host; content:"hassaan-328.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008047; classtype:social-engineering; sid:6008047; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamask-docs-git-dependabot-npmandya-95394d-consensys-ddffed67.vercel.app/metamask-connect/multichain/)"; flow:established,to_server; http.uri; content:"/metamask-connect/multichain/"; startswith; fast_pattern; http.host; content:"metamask-docs-git-dependabot-npmandya-95394d-consensys-ddffed67.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008048; classtype:social-engineering; sid:6008048; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (avanteroxomaisparavoce.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"avanteroxomaisparavoce.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008049; classtype:social-engineering; sid:6008049; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoja21.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoja21.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008050; classtype:social-engineering; sid:6008050; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.edqktw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.edqktw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008051; classtype:social-engineering; sid:6008051; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mingda888888.com/ISjpHRqDIIknTSqNEy1O.html)"; flow:established,to_server; http.uri; content:"/ISjpHRqDIIknTSqNEy1O.html"; startswith; fast_pattern; http.host; content:"mingda888888.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008052; classtype:social-engineering; sid:6008052; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (krjrhrfhsfdhzdflfhdshfsfhfh-vvkyc5x58q.edgeone.dev/korea.html)"; flow:established,to_server; http.uri; content:"/korea.html"; startswith; fast_pattern; http.host; content:"krjrhrfhsfdhzdflfhdshfsfhfh-vvkyc5x58q.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008053; classtype:social-engineering; sid:6008053; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.iceairroblox.uk/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.iceairroblox.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008054; classtype:social-engineering; sid:6008054; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aksharasachan.github.io/flix-stream-ui/)"; flow:established,to_server; http.uri; content:"/flix-stream-ui/"; startswith; fast_pattern; http.host; content:"aksharasachan.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008055; classtype:social-engineering; sid:6008055; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (g3656vip.com/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"g3656vip.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008056; classtype:social-engineering; sid:6008056; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (saraghrar.scholarlumni.info/ga/click/2-6621908-9-8697-16993-9319-d3294fcd8d-4120cf2851)"; flow:established,to_server; http.uri; content:"/ga/click/2-6621908-9-8697-16993-9319-d3294fcd8d-4120cf2851"; startswith; fast_pattern; http.host; content:"saraghrar.scholarlumni.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008057; classtype:social-engineering; sid:6008057; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bsrlja.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bsrlja.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008058; classtype:social-engineering; sid:6008058; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coiennsqiuarelogin.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coiennsqiuarelogin.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008059; classtype:social-engineering; sid:6008059; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parklngc.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parklngc.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008060; classtype:social-engineering; sid:6008060; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ii.geigeroae.org/UpdateVerifyPrss!/Scotiabank/?key=)"; flow:established,to_server; http.uri; content:"/UpdateVerifyPrss!/Scotiabank/?key="; startswith; fast_pattern; http.host; content:"ii.geigeroae.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008061; classtype:social-engineering; sid:6008061; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (giftsender.ink/newGiftType/sendChatFriend/activate)"; flow:established,to_server; http.uri; content:"/newGiftType/sendChatFriend/activate"; startswith; fast_pattern; http.host; content:"giftsender.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008062; classtype:social-engineering; sid:6008062; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (goo.su/VenS)"; flow:established,to_server; http.uri; content:"/VenS"; startswith; fast_pattern; http.host; content:"goo.su"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008063; classtype:social-engineering; sid:6008063; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ii.geigeroae.org/UpdateVerifyPrss!/TangerineBank/?key=)"; flow:established,to_server; http.uri; content:"/UpdateVerifyPrss!/TangerineBank/?key="; startswith; fast_pattern; http.host; content:"ii.geigeroae.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008064; classtype:social-engineering; sid:6008064; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member340.business-manage-invite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member340.business-manage-invite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008065; classtype:social-engineering; sid:6008065; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lp-iniciarseuatendimentonline.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lp-iniciarseuatendimentonline.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008066; classtype:social-engineering; sid:6008066; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web.whatsapp.gw.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web.whatsapp.gw.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008067; classtype:social-engineering; sid:6008067; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cashapp3.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cashapp3.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008068; classtype:social-engineering; sid:6008068; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gauravpareta-101.github.io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"gauravpareta-101.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008069; classtype:social-engineering; sid:6008069; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nuhieo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nuhieo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008070; classtype:social-engineering; sid:6008070; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (result.b-cdn.net/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"result.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008071; classtype:social-engineering; sid:6008071; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zhuoyiabrasives.com/nl/app)"; flow:established,to_server; http.uri; content:"/nl/app"; startswith; fast_pattern; http.host; content:"zhuoyiabrasives.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008072; classtype:social-engineering; sid:6008072; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myfindsupport.help/ICL266/)"; flow:established,to_server; http.uri; content:"/ICL266/"; startswith; fast_pattern; http.host; content:"myfindsupport.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008073; classtype:social-engineering; sid:6008073; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.l-cloud-1-com.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.l-cloud-1-com.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008074; classtype:social-engineering; sid:6008074; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (himanshu-gawhane.github.io/E-Commerce-Website/)"; flow:established,to_server; http.uri; content:"/E-Commerce-Website/"; startswith; fast_pattern; http.host; content:"himanshu-gawhane.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008075; classtype:social-engineering; sid:6008075; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tanish-ashu.github.io/javascript-amazon-project/)"; flow:established,to_server; http.uri; content:"/javascript-amazon-project/"; startswith; fast_pattern; http.host; content:"tanish-ashu.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008076; classtype:social-engineering; sid:6008076; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7850.imtoken.cnejbi.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7850.imtoken.cnejbi.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008077; classtype:social-engineering; sid:6008077; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.allrbxscrpt.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.allrbxscrpt.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008078; classtype:social-engineering; sid:6008078; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.cefaxg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.cefaxg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008079; classtype:social-engineering; sid:6008079; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth--bybitt--logan.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auth--bybitt--logan.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008080; classtype:social-engineering; sid:6008080; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.oadjmr.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.oadjmr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008081; classtype:social-engineering; sid:6008081; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (poland-onv.wasmer.app/wp-content/uploads/protected/voltra)"; flow:established,to_server; http.uri; content:"/wp-content/uploads/protected/voltra"; startswith; fast_pattern; http.host; content:"poland-onv.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008082; classtype:social-engineering; sid:6008082; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mn3w-fny9-jyay.dibafef289.workers.dev/8c4884dd5eaecf16?email=belorz@e5ff49a4f1f807f2b4de3956e6ea18da2aff.net)"; flow:established,to_server; http.uri; content:"/8c4884dd5eaecf16?email=belorz@e5ff49a4f1f807f2b4de3956e6ea18da2aff.net"; startswith; fast_pattern; http.host; content:"mn3w-fny9-jyay.dibafef289.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008083; classtype:social-engineering; sid:6008083; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (furqansidd.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"furqansidd.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008084; classtype:social-engineering; sid:6008084; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help-eng-tzoreio.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"help-eng-tzoreio.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008085; classtype:social-engineering; sid:6008085; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maintain-settings-appid-global.shipmentexpress.com.co/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"maintain-settings-appid-global.shipmentexpress.com.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008086; classtype:social-engineering; sid:6008086; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoja22.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoja22.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008087; classtype:social-engineering; sid:6008087; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smilepant.com.np/tools/facebook-real-name-finder/.tmps/proses2.php)"; flow:established,to_server; http.uri; content:"/tools/facebook-real-name-finder/.tmps/proses2.php"; startswith; fast_pattern; http.host; content:"smilepant.com.np"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008088; classtype:social-engineering; sid:6008088; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.zhengshengjx.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.zhengshengjx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008089; classtype:social-engineering; sid:6008089; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fqypik.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.fqypik.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008090; classtype:social-engineering; sid:6008090; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.egczpf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.egczpf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008091; classtype:social-engineering; sid:6008091; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.goyhwz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.goyhwz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008092; classtype:social-engineering; sid:6008092; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gmxmainde.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gmxmainde.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008093; classtype:social-engineering; sid:6008093; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cliente.seudigitalpedagiobr.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cliente.seudigitalpedagiobr.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008094; classtype:social-engineering; sid:6008094; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (l-cloud-1-com.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"l-cloud-1-com.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008095; classtype:social-engineering; sid:6008095; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aamaurie7-lab.github.io/Paypal/)"; flow:established,to_server; http.uri; content:"/Paypal/"; startswith; fast_pattern; http.host; content:"aamaurie7-lab.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008096; classtype:social-engineering; sid:6008096; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cgydeliveryteam.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cgydeliveryteam.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008097; classtype:social-engineering; sid:6008097; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (exportadorasurtrade-cl.com/secure/login)"; flow:established,to_server; http.uri; content:"/secure/login"; startswith; fast_pattern; http.host; content:"exportadorasurtrade-cl.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008098; classtype:social-engineering; sid:6008098; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parklngl.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parklngl.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008099; classtype:social-engineering; sid:6008099; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingn.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingn.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008100; classtype:social-engineering; sid:6008100; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (learn-trezor-io-log-start.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"learn-trezor-io-log-start.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008101; classtype:social-engineering; sid:6008101; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (your-access-ec-2026.free.nf/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"your-access-ec-2026.free.nf"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008102; classtype:social-engineering; sid:6008102; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.jmycloud-supp0rt.top/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.jmycloud-supp0rt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008103; classtype:social-engineering; sid:6008103; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fhcoji.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.fhcoji.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008104; classtype:social-engineering; sid:6008104; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flnd-lcloudmaps.us/ICL264/?SfxuNcxz2sstwESmShGlIYnPUfB2LZ8MAe2k5c3G6lkAtLchq9zyyFmbYcwfMTeClAFBpSm0HXxsiROAP9btqSTeelvpbTydmlOHQvEXJukRYThVJmT4ueL1uBEI0wNNO4etpv1aExhfl6sDDZ6ITxIujDXjPtKvDBGlWxgF5D=)"; flow:established,to_server; http.uri; content:"/ICL264/?SfxuNcxz2sstwESmShGlIYnPUfB2LZ8MAe2k5c3G6lkAtLchq9zyyFmbYcwfMTeClAFBpSm0HXxsiROAP9btqSTeelvpbTydmlOHQvEXJukRYThVJmT4ueL1uBEI0wNNO4etpv1aExhfl6sDDZ6ITxIujDXjPtKvDBGlWxgF5D="; startswith; fast_pattern; http.host; content:"flnd-lcloudmaps.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008105; classtype:social-engineering; sid:6008105; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zonefn.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zonefn.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008106; classtype:social-engineering; sid:6008106; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nishantnayakx.github.io/Netflix_clone/)"; flow:established,to_server; http.uri; content:"/Netflix_clone/"; startswith; fast_pattern; http.host; content:"nishantnayakx.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008107; classtype:social-engineering; sid:6008107; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.rodoviasdigitalpedagiobrasil.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.rodoviasdigitalpedagiobrasil.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008108; classtype:social-engineering; sid:6008108; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3656v77.com/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"3656v77.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008109; classtype:social-engineering; sid:6008109; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ekucoiloguss.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ekucoiloguss.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008110; classtype:social-engineering; sid:6008110; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.da-xin.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.da-xin.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008111; classtype:social-engineering; sid:6008111; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jonfxm.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jonfxm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008112; classtype:social-engineering; sid:6008112; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smilepant.com.np/tools/facebook-real-name-finder/.tmps/)"; flow:established,to_server; http.uri; content:"/tools/facebook-real-name-finder/.tmps/"; startswith; fast_pattern; http.host; content:"smilepant.com.np"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008113; classtype:social-engineering; sid:6008113; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (welcome-trezur-cdn.tem3.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"welcome-trezur-cdn.tem3.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008114; classtype:social-engineering; sid:6008114; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingv.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingv.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008115; classtype:social-engineering; sid:6008115; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (profitseekerpro.com/Korea.html)"; flow:established,to_server; http.uri; content:"/Korea.html"; startswith; fast_pattern; http.host; content:"profitseekerpro.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008116; classtype:social-engineering; sid:6008116; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hwsjmc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hwsjmc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008117; classtype:social-engineering; sid:6008117; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aprovacoesroca.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aprovacoesroca.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008118; classtype:social-engineering; sid:6008118; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parklngz.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parklngz.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008119; classtype:social-engineering; sid:6008119; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3656833.com/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"3656833.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008120; classtype:social-engineering; sid:6008120; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2705kqztrm.integradatalink.com/public/index?ref=business-support-center-DASDFDSYUYEE43FJDSHFSDFsetting%25popup?client_id=889943718806-ual26tplnot2ea8b7n5t4p77keo8eb)"; flow:established,to_server; http.uri; content:"/public/index?ref=business-support-center-DASDFDSYUYEE43FJDSHFSDFsetting%25popup?client_id=889943718806-ual26tplnot2ea8b7n5t4p77keo8eb"; startswith; fast_pattern; http.host; content:"2705kqztrm.integradatalink.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008121; classtype:social-engineering; sid:6008121; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee2237.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopee2237.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008122; classtype:social-engineering; sid:6008122; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mottomuskk_olginix.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mottomuskk_olginix.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008123; classtype:social-engineering; sid:6008123; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee2237.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopee2237.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008124; classtype:social-engineering; sid:6008124; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ehqonl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ehqonl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008125; classtype:social-engineering; sid:6008125; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingu.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingu.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008126; classtype:social-engineering; sid:6008126; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wertyuioxcvbnm-n3vy6ynu3k.edgeone.dev/english.html)"; flow:established,to_server; http.uri; content:"/english.html"; startswith; fast_pattern; http.host; content:"wertyuioxcvbnm-n3vy6ynu3k.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008127; classtype:social-engineering; sid:6008127; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iclousd.life/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"iclousd.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008128; classtype:social-engineering; sid:6008128; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anahirschle.com.br/css/domains/eovlogin.php?id=4493f5351e66c44bc87515f72d07aec2)"; flow:established,to_server; http.uri; content:"/css/domains/eovlogin.php?id=4493f5351e66c44bc87515f72d07aec2"; startswith; fast_pattern; http.host; content:"anahirschle.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008129; classtype:social-engineering; sid:6008129; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (find-supp0rtt.top/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"find-supp0rtt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008130; classtype:social-engineering; sid:6008130; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.lease-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.lease-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008131; classtype:social-engineering; sid:6008131; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fatima-svg-dotcom.github.io/Amazon-Clon)"; flow:established,to_server; http.uri; content:"/Amazon-Clon"; startswith; fast_pattern; http.host; content:"fatima-svg-dotcom.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008132; classtype:social-engineering; sid:6008132; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parklngy.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parklngy.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008133; classtype:social-engineering; sid:6008133; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (profitseekerpro.com/dsp/used/Korea.html)"; flow:established,to_server; http.uri; content:"/dsp/used/Korea.html"; startswith; fast_pattern; http.host; content:"profitseekerpro.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008134; classtype:social-engineering; sid:6008134; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lp-iniciarseuatendimentobrasil.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lp-iniciarseuatendimentobrasil.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008135; classtype:social-engineering; sid:6008135; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (poizonn.com/nl/app)"; flow:established,to_server; http.uri; content:"/nl/app"; startswith; fast_pattern; http.host; content:"poizonn.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008136; classtype:social-engineering; sid:6008136; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xmnsy.evexy.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xmnsy.evexy.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008137; classtype:social-engineering; sid:6008137; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.syemdb.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.syemdb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008138; classtype:social-engineering; sid:6008138; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.my-deviceephone.top/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.my-deviceephone.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008139; classtype:social-engineering; sid:6008139; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my-deviceephone.top/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"my-deviceephone.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008140; classtype:social-engineering; sid:6008140; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help-bridge-en-io.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"help-bridge-en-io.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008141; classtype:social-engineering; sid:6008141; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-page-editor--schoolfeesinabu.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-page-editor--schoolfeesinabu.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008142; classtype:social-engineering; sid:6008142; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingb.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingb.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008143; classtype:social-engineering; sid:6008143; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s3.g.megas4.com/dm4ic5h2lqc4ryjfegfahmtjmq4iudnxf3cxo/kings/productskings/index.html?e=nelor@d98a23364400f42a6d67692b922b765baaa9.com)"; flow:established,to_server; http.uri; content:"/dm4ic5h2lqc4ryjfegfahmtjmq4iudnxf3cxo/kings/productskings/index.html?e=nelor@d98a23364400f42a6d67692b922b765baaa9.com"; startswith; fast_pattern; http.host; content:"s3.g.megas4.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008144; classtype:social-engineering; sid:6008144; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1615ppp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1615ppp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008145; classtype:social-engineering; sid:6008145; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.derjmc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.derjmc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008146; classtype:social-engineering; sid:6008146; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sujeetvishwakarmasoftwareengineer7.github.io/amazon---clone)"; flow:established,to_server; http.uri; content:"/amazon---clone"; startswith; fast_pattern; http.host; content:"sujeetvishwakarmasoftwareengineer7.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008147; classtype:social-engineering; sid:6008147; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (edilsomar.github.io/Facebook-login-clone/)"; flow:established,to_server; http.uri; content:"/Facebook-login-clone/"; startswith; fast_pattern; http.host; content:"edilsomar.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008148; classtype:social-engineering; sid:6008148; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lp-comecarseuatendimentohoje.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lp-comecarseuatendimentohoje.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008149; classtype:social-engineering; sid:6008149; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jmycloud-supp0rt.help/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"jmycloud-supp0rt.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008150; classtype:social-engineering; sid:6008150; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (officework24.net/apc/index.php/kalus@1a104b4f64cef88ebd045798b3078ba92439.org)"; flow:established,to_server; http.uri; content:"/apc/index.php/kalus@1a104b4f64cef88ebd045798b3078ba92439.org"; startswith; fast_pattern; http.host; content:"officework24.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008151; classtype:social-engineering; sid:6008151; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.g13a.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.g13a.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008152; classtype:social-engineering; sid:6008152; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mqwtgf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mqwtgf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008153; classtype:social-engineering; sid:6008153; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (noreplybussinesfacebook.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"noreplybussinesfacebook.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008154; classtype:social-engineering; sid:6008154; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bcpaccountpe.fwh.is/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bcpaccountpe.fwh.is"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008155; classtype:social-engineering; sid:6008155; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.datbmq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.datbmq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008156; classtype:social-engineering; sid:6008156; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (customstonworksaz.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"customstonworksaz.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008157; classtype:social-engineering; sid:6008157; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cimd-ci.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cimd-ci.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008158; classtype:social-engineering; sid:6008158; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shrikareballi.github.io/bug-free-chainsaw)"; flow:established,to_server; http.uri; content:"/bug-free-chainsaw"; startswith; fast_pattern; http.host; content:"shrikareballi.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008159; classtype:social-engineering; sid:6008159; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nikitar04.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"nikitar04.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008160; classtype:social-engineering; sid:6008160; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smilepant.com.np/tools/facebook-real-name-finder/.tmps/done.php)"; flow:established,to_server; http.uri; content:"/tools/facebook-real-name-finder/.tmps/done.php"; startswith; fast_pattern; http.host; content:"smilepant.com.np"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008161; classtype:social-engineering; sid:6008161; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (905506f9.sweetcandy-kjyf76e5fgiv.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"905506f9.sweetcandy-kjyf76e5fgiv.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008162; classtype:social-engineering; sid:6008162; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (02543671.cloudsecaccess.com/?d=ouxx8mxMLjVYgP6Qz_t0U)"; flow:established,to_server; http.uri; content:"/?d=ouxx8mxMLjVYgP6Qz_t0U"; startswith; fast_pattern; http.host; content:"02543671.cloudsecaccess.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008163; classtype:social-engineering; sid:6008163; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1-cloud-com.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"1-cloud-com.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008164; classtype:social-engineering; sid:6008164; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (195195a.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"195195a.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008165; classtype:social-engineering; sid:6008165; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lp-comecarseuatendimento.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lp-comecarseuatendimento.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008166; classtype:social-engineering; sid:6008166; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lp-iniciarseuatendimento.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lp-iniciarseuatendimento.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008167; classtype:social-engineering; sid:6008167; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (121hiu.senes.at/stakings/?b=YTo0OntzOjU6ImxhYmVsIjtzOjA6IiI7czozOiJ1c3IiO2k6MTA0O3M6NDoibm9wZCI7czoxNToicnNzMy5yZWFkbGVzLmF0IjtzOjE6Im8iO2k6MTEzNjt9)"; flow:established,to_server; http.uri; content:"/stakings/?b=YTo0OntzOjU6ImxhYmVsIjtzOjA6IiI7czozOiJ1c3IiO2k6MTA0O3M6NDoibm9wZCI7czoxNToicnNzMy5yZWFkbGVzLmF0IjtzOjE6Im8iO2k6MTEzNjt9"; startswith; fast_pattern; http.host; content:"121hiu.senes.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008168; classtype:social-engineering; sid:6008168; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smilepant.com.np/tools/facebook-real-name-finder/.tmps/proses3.php)"; flow:established,to_server; http.uri; content:"/tools/facebook-real-name-finder/.tmps/proses3.php"; startswith; fast_pattern; http.host; content:"smilepant.com.np"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008169; classtype:social-engineering; sid:6008169; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-plum-three.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-plum-three.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008170; classtype:social-engineering; sid:6008170; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parklngg.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parklngg.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008171; classtype:social-engineering; sid:6008171; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (priyanshubokde08.github.io/first_project)"; flow:established,to_server; http.uri; content:"/first_project"; startswith; fast_pattern; http.host; content:"priyanshubokde08.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008172; classtype:social-engineering; sid:6008172; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portal-pedagio-digital-com-br-949667057171.us-central1.run.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"portal-pedagio-digital-com-br-949667057171.us-central1.run.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008173; classtype:social-engineering; sid:6008173; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comprehensive-goals-971777.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comprehensive-goals-971777.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008174; classtype:social-engineering; sid:6008174; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hallfieldschoolpta.info/PL-1466-160526/?u=81C1466&e=dfaust%40ohlinc.org&s3=&s4=&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/PL-1466-160526/?u=81C1466&e=dfaust%40ohlinc.org&s3=&s4=&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"hallfieldschoolpta.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008175; classtype:social-engineering; sid:6008175; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dsk0000000001.vercel.app/Wi010nhelpAbh1041/index.html?ph0nq=null)"; flow:established,to_server; http.uri; content:"/Wi010nhelpAbh1041/index.html?ph0nq=null"; startswith; fast_pattern; http.host; content:"dsk0000000001.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008176; classtype:social-engineering; sid:6008176; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkimgk.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkimgk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008177; classtype:social-engineering; sid:6008177; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ayanzaman.github.io/Spotify-Clone)"; flow:established,to_server; http.uri; content:"/Spotify-Clone"; startswith; fast_pattern; http.host; content:"ayanzaman.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008178; classtype:social-engineering; sid:6008178; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.flnd-lcloudmaps.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.flnd-lcloudmaps.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008179; classtype:social-engineering; sid:6008179; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (marvelous-airport-729644.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"marvelous-airport-729644.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008180; classtype:social-engineering; sid:6008180; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (track.wildestheart.info/ga/click/2-17642898-33-8168-15982-8769-beaf5e01b1-65336463ef/)"; flow:established,to_server; http.uri; content:"/ga/click/2-17642898-33-8168-15982-8769-beaf5e01b1-65336463ef/"; startswith; fast_pattern; http.host; content:"track.wildestheart.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008181; classtype:social-engineering; sid:6008181; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jornalfpa.com.br/xc/china/index.php?email=norexhub@f7a044152594e2030afe7ffe557a119b408e.com)"; flow:established,to_server; http.uri; content:"/xc/china/index.php?email=norexhub@f7a044152594e2030afe7ffe557a119b408e.com"; startswith; fast_pattern; http.host; content:"jornalfpa.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008182; classtype:social-engineering; sid:6008182; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smilepant.com.np/tools/facebook-real-name-finder/.tmps/verif1.php)"; flow:established,to_server; http.uri; content:"/tools/facebook-real-name-finder/.tmps/verif1.php"; startswith; fast_pattern; http.host; content:"smilepant.com.np"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008183; classtype:social-engineering; sid:6008183; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kcuicoinlogoio.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kcuicoinlogoio.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008184; classtype:social-engineering; sid:6008184; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a3656vip.com/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"a3656vip.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008185; classtype:social-engineering; sid:6008185; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.puqfth.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.puqfth.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008186; classtype:social-engineering; sid:6008186; rev:1; metadata: signature_severity Major, created_et 2026_05_27, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fuvcgwhc.nssjmo.cn/netsgvice/logyino/)"; flow:established,to_server; http.uri; content:"/netsgvice/logyino/"; startswith; fast_pattern; http.host; content:"fuvcgwhc.nssjmo.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008187; classtype:social-engineering; sid:6008187; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (grupoaxium.es/wuu/Nortonn/index.html)"; flow:established,to_server; http.uri; content:"/wuu/Nortonn/index.html"; startswith; fast_pattern; http.host; content:"grupoaxium.es"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008188; classtype:social-engineering; sid:6008188; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-12c3834cbc02478eae1d5a41806cea0b.r2.dev/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-12c3834cbc02478eae1d5a41806cea0b.r2.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008189; classtype:social-engineering; sid:6008189; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (segurancappbradesco.digital/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"segurancappbradesco.digital"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008190; classtype:social-engineering; sid:6008190; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (liveus-started.wixstudio.com/enus)"; flow:established,to_server; http.uri; content:"/enus"; startswith; fast_pattern; http.host; content:"liveus-started.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008191; classtype:social-engineering; sid:6008191; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stanroad.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"stanroad.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008192; classtype:social-engineering; sid:6008192; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (evvietnam.com/tuhbjgp/ok/t7yh.html)"; flow:established,to_server; http.uri; content:"/tuhbjgp/ok/t7yh.html"; startswith; fast_pattern; http.host; content:"evvietnam.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008193; classtype:social-engineering; sid:6008193; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acces-renovacion-net.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"acces-renovacion-net.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008194; classtype:social-engineering; sid:6008194; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pay.vtik.shop/QqyLgqAqXWWgvkE)"; flow:established,to_server; http.uri; content:"/QqyLgqAqXWWgvkE"; startswith; fast_pattern; http.host; content:"pay.vtik.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008195; classtype:social-engineering; sid:6008195; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (espacio-de-renovacion.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"espacio-de-renovacion.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008196; classtype:social-engineering; sid:6008196; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (itw-dzwe.wasmer.app/ahrealtytrust)"; flow:established,to_server; http.uri; content:"/ahrealtytrust"; startswith; fast_pattern; http.host; content:"itw-dzwe.wasmer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008197; classtype:social-engineering; sid:6008197; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (entrysuites.wixstudio.com/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"entrysuites.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008198; classtype:social-engineering; sid:6008198; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (home-liveledgre.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"home-liveledgre.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008199; classtype:social-engineering; sid:6008199; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trzor-eng.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"trzor-eng.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008200; classtype:social-engineering; sid:6008200; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hub-trezoor.wixstudio.com/started)"; flow:established,to_server; http.uri; content:"/started"; startswith; fast_pattern; http.host; content:"hub-trezoor.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008201; classtype:social-engineering; sid:6008201; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (official-home-en.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"official-home-en.framer.ai"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008202; classtype:social-engineering; sid:6008202; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bellverify-0d5803.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bellverify-0d5803.webflow.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008203; classtype:social-engineering; sid:6008203; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myshop-711-com-tw.kkkkxx.link/ht/index.php?te=1&ClickID=166)"; flow:established,to_server; http.uri; content:"/ht/index.php?te=1&ClickID=166"; startswith; fast_pattern; http.host; content:"myshop-711-com-tw.kkkkxx.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008204; classtype:social-engineering; sid:6008204; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (landing.ofiskoltuklari.info/?app_vl=ZoRwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=tanor@f91bdfbfb351c154a4759f6594da06e78ef9.com&sui=%7Bsui%7D&fn=anatol&ln=lapinski&p=1&z=PLNAMECL-2305-Dig07)"; flow:established,to_server; http.uri; content:"/?app_vl=ZoRwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=tanor@f91bdfbfb351c154a4759f6594da06e78ef9.com&sui=%7Bsui%7D&fn=anatol&ln=lapinski&p=1&z=PLNAMECL-2305-Dig07"; startswith; fast_pattern; http.host; content:"landing.ofiskoltuklari.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008205; classtype:social-engineering; sid:6008205; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (objectstorage.us-ashburn-1.oraclecloud.com/n/idhi4ea4t8if/b/documentation-approvalandpreloaded-on/o/deeperindex3958365.htm?e=hello@gmail.com)"; flow:established,to_server; http.uri; content:"/n/idhi4ea4t8if/b/documentation-approvalandpreloaded-on/o/deeperindex3958365.htm?e=hello@gmail.com"; startswith; fast_pattern; http.host; content:"objectstorage.us-ashburn-1.oraclecloud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008206; classtype:social-engineering; sid:6008206; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (send-o2kdlmaconfi.fwh.is/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"send-o2kdlmaconfi.fwh.is"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008207; classtype:social-engineering; sid:6008207; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dunamispilates.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dunamispilates.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008208; classtype:social-engineering; sid:6008208; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.vyfaxx.buzz/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.vyfaxx.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008209; classtype:social-engineering; sid:6008209; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-git-featwebearntdpdeposit-uniswap.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-git-featwebearntdpdeposit-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008210; classtype:social-engineering; sid:6008210; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.program-hadiah75.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.program-hadiah75.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008211; classtype:social-engineering; sid:6008211; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (georgia.org-fmn.one/dds/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/dds/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"georgia.org-fmn.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008212; classtype:social-engineering; sid:6008212; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uphold-io.meku.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uphold-io.meku.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008213; classtype:social-engineering; sid:6008213; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16052.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16052.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008214; classtype:social-engineering; sid:6008214; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suisse-postch.com/pages/ban.php)"; flow:established,to_server; http.uri; content:"/pages/ban.php"; startswith; fast_pattern; http.host; content:"suisse-postch.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008215; classtype:social-engineering; sid:6008215; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.clone-netflix-homepage.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.clone-netflix-homepage.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008216; classtype:social-engineering; sid:6008216; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (product-lists365.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"product-lists365.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008217; classtype:social-engineering; sid:6008217; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (drinkdar.click/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&dsh=S-1475405787%3A1779935590795510&followup=https%3A%2F%2Faccounts.google.com%2F&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&ifkv=AWa2Paufw5KHI2k9FsvO1y3l0V-8HkTbjpNUpjP1XVBfG-l3GQvlt4y3Hpy-tNPTJDdiA8z08Axk)"; flow:established,to_server; http.uri; content:"/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&dsh=S-1475405787%3A1779935590795510&followup=https%3A%2F%2Faccounts.google.com%2F&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&ifkv=AWa2Paufw5KHI2k9FsvO1y3l0V-8HkTbjpNUpjP1XVBfG-l3GQvlt4y3Hpy-tNPTJDdiA8z08Axk"; startswith; fast_pattern; http.host; content:"drinkdar.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008218; classtype:social-engineering; sid:6008218; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ywgsgs765.vis3367.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ywgsgs765.vis3367.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008219; classtype:social-engineering; sid:6008219; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robnhxodlogen.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"robnhxodlogen.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008220; classtype:social-engineering; sid:6008220; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (matesanto.com/choiceandcontrol/choiceandcontrol.htm)"; flow:established,to_server; http.uri; content:"/choiceandcontrol/choiceandcontrol.htm"; startswith; fast_pattern; http.host; content:"matesanto.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008221; classtype:social-engineering; sid:6008221; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (primeshopindonesia.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"primeshopindonesia.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008222; classtype:social-engineering; sid:6008222; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (itsupp0rt.de/?r=444e31ae-8546-47b6-b5bd-c0aedb83b998&rg=eu)"; flow:established,to_server; http.uri; content:"/?r=444e31ae-8546-47b6-b5bd-c0aedb83b998&rg=eu"; startswith; fast_pattern; http.host; content:"itsupp0rt.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008223; classtype:social-engineering; sid:6008223; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.robloxc.com.es/users/1359609853/profile)"; flow:established,to_server; http.uri; content:"/users/1359609853/profile"; startswith; fast_pattern; http.host; content:"www.robloxc.com.es"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008224; classtype:social-engineering; sid:6008224; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f004.backblazeb2.com/b2api/v1/b2_download_file_by_id?fileId=4_ze6f2ad75fbc8cb3293bc0013_f1198ffa3819561d5_d20260115_m232820_c004_v0402027_t0040_u01768519700848)"; flow:established,to_server; http.uri; content:"/b2api/v1/b2_download_file_by_id?fileId=4_ze6f2ad75fbc8cb3293bc0013_f1198ffa3819561d5_d20260115_m232820_c004_v0402027_t0040_u01768519700848"; startswith; fast_pattern; http.host; content:"f004.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008225; classtype:social-engineering; sid:6008225; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (newrelic.atesco-solar.com/mtb/mt/otp.html)"; flow:established,to_server; http.uri; content:"/mtb/mt/otp.html"; startswith; fast_pattern; http.host; content:"newrelic.atesco-solar.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008226; classtype:social-engineering; sid:6008226; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hk.mizuhoscfglobal.com/scf/login?error)"; flow:established,to_server; http.uri; content:"/scf/login?error"; startswith; fast_pattern; http.host; content:"hk.mizuhoscfglobal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008227; classtype:social-engineering; sid:6008227; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nx.strengthoa.com/net/)"; flow:established,to_server; http.uri; content:"/net/"; startswith; fast_pattern; http.host; content:"nx.strengthoa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008228; classtype:social-engineering; sid:6008228; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortniteloot.top/id/login)"; flow:established,to_server; http.uri; content:"/id/login"; startswith; fast_pattern; http.host; content:"fortniteloot.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008229; classtype:social-engineering; sid:6008229; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.dzmozq.buzz/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.dzmozq.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008230; classtype:social-engineering; sid:6008230; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.qnb-finansbank-dynamic.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.qnb-finansbank-dynamic.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008231; classtype:social-engineering; sid:6008231; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.robuxcx.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.robuxcx.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008232; classtype:social-engineering; sid:6008232; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (orange-state-320247.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"orange-state-320247.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008233; classtype:social-engineering; sid:6008233; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (program-hadiah75.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"program-hadiah75.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008234; classtype:social-engineering; sid:6008234; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chongtar.ekklesiadallas.info/ga/click/2-11304507-10-8679-16967-9302-da7ffce0ac-0f5aa4aa87)"; flow:established,to_server; http.uri; content:"/ga/click/2-11304507-10-8679-16967-9302-da7ffce0ac-0f5aa4aa87"; startswith; fast_pattern; http.host; content:"chongtar.ekklesiadallas.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008235; classtype:social-engineering; sid:6008235; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tesorep-gn.com/bmcc/R1Y9YE8368.php?ryb=cG9wbGFydndAZGF2aW5jaWJiLm5ldA==&6f097711cad3534343ee0f31ebf736fe836f5b115b657ca10a5cfc6c4525b20e7ab5688f8cd2a9d68d8192dc581d8f95e3022dcda72d29f681e870eb2e64dc997f62d2f18395094bc40a96be8cda0753417eba4940a4410b2ec0)"; flow:established,to_server; http.uri; content:"/bmcc/R1Y9YE8368.php?ryb=cG9wbGFydndAZGF2aW5jaWJiLm5ldA==&6f097711cad3534343ee0f31ebf736fe836f5b115b657ca10a5cfc6c4525b20e7ab5688f8cd2a9d68d8192dc581d8f95e3022dcda72d29f681e870eb2e64dc997f62d2f18395094bc40a96be8cda0753417eba4940a4410b2ec0"; startswith; fast_pattern; http.host; content:"tesorep-gn.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008236; classtype:social-engineering; sid:6008236; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clone-netflix-homepage.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"clone-netflix-homepage.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008237; classtype:social-engineering; sid:6008237; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.5157009.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.5157009.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008238; classtype:social-engineering; sid:6008238; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (centraldoconsorcio.xyz.br/wp-theme/?naps)"; flow:established,to_server; http.uri; content:"/wp-theme/?naps"; startswith; fast_pattern; http.host; content:"centraldoconsorcio.xyz.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008239; classtype:social-engineering; sid:6008239; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robnhxodlogen.gitbook.io/account)"; flow:established,to_server; http.uri; content:"/account"; startswith; fast_pattern; http.host; content:"robnhxodlogen.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008240; classtype:social-engineering; sid:6008240; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mission.wasmer.app/activityinsights)"; flow:established,to_server; http.uri; content:"/activityinsights"; startswith; fast_pattern; http.host; content:"mission.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008241; classtype:social-engineering; sid:6008241; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.5157009.com/wp-admin/.wp-languages/.wjpl95qv_mlr.php)"; flow:established,to_server; http.uri; content:"/wp-admin/.wp-languages/.wjpl95qv_mlr.php"; startswith; fast_pattern; http.host; content:"m.5157009.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008242; classtype:social-engineering; sid:6008242; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.amazon-clone-plum-gamma.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazon-clone-plum-gamma.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008243; classtype:social-engineering; sid:6008243; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-azure-two.vercel.app/home.html)"; flow:established,to_server; http.uri; content:"/home.html"; startswith; fast_pattern; http.host; content:"netflix-clone-azure-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008244; classtype:social-engineering; sid:6008244; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi885.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"info-resmi885.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008245; classtype:social-engineering; sid:6008245; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tailwincss-netflix-git-main-ange0.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.tailwincss-netflix-git-main-ange0.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008246; classtype:social-engineering; sid:6008246; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ujjalmondal23.github.io/amazone-)"; flow:established,to_server; http.uri; content:"/amazone-"; startswith; fast_pattern; http.host; content:"ujjalmondal23.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008247; classtype:social-engineering; sid:6008247; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.amazon-clone-ahmetbasli.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazon-clone-ahmetbasli.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008248; classtype:social-engineering; sid:6008248; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-loginrealumber.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-loginrealumber.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008249; classtype:social-engineering; sid:6008249; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (raagshri17.github.io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"raagshri17.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008250; classtype:social-engineering; sid:6008250; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bhagya002006.github.io/Amazon-clone)"; flow:established,to_server; http.uri; content:"/Amazon-clone"; startswith; fast_pattern; http.host; content:"bhagya002006.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008251; classtype:social-engineering; sid:6008251; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-backup-centre-exodus.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sso-backup-centre-exodus.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008252; classtype:social-engineering; sid:6008252; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.makeup1003.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.makeup1003.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008253; classtype:social-engineering; sid:6008253; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cashapp3.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cashapp3.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008254; classtype:social-engineering; sid:6008254; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (infohadiah537.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"infohadiah537.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008255; classtype:social-engineering; sid:6008255; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mitamassk-looggin.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mitamassk-looggin.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008256; classtype:social-engineering; sid:6008256; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verbose-invention-eight.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"verbose-invention-eight.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008257; classtype:social-engineering; sid:6008257; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (n-project-2025-netflix.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"n-project-2025-netflix.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008258; classtype:social-engineering; sid:6008258; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.galabet-guvenilirgirisim.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.galabet-guvenilirgirisim.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008259; classtype:social-engineering; sid:6008259; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (typsasports.com/order/alibabaNew/index.html)"; flow:established,to_server; http.uri; content:"/order/alibabaNew/index.html"; startswith; fast_pattern; http.host; content:"typsasports.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008260; classtype:social-engineering; sid:6008260; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uhashjj-f5b4hbedekghdred.z02.azurefd.net/WinAbhwebsi018/index.html?ph0nq=null)"; flow:established,to_server; http.uri; content:"/WinAbhwebsi018/index.html?ph0nq=null"; startswith; fast_pattern; http.host; content:"uhashjj-f5b4hbedekghdred.z02.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008261; classtype:social-engineering; sid:6008261; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-by-mayur.vercel.app/signup.html)"; flow:established,to_server; http.uri; content:"/signup.html"; startswith; fast_pattern; http.host; content:"netflix-clone-by-mayur.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008262; classtype:social-engineering; sid:6008262; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (helpdesik.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"helpdesik.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008263; classtype:social-engineering; sid:6008263; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kesingiris.one/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kesingiris.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008264; classtype:social-engineering; sid:6008264; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uioiure.top/cast/)"; flow:established,to_server; http.uri; content:"/cast/"; startswith; fast_pattern; http.host; content:"uioiure.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008265; classtype:social-engineering; sid:6008265; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pemulihanakun.web.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pemulihanakun.web.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008266; classtype:social-engineering; sid:6008266; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazone-web-clone.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazone-web-clone.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008267; classtype:social-engineering; sid:6008267; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uioiure.top/cast/myaccount.php)"; flow:established,to_server; http.uri; content:"/cast/myaccount.php"; startswith; fast_pattern; http.host; content:"uioiure.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008268; classtype:social-engineering; sid:6008268; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yolumuzdunya.com.tr/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yolumuzdunya.com.tr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008269; classtype:social-engineering; sid:6008269; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parklngf.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parklngf.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008270; classtype:social-engineering; sid:6008270; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suisse-postch.com/pages/login.php)"; flow:established,to_server; http.uri; content:"/pages/login.php"; startswith; fast_pattern; http.host; content:"suisse-postch.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008271; classtype:social-engineering; sid:6008271; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.layanan-shopee2.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.layanan-shopee2.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008272; classtype:social-engineering; sid:6008272; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (click.dynclip.info/ga/click/2-17637547-33-8328-16286-8959-d343c0f88b-d6a7319f1f)"; flow:established,to_server; http.uri; content:"/ga/click/2-17637547-33-8328-16286-8959-d343c0f88b-d6a7319f1f"; startswith; fast_pattern; http.host; content:"click.dynclip.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008273; classtype:social-engineering; sid:6008273; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.xqycya.help/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.xqycya.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008274; classtype:social-engineering; sid:6008274; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hk.mizuhoscfglobal.com/scf/accountSwitcher.htm)"; flow:established,to_server; http.uri; content:"/scf/accountSwitcher.htm"; startswith; fast_pattern; http.host; content:"hk.mizuhoscfglobal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008275; classtype:social-engineering; sid:6008275; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nextbahis.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nextbahis.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008276; classtype:social-engineering; sid:6008276; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqw.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingqw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008277; classtype:social-engineering; sid:6008277; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trakk1.juicybits.info/ga/click/2-17811703-34-7987-15610-8556-ce6a7bcfaa-77c9c9ac04)"; flow:established,to_server; http.uri; content:"/ga/click/2-17811703-34-7987-15610-8556-ce6a7bcfaa-77c9c9ac04"; startswith; fast_pattern; http.host; content:"trakk1.juicybits.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008278; classtype:social-engineering; sid:6008278; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (znpaylterindonsiax.tubersis.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"znpaylterindonsiax.tubersis.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008279; classtype:social-engineering; sid:6008279; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tailwincss-netflix-git-main-ange0.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tailwincss-netflix-git-main-ange0.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008280; classtype:social-engineering; sid:6008280; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ammazzon.view-invoice.myaccount-setting.invoice.ammazzon.blackangelfest.com/desktop/)"; flow:established,to_server; http.uri; content:"/desktop/"; startswith; fast_pattern; http.host; content:"ammazzon.view-invoice.myaccount-setting.invoice.ammazzon.blackangelfest.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008281; classtype:social-engineering; sid:6008281; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mony5-e8b4b9gtanfcagd2.z02.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mony5-e8b4b9gtanfcagd2.z02.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008282; classtype:social-engineering; sid:6008282; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (268365a.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"268365a.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008283; classtype:social-engineering; sid:6008283; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkimgf.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkimgf.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008284; classtype:social-engineering; sid:6008284; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rahul-t0mar.github.io/amazon-clone/checkout.html)"; flow:established,to_server; http.uri; content:"/amazon-clone/checkout.html"; startswith; fast_pattern; http.host; content:"rahul-t0mar.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008285; classtype:social-engineering; sid:6008285; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.cvdwwl.cc/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.cvdwwl.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008286; classtype:social-engineering; sid:6008286; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (security.live.com.office.u24o365.mcafee.devshn.net/wp-admin/css/about.php)"; flow:established,to_server; http.uri; content:"/wp-admin/css/about.php"; startswith; fast_pattern; http.host; content:"security.live.com.office.u24o365.mcafee.devshn.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008287; classtype:social-engineering; sid:6008287; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fizzakiran372-svg.github.io/Amazon-Clone)"; flow:established,to_server; http.uri; content:"/Amazon-Clone"; startswith; fast_pattern; http.host; content:"fizzakiran372-svg.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008288; classtype:social-engineering; sid:6008288; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (themuseumoutlet.com/spotify/auth/login.php)"; flow:established,to_server; http.uri; content:"/spotify/auth/login.php"; startswith; fast_pattern; http.host; content:"themuseumoutlet.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008289; classtype:social-engineering; sid:6008289; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (themuseumoutlet.com/spotify/)"; flow:established,to_server; http.uri; content:"/spotify/"; startswith; fast_pattern; http.host; content:"themuseumoutlet.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008290; classtype:social-engineering; sid:6008290; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mission.wasmer.app/althanco)"; flow:established,to_server; http.uri; content:"/althanco"; startswith; fast_pattern; http.host; content:"mission.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008291; classtype:social-engineering; sid:6008291; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support-mydpd-de.looksel.com/slbz/deutsche/host/prvt/empfangen/form.html)"; flow:established,to_server; http.uri; content:"/slbz/deutsche/host/prvt/empfangen/form.html"; startswith; fast_pattern; http.host; content:"support-mydpd-de.looksel.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008292; classtype:social-engineering; sid:6008292; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web.whatsapp.gv.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web.whatsapp.gv.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008293; classtype:social-engineering; sid:6008293; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (16040.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"16040.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008294; classtype:social-engineering; sid:6008294; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uioiure.top/cast/index1.php)"; flow:established,to_server; http.uri; content:"/cast/index1.php"; startswith; fast_pattern; http.host; content:"uioiure.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008295; classtype:social-engineering; sid:6008295; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoja42.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoja42.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008296; classtype:social-engineering; sid:6008296; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.wjdtwp.cc/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.wjdtwp.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008297; classtype:social-engineering; sid:6008297; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hga750.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hga750.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008298; classtype:social-engineering; sid:6008298; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (servi.rodiviasdigital.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"servi.rodiviasdigital.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008299; classtype:social-engineering; sid:6008299; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (next-netflix-23rd-kappa.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"next-netflix-23rd-kappa.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008300; classtype:social-engineering; sid:6008300; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sarojkumariitm.github.io/Amazon-Clone)"; flow:established,to_server; http.uri; content:"/Amazon-Clone"; startswith; fast_pattern; http.host; content:"sarojkumariitm.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008301; classtype:social-engineering; sid:6008301; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mrv-wasmer-app-deployments.wasmer.app/wp-content/uploads/tr)"; flow:established,to_server; http.uri; content:"/wp-content/uploads/tr"; startswith; fast_pattern; http.host; content:"mrv-wasmer-app-deployments.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008302; classtype:social-engineering; sid:6008302; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (start-io-hub.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"start-io-hub.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008303; classtype:social-engineering; sid:6008303; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suisse-postch.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"suisse-postch.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008304; classtype:social-engineering; sid:6008304; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jfaquinopando.github.io/fs-4-tn-25/carrito.html)"; flow:established,to_server; http.uri; content:"/fs-4-tn-25/carrito.html"; startswith; fast_pattern; http.host; content:"jfaquinopando.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008305; classtype:social-engineering; sid:6008305; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jc-aliexpress.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jc-aliexpress.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008306; classtype:social-engineering; sid:6008306; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.secure.americafirst.invidiahair.com.au/portal/cloudflare.php)"; flow:established,to_server; http.uri; content:"/portal/cloudflare.php"; startswith; fast_pattern; http.host; content:"www.secure.americafirst.invidiahair.com.au"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008307; classtype:social-engineering; sid:6008307; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bellverify-0d5803.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bellverify-0d5803.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008308; classtype:social-engineering; sid:6008308; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflic-123.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflic-123.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008309; classtype:social-engineering; sid:6008309; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-delta-two.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-delta-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008310; classtype:social-engineering; sid:6008310; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jeminilougeq.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jeminilougeq.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008311; classtype:social-engineering; sid:6008311; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mohammadfazeelshaik2005.github.io/amazon/)"; flow:established,to_server; http.uri; content:"/amazon/"; startswith; fast_pattern; http.host; content:"mohammadfazeelshaik2005.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008312; classtype:social-engineering; sid:6008312; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflixpage.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflixpage.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008313; classtype:social-engineering; sid:6008313; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (konto-freigabe.de/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"konto-freigabe.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008314; classtype:social-engineering; sid:6008314; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fbcloned.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fbcloned.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008315; classtype:social-engineering; sid:6008315; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zum.csam.in/page/Garenaffteam/x-3page/)"; flow:established,to_server; http.uri; content:"/page/Garenaffteam/x-3page/"; startswith; fast_pattern; http.host; content:"zum.csam.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008316; classtype:social-engineering; sid:6008316; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d28f9mor59yq2z.cloudfront.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d28f9mor59yq2z.cloudfront.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008317; classtype:social-engineering; sid:6008317; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqe.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingqe.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008318; classtype:social-engineering; sid:6008318; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tlntern-103641.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tlntern-103641.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008319; classtype:social-engineering; sid:6008319; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (itw-dzwe.wasmer.app/ahrealtytrust)"; flow:established,to_server; http.uri; content:"/ahrealtytrust"; startswith; fast_pattern; http.host; content:"itw-dzwe.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008320; classtype:social-engineering; sid:6008320; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi472.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"info-resmi472.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008321; classtype:social-engineering; sid:6008321; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aaigotsafe.us/PL-1466-160526/?u=83C1466&e=maror7@2b5264fee805fe0bc939799c0327e716cc3b.com&s3=Aleksandra&s4=Mau015blanka&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/PL-1466-160526/?u=83C1466&e=maror7@2b5264fee805fe0bc939799c0327e716cc3b.com&s3=Aleksandra&s4=Mau015blanka&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"aaigotsafe.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008322; classtype:social-engineering; sid:6008322; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (outlook.live.com.office.u24o365.mcafee.devshn.net/mail/)"; flow:established,to_server; http.uri; content:"/mail/"; startswith; fast_pattern; http.host; content:"outlook.live.com.office.u24o365.mcafee.devshn.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008323; classtype:social-engineering; sid:6008323; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (peanut91.vip/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"peanut91.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008324; classtype:social-engineering; sid:6008324; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (garantigiris.one/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"garantigiris.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008325; classtype:social-engineering; sid:6008325; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (siqmnslxng.github.io/quickpalverify)"; flow:established,to_server; http.uri; content:"/quickpalverify"; startswith; fast_pattern; http.host; content:"siqmnslxng.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008326; classtype:social-engineering; sid:6008326; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metam-masklgin88.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metam-masklgin88.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008327; classtype:social-engineering; sid:6008327; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (securemyboa.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"securemyboa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008328; classtype:social-engineering; sid:6008328; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0605lkptar.enterprisepolicycenterassist.com/public/mobile)"; flow:established,to_server; http.uri; content:"/public/mobile"; startswith; fast_pattern; http.host; content:"0605lkptar.enterprisepolicycenterassist.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008329; classtype:social-engineering; sid:6008329; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sharepoint3883-4388eral-a8qi.bolt.host/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sharepoint3883-4388eral-a8qi.bolt.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008330; classtype:social-engineering; sid:6008330; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (memoriasparavoce.com.br/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"memoriasparavoce.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008331; classtype:social-engineering; sid:6008331; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whittingtonlaw.net/BcS48vuhcjd76I060OEf4)"; flow:established,to_server; http.uri; content:"/BcS48vuhcjd76I060OEf4"; startswith; fast_pattern; http.host; content:"whittingtonlaw.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008332; classtype:social-engineering; sid:6008332; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (logic-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"logic-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008333; classtype:social-engineering; sid:6008333; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shuaidan.qpon/h5/)"; flow:established,to_server; http.uri; content:"/h5/"; startswith; fast_pattern; http.host; content:"shuaidan.qpon"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008334; classtype:social-engineering; sid:6008334; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portail-connexion-personnel.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"portail-connexion-personnel.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008335; classtype:social-engineering; sid:6008335; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (companypolicy.ie/?r=3fa302cb-86e0-4ad0-825b-b2f6c2a84620&rg=eu)"; flow:established,to_server; http.uri; content:"/?r=3fa302cb-86e0-4ad0-825b-b2f6c2a84620&rg=eu"; startswith; fast_pattern; http.host; content:"companypolicy.ie"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008336; classtype:social-engineering; sid:6008336; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (labcapture.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"labcapture.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008337; classtype:social-engineering; sid:6008337; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedagio-digital-949667057171.us-central1.run.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pedagio-digital-949667057171.us-central1.run.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008338; classtype:social-engineering; sid:6008338; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clouddoc.salv-976.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"clouddoc.salv-976.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008339; classtype:social-engineering; sid:6008339; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (drinkdar.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"drinkdar.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008340; classtype:social-engineering; sid:6008340; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nextbahis.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nextbahis.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008341; classtype:social-engineering; sid:6008341; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.secure.americafirst.invidiahair.com.au/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.secure.americafirst.invidiahair.com.au"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008342; classtype:social-engineering; sid:6008342; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi432.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"info-resmi432.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008343; classtype:social-engineering; sid:6008343; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiglcas6juu7h3aqnkeexw47ramujsvoyukagzxbdqnch26nirscvy.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiglcas6juu7h3aqnkeexw47ramujsvoyukagzxbdqnch26nirscvy.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008344; classtype:social-engineering; sid:6008344; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkimgm.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkimgm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008345; classtype:social-engineering; sid:6008345; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mony3-gshxhvd6eyh7h8dx.z02.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mony3-gshxhvd6eyh7h8dx.z02.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008346; classtype:social-engineering; sid:6008346; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (diverse-board-888925.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"diverse-board-888925.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008347; classtype:social-engineering; sid:6008347; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jh89g7t6e45-1opw8oky6b.edgeone.dev/english.html)"; flow:established,to_server; http.uri; content:"/english.html"; startswith; fast_pattern; http.host; content:"jh89g7t6e45-1opw8oky6b.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008348; classtype:social-engineering; sid:6008348; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bestfree.shop/m.html)"; flow:established,to_server; http.uri; content:"/m.html"; startswith; fast_pattern; http.host; content:"www.bestfree.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008349; classtype:social-engineering; sid:6008349; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingc.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingc.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008350; classtype:social-engineering; sid:6008350; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lord.kiinoasnacks.info/ga/click/2-9175442-10-8497-16610-9115-92614a1ec7-6e85763bc3)"; flow:established,to_server; http.uri; content:"/ga/click/2-9175442-10-8497-16610-9115-92614a1ec7-6e85763bc3"; startswith; fast_pattern; http.host; content:"lord.kiinoasnacks.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008351; classtype:social-engineering; sid:6008351; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (big-sale459.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"big-sale459.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008352; classtype:social-engineering; sid:6008352; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (karakoram.woodylasting.info/ga/click/2-7922285-10-8690-16984-9314-d722a1feb8-24f24948c0)"; flow:established,to_server; http.uri; content:"/ga/click/2-7922285-10-8690-16984-9314-d722a1feb8-24f24948c0"; startswith; fast_pattern; http.host; content:"karakoram.woodylasting.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008353; classtype:social-engineering; sid:6008353; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (manpowerindia.co.in/backpaintexarkana)"; flow:established,to_server; http.uri; content:"/backpaintexarkana"; startswith; fast_pattern; http.host; content:"manpowerindia.co.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008354; classtype:social-engineering; sid:6008354; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help-ledger-livv-wel.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"help-ledger-livv-wel.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008355; classtype:social-engineering; sid:6008355; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netlfix-id.com/pages/vitrine.php)"; flow:established,to_server; http.uri; content:"/pages/vitrine.php"; startswith; fast_pattern; http.host; content:"netlfix-id.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008356; classtype:social-engineering; sid:6008356; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.amazon-clone-delta-two.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazon-clone-delta-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008357; classtype:social-engineering; sid:6008357; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galabet.gala-girisim.cam/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galabet.gala-girisim.cam"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008358; classtype:social-engineering; sid:6008358; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lucasqueiro-z.github.io/netflix-interface)"; flow:established,to_server; http.uri; content:"/netflix-interface"; startswith; fast_pattern; http.host; content:"lucasqueiro-z.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008359; classtype:social-engineering; sid:6008359; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.metam-masklgin88.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.metam-masklgin88.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008360; classtype:social-engineering; sid:6008360; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gov-kawi.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.gov-kawi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008361; classtype:social-engineering; sid:6008361; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m1.devices-check.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m1.devices-check.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008362; classtype:social-engineering; sid:6008362; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (security.live.com.office.u24o365.mcafee.devshn.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"security.live.com.office.u24o365.mcafee.devshn.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008363; classtype:social-engineering; sid:6008363; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-clone-nu-eight.vercel.app/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"facebook-clone-nu-eight.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008364; classtype:social-engineering; sid:6008364; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (16091.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"16091.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008365; classtype:social-engineering; sid:6008365; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hklogin.mizuhoscfglobal.com/oauth2/authorize?response_type=code&client_id=3dd7d8eb-520a-4617-aaae-ff6bd4f1b21b&scope=openid%20email%20profile&state=drrXUoRCxOYIbEqPLSeiOwPi5drDeovloPGAKw-9gVQ%3D&redirect_uri=https://hk.mizuhoscfglobal.com/scf/login/oauth2/code/fusionauth&nonce=ivSUJcIf2xml990WZzj1fY4MDoB7Y8yBGuZuKbM9X2U)"; flow:established,to_server; http.uri; content:"/oauth2/authorize?response_type=code&client_id=3dd7d8eb-520a-4617-aaae-ff6bd4f1b21b&scope=openid%20email%20profile&state=drrXUoRCxOYIbEqPLSeiOwPi5drDeovloPGAKw-9gVQ%3D&redirect_uri=https://hk.mizuhoscfglobal.com/scf/login/oauth2/code/fusionauth&nonce=ivSUJcIf2xml990WZzj1fY4MDoB7Y8yBGuZuKbM9X2U"; startswith; fast_pattern; http.host; content:"hklogin.mizuhoscfglobal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008366; classtype:social-engineering; sid:6008366; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j69t.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j69t.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008367; classtype:social-engineering; sid:6008367; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myshop-711-com-tw.kkkkxx.link/ht/kefu.php?ClickID=166&amount=100.00)"; flow:established,to_server; http.uri; content:"/ht/kefu.php?ClickID=166&amount=100.00"; startswith; fast_pattern; http.host; content:"myshop-711-com-tw.kkkkxx.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008368; classtype:social-engineering; sid:6008368; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (layanan-shopee2.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"layanan-shopee2.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008369; classtype:social-engineering; sid:6008369; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi471.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"info-resmi471.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008370; classtype:social-engineering; sid:6008370; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (day.nowiggins.info/?app_vl=ZYFwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=jalves%40desilvagates.com&sui=%7Bsui%7D&fn=&ln=&p=&z=PLNONARAW-2805-VULTUR10)"; flow:established,to_server; http.uri; content:"/?app_vl=ZYFwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=jalves%40desilvagates.com&sui=%7Bsui%7D&fn=&ln=&p=&z=PLNONARAW-2805-VULTUR10"; startswith; fast_pattern; http.host; content:"day.nowiggins.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008371; classtype:social-engineering; sid:6008371; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amz36rd.s3.us-east-1.amazonaws.com/jpsert.html)"; flow:established,to_server; http.uri; content:"/jpsert.html"; startswith; fast_pattern; http.host; content:"amz36rd.s3.us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008372; classtype:social-engineering; sid:6008372; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (raiffeisen-gabe.vip/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"raiffeisen-gabe.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008373; classtype:social-engineering; sid:6008373; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi365.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"info-resmi365.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008374; classtype:social-engineering; sid:6008374; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mission.wasmer.app/es/)"; flow:established,to_server; http.uri; content:"/es/"; startswith; fast_pattern; http.host; content:"mission.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008375; classtype:social-engineering; sid:6008375; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cs-clientlogin.com/applyform/)"; flow:established,to_server; http.uri; content:"/applyform/"; startswith; fast_pattern; http.host; content:"cs-clientlogin.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008376; classtype:social-engineering; sid:6008376; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-com-start-en.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-com-start-en.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008377; classtype:social-engineering; sid:6008377; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-mu-one.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-mu-one.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008378; classtype:social-engineering; sid:6008378; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (simplest-watching-886115.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"simplest-watching-886115.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008379; classtype:social-engineering; sid:6008379; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (evvietnam.com/tuhbjgp/ok/t7yh.html)"; flow:established,to_server; http.uri; content:"/tuhbjgp/ok/t7yh.html"; startswith; fast_pattern; http.host; content:"evvietnam.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008380; classtype:social-engineering; sid:6008380; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uioiure.top/cast/verify.php)"; flow:established,to_server; http.uri; content:"/cast/verify.php"; startswith; fast_pattern; http.host; content:"uioiure.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008381; classtype:social-engineering; sid:6008381; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (welcome-trezrr-strtt-help-faqs.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"welcome-trezrr-strtt-help-faqs.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008382; classtype:social-engineering; sid:6008382; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.364362segu.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.364362segu.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008383; classtype:social-engineering; sid:6008383; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (georgia.org-ko.one/dds/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/dds/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"georgia.org-ko.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008384; classtype:social-engineering; sid:6008384; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rohitmanis1.github.io/clone-ecom/)"; flow:established,to_server; http.uri; content:"/clone-ecom/"; startswith; fast_pattern; http.host; content:"rohitmanis1.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008385; classtype:social-engineering; sid:6008385; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (on-notification-emessage.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"on-notification-emessage.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008386; classtype:social-engineering; sid:6008386; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myshop-711-com-tw.zhjrjy.link/ht/index.php?te=1&ClickID=1208)"; flow:established,to_server; http.uri; content:"/ht/index.php?te=1&ClickID=1208"; startswith; fast_pattern; http.host; content:"myshop-711-com-tw.zhjrjy.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008387; classtype:social-engineering; sid:6008387; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (digital-writing-933991.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"digital-writing-933991.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008388; classtype:social-engineering; sid:6008388; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi754.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"info-resmi754.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008389; classtype:social-engineering; sid:6008389; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.ebtwvv.help/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.ebtwvv.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008390; classtype:social-engineering; sid:6008390; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pintorreen.us/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pintorreen.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008391; classtype:social-engineering; sid:6008391; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqt.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingqt.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008392; classtype:social-engineering; sid:6008392; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (syn-notification-emessage.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"syn-notification-emessage.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008393; classtype:social-engineering; sid:6008393; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-mu-one.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-mu-one.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008394; classtype:social-engineering; sid:6008394; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumetamaissuchancedelimite.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumetamaissuchancedelimite.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008395; classtype:social-engineering; sid:6008395; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lc77.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lc77.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008396; classtype:social-engineering; sid:6008396; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (indiarevolutionnova.github.io/fake-amazon-ui/)"; flow:established,to_server; http.uri; content:"/fake-amazon-ui/"; startswith; fast_pattern; http.host; content:"indiarevolutionnova.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008397; classtype:social-engineering; sid:6008397; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mohitkumar9955458869-afk.github.io/my-first-website)"; flow:established,to_server; http.uri; content:"/my-first-website"; startswith; fast_pattern; http.host; content:"mohitkumar9955458869-afk.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008398; classtype:social-engineering; sid:6008398; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-five-iota.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-five-iota.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008399; classtype:social-engineering; sid:6008399; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.amazone-web-clone.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazone-web-clone.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008400; classtype:social-engineering; sid:6008400; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreigzys3rczbnczb5s7o2r3j5av4izhqvml6gyxah2d6v27apc4rjpy.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreigzys3rczbnczb5s7o2r3j5av4izhqvml6gyxah2d6v27apc4rjpy.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008401; classtype:social-engineering; sid:6008401; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mission.wasmer.app/about-us/)"; flow:established,to_server; http.uri; content:"/about-us/"; startswith; fast_pattern; http.host; content:"mission.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008402; classtype:social-engineering; sid:6008402; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p54zyo.ljminingbnb.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p54zyo.ljminingbnb.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008403; classtype:social-engineering; sid:6008403; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enchanting-bonbon-da7e7f.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"enchanting-bonbon-da7e7f.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008404; classtype:social-engineering; sid:6008404; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqq.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingqq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008405; classtype:social-engineering; sid:6008405; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kumaroyna2026.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kumaroyna2026.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008406; classtype:social-engineering; sid:6008406; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-clone-five-iota.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-five-iota.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008407; classtype:social-engineering; sid:6008407; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (page----uphold-us.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"page----uphold-us.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008408; classtype:social-engineering; sid:6008408; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoja24.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoja24.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008409; classtype:social-engineering; sid:6008409; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t6u7v8.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"t6u7v8.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008410; classtype:social-engineering; sid:6008410; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.vsfsnq.help/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.vsfsnq.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008411; classtype:social-engineering; sid:6008411; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.verbose-invention-eight.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.verbose-invention-eight.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008412; classtype:social-engineering; sid:6008412; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (student-eshwari.github.io/CSS-Project)"; flow:established,to_server; http.uri; content:"/CSS-Project"; startswith; fast_pattern; http.host; content:"student-eshwari.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008413; classtype:social-engineering; sid:6008413; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hk.mizuhoscfglobal.com/scf/login/oauth2/code/fusionauth)"; flow:established,to_server; http.uri; content:"/scf/login/oauth2/code/fusionauth"; startswith; fast_pattern; http.host; content:"hk.mizuhoscfglobal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008414; classtype:social-engineering; sid:6008414; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shuaidan.qpon/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shuaidan.qpon"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008415; classtype:social-engineering; sid:6008415; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uioiure.top/cast/CmaxAuthnAge.php)"; flow:established,to_server; http.uri; content:"/cast/CmaxAuthnAge.php"; startswith; fast_pattern; http.host; content:"uioiure.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008416; classtype:social-engineering; sid:6008416; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spify677.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spify677.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008417; classtype:social-engineering; sid:6008417; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16027.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16027.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008418; classtype:social-engineering; sid:6008418; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (staenmucoser.skin/100)"; flow:established,to_server; http.uri; content:"/100"; startswith; fast_pattern; http.host; content:"staenmucoser.skin"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008419; classtype:social-engineering; sid:6008419; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myshop-711-com-tw.zhjrjy.link/ht/kefu.php?ClickID=1208&amount=190.00)"; flow:established,to_server; http.uri; content:"/ht/kefu.php?ClickID=1208&amount=190.00"; startswith; fast_pattern; http.host; content:"myshop-711-com-tw.zhjrjy.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008420; classtype:social-engineering; sid:6008420; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.amazone-clone-teal.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazone-clone-teal.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008421; classtype:social-engineering; sid:6008421; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.vpyfak.buzz/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.vpyfak.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008422; classtype:social-engineering; sid:6008422; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spikecatcher.info/PL-1466-160526/?u=83C1466&e=nelar@0f976da0516b8821e1a545a81cb9d9060e79.org&s3=jozef&s4=sbeczka&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/PL-1466-160526/?u=83C1466&e=nelar@0f976da0516b8821e1a545a81cb9d9060e79.org&s3=jozef&s4=sbeczka&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"spikecatcher.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008423; classtype:social-engineering; sid:6008423; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bradesco.clientemaster.digital/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bradesco.clientemaster.digital"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008424; classtype:social-engineering; sid:6008424; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trzo-en-bridge.framer.media/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"trzo-en-bridge.framer.media"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008425; classtype:social-engineering; sid:6008425; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hub-suiiit-trzr.framer.media/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hub-suiiit-trzr.framer.media"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008426; classtype:social-engineering; sid:6008426; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezo-home.framer.media/com-starts)"; flow:established,to_server; http.uri; content:"/com-starts"; startswith; fast_pattern; http.host; content:"trezo-home.framer.media"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008427; classtype:social-engineering; sid:6008427; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prime-onlinesuivi.com/signin?email=marouan.cloudy@laposte.net&\;token=lqbmieq4ws1pguhj6rdjx1s3o8q9o6tb2mcpmdf2hvasgsikm0ywyu6kw3ofk3p2&\;downdate=19&\;amount=414.72&\;identity=marouan%20cloudy)"; flow:established,to_server; http.uri; content:"/signin?email=marouan.cloudy@laposte.net&|3b|token=lqbmieq4ws1pguhj6rdjx1s3o8q9o6tb2mcpmdf2hvasgsikm0ywyu6kw3ofk3p2&|3b|downdate=19&|3b|amount=414.72&|3b|identity=marouan%20cloudy"; startswith; fast_pattern; http.host; content:"prime-onlinesuivi.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008428; classtype:social-engineering; sid:6008428; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (startedio.framer.media/suite-app)"; flow:established,to_server; http.uri; content:"/suite-app"; startswith; fast_pattern; http.host; content:"startedio.framer.media"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008429; classtype:social-engineering; sid:6008429; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (laitdecoco90.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"laitdecoco90.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008430; classtype:social-engineering; sid:6008430; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (recouvr-54652.com/suivi)"; flow:established,to_server; http.uri; content:"/suivi"; startswith; fast_pattern; http.host; content:"recouvr-54652.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008431; classtype:social-engineering; sid:6008431; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en-suiteapp.framer.media/en-suite)"; flow:established,to_server; http.uri; content:"/en-suite"; startswith; fast_pattern; http.host; content:"en-suiteapp.framer.media"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008432; classtype:social-engineering; sid:6008432; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en-suiteapp.framer.media/app)"; flow:established,to_server; http.uri; content:"/app"; startswith; fast_pattern; http.host; content:"en-suiteapp.framer.media"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008433; classtype:social-engineering; sid:6008433; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (davebenson688.systeme.io/ba0430ed)"; flow:established,to_server; http.uri; content:"/ba0430ed"; startswith; fast_pattern; http.host; content:"davebenson688.systeme.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008434; classtype:social-engineering; sid:6008434; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezriosuite.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezriosuite.framer.ai"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008435; classtype:social-engineering; sid:6008435; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezorsuite.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezorsuite.framer.website"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008436; classtype:social-engineering; sid:6008436; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suites-faqs-trezo.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"suites-faqs-trezo.framer.website"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008437; classtype:social-engineering; sid:6008437; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail-ionos.de-en.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webmail-ionos.de-en.cc"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008438; classtype:social-engineering; sid:6008438; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (activetask.help/view/es)"; flow:established,to_server; http.uri; content:"/view/es"; startswith; fast_pattern; http.host; content:"activetask.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008439; classtype:social-engineering; sid:6008439; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (digital-task.pro/fv/chek-inf)"; flow:established,to_server; http.uri; content:"/fv/chek-inf"; startswith; fast_pattern; http.host; content:"digital-task.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008440; classtype:social-engineering; sid:6008440; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gigupdate.digital/fv/chek-inf)"; flow:established,to_server; http.uri; content:"/fv/chek-inf"; startswith; fast_pattern; http.host; content:"gigupdate.digital"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008441; classtype:social-engineering; sid:6008441; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aflinks.co.uk/Re-Format/TenderDocRFP.php)"; flow:established,to_server; http.uri; content:"/Re-Format/TenderDocRFP.php"; startswith; fast_pattern; http.host; content:"aflinks.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008442; classtype:social-engineering; sid:6008442; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflexro-trialpremium-sandu.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflexro-trialpremium-sandu.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008443; classtype:social-engineering; sid:6008443; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xhofjv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xhofjv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008444; classtype:social-engineering; sid:6008444; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m0skk_mettamsiggn0n0.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m0skk_mettamsiggn0n0.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008445; classtype:social-engineering; sid:6008445; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ljwxnz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ljwxnz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008446; classtype:social-engineering; sid:6008446; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (professionelle-flverr.help/view/kollise)"; flow:established,to_server; http.uri; content:"/view/kollise"; startswith; fast_pattern; http.host; content:"professionelle-flverr.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008447; classtype:social-engineering; sid:6008447; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xqpyzxrog23j0d6.i8vipjili.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xqpyzxrog23j0d6.i8vipjili.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008448; classtype:social-engineering; sid:6008448; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi472.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi472.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008449; classtype:social-engineering; sid:6008449; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (insta-clone-umber.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"insta-clone-umber.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008450; classtype:social-engineering; sid:6008450; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bdoovip.com/ph/personal)"; flow:established,to_server; http.uri; content:"/ph/personal"; startswith; fast_pattern; http.host; content:"bdoovip.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008451; classtype:social-engineering; sid:6008451; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jrtchs.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jrtchs.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008452; classtype:social-engineering; sid:6008452; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (supriya25-09-2007.github.io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"supriya25-09-2007.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008453; classtype:social-engineering; sid:6008453; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqa.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingqa.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008454; classtype:social-engineering; sid:6008454; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e6feaoc59minzknd8yv1.69vipjili.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e6feaoc59minzknd8yv1.69vipjili.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008455; classtype:social-engineering; sid:6008455; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bcvjhz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bcvjhz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008456; classtype:social-engineering; sid:6008456; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vqcuef.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vqcuef.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008457; classtype:social-engineering; sid:6008457; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.wapluszone.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.wapluszone.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008458; classtype:social-engineering; sid:6008458; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (student-ju.github.io/Amazon-Website-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Website-Clone/"; startswith; fast_pattern; http.host; content:"student-ju.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008459; classtype:social-engineering; sid:6008459; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (projectcenter.pro/fv/chek-inf)"; flow:established,to_server; http.uri; content:"/fv/chek-inf"; startswith; fast_pattern; http.host; content:"projectcenter.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008460; classtype:social-engineering; sid:6008460; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flverr-verlflcation.com/project/flverr)"; flow:established,to_server; http.uri; content:"/project/flverr"; startswith; fast_pattern; http.host; content:"flverr-verlflcation.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008461; classtype:social-engineering; sid:6008461; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (media-post-case-202637.pages.dev/meta.help)"; flow:established,to_server; http.uri; content:"/meta.help"; startswith; fast_pattern; http.host; content:"media-post-case-202637.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008462; classtype:social-engineering; sid:6008462; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mazienolden.com/work/verifyfreelancer)"; flow:established,to_server; http.uri; content:"/work/verifyfreelancer"; startswith; fast_pattern; http.host; content:"mazienolden.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008463; classtype:social-engineering; sid:6008463; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bplesi.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bplesi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008464; classtype:social-engineering; sid:6008464; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.spotifypremiumapkmundoperfecto.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.spotifypremiumapkmundoperfecto.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008465; classtype:social-engineering; sid:6008465; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gladorione.com/work/user84359231)"; flow:established,to_server; http.uri; content:"/work/user84359231"; startswith; fast_pattern; http.host; content:"gladorione.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008466; classtype:social-engineering; sid:6008466; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yashvpawar.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"yashvpawar.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008467; classtype:social-engineering; sid:6008467; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flverr.cam/view/es)"; flow:established,to_server; http.uri; content:"/view/es"; startswith; fast_pattern; http.host; content:"flverr.cam"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008468; classtype:social-engineering; sid:6008468; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maindata.world/view/delivers)"; flow:established,to_server; http.uri; content:"/view/delivers"; startswith; fast_pattern; http.host; content:"maindata.world"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008469; classtype:social-engineering; sid:6008469; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (utterelo.com/fv/chek-inf)"; flow:established,to_server; http.uri; content:"/fv/chek-inf"; startswith; fast_pattern; http.host; content:"utterelo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008470; classtype:social-engineering; sid:6008470; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uyvfjsf777.777yjfg.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uyvfjsf777.777yjfg.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008471; classtype:social-engineering; sid:6008471; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiverr-veriflcation.pro/view/kollise)"; flow:established,to_server; http.uri; content:"/view/kollise"; startswith; fast_pattern; http.host; content:"fiverr-veriflcation.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008472; classtype:social-engineering; sid:6008472; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wellobd.info/path-50/TenderRFPDoc.php)"; flow:established,to_server; http.uri; content:"/path-50/TenderRFPDoc.php"; startswith; fast_pattern; http.host; content:"wellobd.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008473; classtype:social-engineering; sid:6008473; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (media-post-case-202630-8bt.pages.dev/meta.help)"; flow:established,to_server; http.uri; content:"/meta.help"; startswith; fast_pattern; http.host; content:"media-post-case-202630-8bt.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008474; classtype:social-engineering; sid:6008474; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lnzwpv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lnzwpv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008475; classtype:social-engineering; sid:6008475; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (projectscore.pro/view/kollise)"; flow:established,to_server; http.uri; content:"/view/kollise"; startswith; fast_pattern; http.host; content:"projectscore.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008476; classtype:social-engineering; sid:6008476; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chbkjpm-help.com/verify.php)"; flow:established,to_server; http.uri; content:"/verify.php"; startswith; fast_pattern; http.host; content:"chbkjpm-help.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008477; classtype:social-engineering; sid:6008477; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (morvanelithix.com/view/information)"; flow:established,to_server; http.uri; content:"/view/information"; startswith; fast_pattern; http.host; content:"morvanelithix.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008478; classtype:social-engineering; sid:6008478; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail-junomail.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webmail-junomail.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008479; classtype:social-engineering; sid:6008479; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lnsta.fr/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lnsta.fr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008480; classtype:social-engineering; sid:6008480; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (media-post-case-202632.pages.dev/meta.help)"; flow:established,to_server; http.uri; content:"/meta.help"; startswith; fast_pattern; http.host; content:"media-post-case-202632.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008481; classtype:social-engineering; sid:6008481; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mazienolden.com/view/kollise)"; flow:established,to_server; http.uri; content:"/view/kollise"; startswith; fast_pattern; http.host; content:"mazienolden.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008482; classtype:social-engineering; sid:6008482; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiverr-projectspad.pro/view/es)"; flow:established,to_server; http.uri; content:"/view/es"; startswith; fast_pattern; http.host; content:"fiverr-projectspad.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008483; classtype:social-engineering; sid:6008483; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help-trezer-io-startt.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"help-trezer-io-startt.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008484; classtype:social-engineering; sid:6008484; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (georgetownmover.com/www.linkedin.com/index.html)"; flow:established,to_server; http.uri; content:"/www.linkedin.com/index.html"; startswith; fast_pattern; http.host; content:"georgetownmover.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008485; classtype:social-engineering; sid:6008485; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (various-copy-183010.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"various-copy-183010.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008486; classtype:social-engineering; sid:6008486; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reservation-check95839877.world/project/Flverr)"; flow:established,to_server; http.uri; content:"/project/Flverr"; startswith; fast_pattern; http.host; content:"reservation-check95839877.world"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008487; classtype:social-engineering; sid:6008487; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pihagv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pihagv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008488; classtype:social-engineering; sid:6008488; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xsfneb.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xsfneb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008489; classtype:social-engineering; sid:6008489; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.infohadiah537.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.infohadiah537.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008490; classtype:social-engineering; sid:6008490; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkimgn.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkimgn.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008491; classtype:social-engineering; sid:6008491; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (heritagetimileyin85-cloud.github.io/Live-Coding-Test-One)"; flow:established,to_server; http.uri; content:"/Live-Coding-Test-One"; startswith; fast_pattern; http.host; content:"heritagetimileyin85-cloud.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008492; classtype:social-engineering; sid:6008492; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spbmjjnk30b075.69vipjili.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spbmjjnk30b075.69vipjili.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008493; classtype:social-engineering; sid:6008493; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (airbnb-assistant-landing.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"airbnb-assistant-landing.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008494; classtype:social-engineering; sid:6008494; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (discordinc.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"discordinc.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008495; classtype:social-engineering; sid:6008495; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (guia-de-transportes.vercel.app/site/)"; flow:established,to_server; http.uri; content:"/site/"; startswith; fast_pattern; http.host; content:"guia-de-transportes.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008496; classtype:social-engineering; sid:6008496; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.own-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.own-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008497; classtype:social-engineering; sid:6008497; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (grwiucl4iyt1cv1.i8vipjili.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"grwiucl4iyt1cv1.i8vipjili.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008498; classtype:social-engineering; sid:6008498; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkimgn.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkimgn.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008499; classtype:social-engineering; sid:6008499; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.cyswmh.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.cyswmh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008500; classtype:social-engineering; sid:6008500; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.big-sale459.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.big-sale459.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008501; classtype:social-engineering; sid:6008501; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ofspwz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ofspwz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008502; classtype:social-engineering; sid:6008502; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jeclvx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jeclvx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008503; classtype:social-engineering; sid:6008503; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.yoslxc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.yoslxc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008504; classtype:social-engineering; sid:6008504; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopeeid722.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopeeid722.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008505; classtype:social-engineering; sid:6008505; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (viewerorder.com/project/bio)"; flow:established,to_server; http.uri; content:"/project/bio"; startswith; fast_pattern; http.host; content:"viewerorder.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008506; classtype:social-engineering; sid:6008506; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (viewerorder.com/work/user84359231)"; flow:established,to_server; http.uri; content:"/work/user84359231"; startswith; fast_pattern; http.host; content:"viewerorder.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008507; classtype:social-engineering; sid:6008507; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lsymjn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lsymjn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008508; classtype:social-engineering; sid:6008508; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eomelhoridadepluspracima.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"eomelhoridadepluspracima.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008509; classtype:social-engineering; sid:6008509; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (information-progress.digital/fv/chek-inf)"; flow:established,to_server; http.uri; content:"/fv/chek-inf"; startswith; fast_pattern; http.host; content:"information-progress.digital"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008510; classtype:social-engineering; sid:6008510; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi383.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi383.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008511; classtype:social-engineering; sid:6008511; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (doupt.sbs/view/es)"; flow:established,to_server; http.uri; content:"/view/es"; startswith; fast_pattern; http.host; content:"doupt.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008512; classtype:social-engineering; sid:6008512; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myshop.7-11.com.gsart.top/kefu.php)"; flow:established,to_server; http.uri; content:"/kefu.php"; startswith; fast_pattern; http.host; content:"myshop.7-11.com.gsart.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008513; classtype:social-engineering; sid:6008513; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gbjhkq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gbjhkq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008514; classtype:social-engineering; sid:6008514; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fidel-ltgy.cyou/x2kyh0n/page.html)"; flow:established,to_server; http.uri; content:"/x2kyh0n/page.html"; startswith; fast_pattern; http.host; content:"fidel-ltgy.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008515; classtype:social-engineering; sid:6008515; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi432.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi432.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008516; classtype:social-engineering; sid:6008516; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robnhodlogen.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"robnhodlogen.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008517; classtype:social-engineering; sid:6008517; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b592af96.click.kit-mail3.com/lmup7gdw6khmhn9nv4wu6h8wko4wkugh4ozgo/qvh8h7hdpek6edbl/aHR0cHM6Ly9kaXNrY2FjYW1iYXNkZXRyb2l0LmNvbS5ici9hdXRoL3JhY2tlc3BhY2U=)"; flow:established,to_server; http.uri; content:"/lmup7gdw6khmhn9nv4wu6h8wko4wkugh4ozgo/qvh8h7hdpek6edbl/aHR0cHM6Ly9kaXNrY2FjYW1iYXNkZXRyb2l0LmNvbS5ici9hdXRoL3JhY2tlc3BhY2U="; startswith; fast_pattern; http.host; content:"b592af96.click.kit-mail3.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008518; classtype:social-engineering; sid:6008518; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (profesio-portfolio.lat/work/verifyfreelancer)"; flow:established,to_server; http.uri; content:"/work/verifyfreelancer"; startswith; fast_pattern; http.host; content:"profesio-portfolio.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008519; classtype:social-engineering; sid:6008519; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (req-sup405902.lol/view/es)"; flow:established,to_server; http.uri; content:"/view/es"; startswith; fast_pattern; http.host; content:"req-sup405902.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008520; classtype:social-engineering; sid:6008520; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gptrco.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gptrco.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008521; classtype:social-engineering; sid:6008521; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.zh-go-9game.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.zh-go-9game.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008522; classtype:social-engineering; sid:6008522; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.huntohiuo.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.huntohiuo.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008523; classtype:social-engineering; sid:6008523; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mudeumag.com/od/project42357234)"; flow:established,to_server; http.uri; content:"/od/project42357234"; startswith; fast_pattern; http.host; content:"mudeumag.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008524; classtype:social-engineering; sid:6008524; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p0iuwk8zdt6f14.i8vipjili.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p0iuwk8zdt6f14.i8vipjili.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008525; classtype:social-engineering; sid:6008525; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiverr-workspace.pro/project/Flverr)"; flow:established,to_server; http.uri; content:"/project/Flverr"; startswith; fast_pattern; http.host; content:"fiverr-workspace.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008526; classtype:social-engineering; sid:6008526; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (projectcenter.pro/project/bio)"; flow:established,to_server; http.uri; content:"/project/bio"; startswith; fast_pattern; http.host; content:"projectcenter.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008527; classtype:social-engineering; sid:6008527; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (securewebapps.azurewebsites.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"securewebapps.azurewebsites.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008528; classtype:social-engineering; sid:6008528; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp.gq.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp.gq.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008529; classtype:social-engineering; sid:6008529; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wellobd.info/1000meetings/TenderDocRFP.php)"; flow:established,to_server; http.uri; content:"/1000meetings/TenderDocRFP.php"; startswith; fast_pattern; http.host; content:"wellobd.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008530; classtype:social-engineering; sid:6008530; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jovial-malasada-d5b763tyhd.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jovial-malasada-d5b763tyhd.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008531; classtype:social-engineering; sid:6008531; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (projectstasks.pro/view/kollise)"; flow:established,to_server; http.uri; content:"/view/kollise"; startswith; fast_pattern; http.host; content:"projectstasks.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008532; classtype:social-engineering; sid:6008532; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fidel-ltgy.cyou/x2kyh0n)"; flow:established,to_server; http.uri; content:"/x2kyh0n"; startswith; fast_pattern; http.host; content:"fidel-ltgy.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008533; classtype:social-engineering; sid:6008533; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (erific754ations.com.ytp.meo.mybluehost.me/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"erific754ations.com.ytp.meo.mybluehost.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008534; classtype:social-engineering; sid:6008534; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kurcoinlagany.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kurcoinlagany.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008535; classtype:social-engineering; sid:6008535; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkimgk.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkimgk.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008536; classtype:social-engineering; sid:6008536; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blassma.com/project/Flverr)"; flow:established,to_server; http.uri; content:"/project/Flverr"; startswith; fast_pattern; http.host; content:"blassma.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008537; classtype:social-engineering; sid:6008537; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.zenlotus.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.zenlotus.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008538; classtype:social-engineering; sid:6008538; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (individual-project.pro/view/es)"; flow:established,to_server; http.uri; content:"/view/es"; startswith; fast_pattern; http.host; content:"individual-project.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008539; classtype:social-engineering; sid:6008539; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.eowhuv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.eowhuv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008540; classtype:social-engineering; sid:6008540; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (poshmark-shop.shop/view/information)"; flow:established,to_server; http.uri; content:"/view/information"; startswith; fast_pattern; http.host; content:"poshmark-shop.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008541; classtype:social-engineering; sid:6008541; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi895.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi895.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008542; classtype:social-engineering; sid:6008542; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xqplvrzmtn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xqplvrzmtn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008543; classtype:social-engineering; sid:6008543; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (professionelle-flverr.help/work/verifyfreelancer)"; flow:established,to_server; http.uri; content:"/work/verifyfreelancer"; startswith; fast_pattern; http.host; content:"professionelle-flverr.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008544; classtype:social-engineering; sid:6008544; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (first-illuminated.bond/view/kollise)"; flow:established,to_server; http.uri; content:"/view/kollise"; startswith; fast_pattern; http.host; content:"first-illuminated.bond"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008545; classtype:social-engineering; sid:6008545; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (professionelle-flverr.help/bones/referss)"; flow:established,to_server; http.uri; content:"/bones/referss"; startswith; fast_pattern; http.host; content:"professionelle-flverr.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008546; classtype:social-engineering; sid:6008546; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (huntengton.one/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"huntengton.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008547; classtype:social-engineering; sid:6008547; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lieferung-dhl.aiinterface.co.uk/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lieferung-dhl.aiinterface.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008548; classtype:social-engineering; sid:6008548; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gigupdate.digital/work/user84359231)"; flow:established,to_server; http.uri; content:"/work/user84359231"; startswith; fast_pattern; http.host; content:"gigupdate.digital"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008549; classtype:social-engineering; sid:6008549; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bkr4um6hij9l.i8vipjili.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bkr4um6hij9l.i8vipjili.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008550; classtype:social-engineering; sid:6008550; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fistralbeachadultsonly.spahotel.guru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fistralbeachadultsonly.spahotel.guru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008551; classtype:social-engineering; sid:6008551; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (planoavancado.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"planoavancado.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008552; classtype:social-engineering; sid:6008552; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (program-resmi558.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"program-resmi558.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008553; classtype:social-engineering; sid:6008553; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (diskcacambasdetroit.com.br/auth/rackespace/)"; flow:established,to_server; http.uri; content:"/auth/rackespace/"; startswith; fast_pattern; http.host; content:"diskcacambasdetroit.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008554; classtype:social-engineering; sid:6008554; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.conqueryourego.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.conqueryourego.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008555; classtype:social-engineering; sid:6008555; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c-consultaratendimentonline.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c-consultaratendimentonline.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008556; classtype:social-engineering; sid:6008556; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (morvanelithix.com/project/WorkOrder)"; flow:established,to_server; http.uri; content:"/project/WorkOrder"; startswith; fast_pattern; http.host; content:"morvanelithix.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008557; classtype:social-engineering; sid:6008557; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myprojects.help/project/Flverr)"; flow:established,to_server; http.uri; content:"/project/Flverr"; startswith; fast_pattern; http.host; content:"myprojects.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008558; classtype:social-engineering; sid:6008558; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hefolas.com/project/Flverr)"; flow:established,to_server; http.uri; content:"/project/Flverr"; startswith; fast_pattern; http.host; content:"hefolas.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008559; classtype:social-engineering; sid:6008559; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (digital-task.pro/project/bio)"; flow:established,to_server; http.uri; content:"/project/bio"; startswith; fast_pattern; http.host; content:"digital-task.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008560; classtype:social-engineering; sid:6008560; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rs-iniciaratendimentohoje.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rs-iniciaratendimentohoje.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008561; classtype:social-engineering; sid:6008561; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dbiqmv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dbiqmv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008562; classtype:social-engineering; sid:6008562; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (professionaldata.lat/project/jT35aF)"; flow:established,to_server; http.uri; content:"/project/jT35aF"; startswith; fast_pattern; http.host; content:"professionaldata.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008563; classtype:social-engineering; sid:6008563; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lurantero.com/project/more)"; flow:established,to_server; http.uri; content:"/project/more"; startswith; fast_pattern; http.host; content:"lurantero.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008564; classtype:social-engineering; sid:6008564; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (news.info-games.ru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"news.info-games.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008565; classtype:social-engineering; sid:6008565; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (media-post-case-202639.pages.dev/meta.help)"; flow:established,to_server; http.uri; content:"/meta.help"; startswith; fast_pattern; http.host; content:"media-post-case-202639.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008566; classtype:social-engineering; sid:6008566; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wellobd.info/equatore/TenderDocRFP.php)"; flow:established,to_server; http.uri; content:"/equatore/TenderDocRFP.php"; startswith; fast_pattern; http.host; content:"wellobd.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008567; classtype:social-engineering; sid:6008567; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xpuyji.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xpuyji.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008568; classtype:social-engineering; sid:6008568; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.imsypf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.imsypf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008569; classtype:social-engineering; sid:6008569; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (starlit-marshmallow-de6581.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"starlit-marshmallow-de6581.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008570; classtype:social-engineering; sid:6008570; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkimgj.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkimgj.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008571; classtype:social-engineering; sid:6008571; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.huntohiuo.one/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.huntohiuo.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008572; classtype:social-engineering; sid:6008572; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (janolimiti.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"janolimiti.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008573; classtype:social-engineering; sid:6008573; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (digital-task.com/view/es)"; flow:established,to_server; http.uri; content:"/view/es"; startswith; fast_pattern; http.host; content:"digital-task.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008574; classtype:social-engineering; sid:6008574; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mohsin-imran1.github.io/Net-Clone)"; flow:established,to_server; http.uri; content:"/Net-Clone"; startswith; fast_pattern; http.host; content:"mohsin-imran1.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008575; classtype:social-engineering; sid:6008575; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vqlkyz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vqlkyz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008576; classtype:social-engineering; sid:6008576; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aflinks.co.uk/acstro/TenderDetails.php)"; flow:established,to_server; http.uri; content:"/acstro/TenderDetails.php"; startswith; fast_pattern; http.host; content:"aflinks.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008577; classtype:social-engineering; sid:6008577; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-ca-netcoins-com-auth.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sso-ca-netcoins-com-auth.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008578; classtype:social-engineering; sid:6008578; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ltnsym.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ltnsym.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008579; classtype:social-engineering; sid:6008579; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qkvjiu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qkvjiu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008580; classtype:social-engineering; sid:6008580; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqo.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingqo.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008581; classtype:social-engineering; sid:6008581; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jlmbkd.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jlmbkd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008582; classtype:social-engineering; sid:6008582; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fillingform.me/project/Flverr)"; flow:established,to_server; http.uri; content:"/project/Flverr"; startswith; fast_pattern; http.host; content:"fillingform.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008583; classtype:social-engineering; sid:6008583; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.huntontinohio.one/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.huntontinohio.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008584; classtype:social-engineering; sid:6008584; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secundoclick.com/work/verifyfreelancer)"; flow:established,to_server; http.uri; content:"/work/verifyfreelancer"; startswith; fast_pattern; http.host; content:"secundoclick.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008585; classtype:social-engineering; sid:6008585; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ingable.info/PL-1466-160526/?u=81C1466&e=alumlab@56b5acee49097bf462df2fce0938be73d3bb.com&s3=anatol&s4=lapinski&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/PL-1466-160526/?u=81C1466&e=alumlab@56b5acee49097bf462df2fce0938be73d3bb.com&s3=anatol&s4=lapinski&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"ingable.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008586; classtype:social-engineering; sid:6008586; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usconevbaaseproloen.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"usconevbaaseproloen.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008587; classtype:social-engineering; sid:6008587; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (framelast.com/project/bio)"; flow:established,to_server; http.uri; content:"/project/bio"; startswith; fast_pattern; http.host; content:"framelast.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008588; classtype:social-engineering; sid:6008588; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xlzkct.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xlzkct.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008589; classtype:social-engineering; sid:6008589; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ohlmui.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ohlmui.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008590; classtype:social-engineering; sid:6008590; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vrfdigitalcenter.com/project/bio)"; flow:established,to_server; http.uri; content:"/project/bio"; startswith; fast_pattern; http.host; content:"vrfdigitalcenter.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008591; classtype:social-engineering; sid:6008591; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiifkanpayylaterll.from-resmi.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiifkanpayylaterll.from-resmi.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008592; classtype:social-engineering; sid:6008592; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (profesio-portfolio.lat/view/kollise)"; flow:established,to_server; http.uri; content:"/view/kollise"; startswith; fast_pattern; http.host; content:"profesio-portfolio.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008593; classtype:social-engineering; sid:6008593; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (drenixzen.com/od/pro-service)"; flow:established,to_server; http.uri; content:"/od/pro-service"; startswith; fast_pattern; http.host; content:"drenixzen.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008594; classtype:social-engineering; sid:6008594; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xorljd.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xorljd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008595; classtype:social-engineering; sid:6008595; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yolo-shop.github.io/Paypal-)"; flow:established,to_server; http.uri; content:"/Paypal-"; startswith; fast_pattern; http.host; content:"yolo-shop.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008596; classtype:social-engineering; sid:6008596; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiverr-projectsale.pro/view/kollise)"; flow:established,to_server; http.uri; content:"/view/kollise"; startswith; fast_pattern; http.host; content:"fiverr-projectsale.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008597; classtype:social-engineering; sid:6008597; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (drenixzen.com/gallery/pro-service)"; flow:established,to_server; http.uri; content:"/gallery/pro-service"; startswith; fast_pattern; http.host; content:"drenixzen.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008598; classtype:social-engineering; sid:6008598; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fleet-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fleet-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008599; classtype:social-engineering; sid:6008599; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (teloalquilo.pe/saa-doc-1912w-approved/ap-secure-edocum9nt-access.html)"; flow:established,to_server; http.uri; content:"/saa-doc-1912w-approved/ap-secure-edocum9nt-access.html"; startswith; fast_pattern; http.host; content:"teloalquilo.pe"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008600; classtype:social-engineering; sid:6008600; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fljywo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.fljywo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008601; classtype:social-engineering; sid:6008601; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi365.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi365.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008602; classtype:social-engineering; sid:6008602; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi754.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi754.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008603; classtype:social-engineering; sid:6008603; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aflinks.co.uk/nuplanet/TenderProposal.php)"; flow:established,to_server; http.uri; content:"/nuplanet/TenderProposal.php"; startswith; fast_pattern; http.host; content:"aflinks.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008604; classtype:social-engineering; sid:6008604; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (activetask.help/project/Flverr)"; flow:established,to_server; http.uri; content:"/project/Flverr"; startswith; fast_pattern; http.host; content:"activetask.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008605; classtype:social-engineering; sid:6008605; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sohamp2108.github.io/Amazon-Clone)"; flow:established,to_server; http.uri; content:"/Amazon-Clone"; startswith; fast_pattern; http.host; content:"sohamp2108.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008606; classtype:social-engineering; sid:6008606; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reservation-check95839877.world/view/es)"; flow:established,to_server; http.uri; content:"/view/es"; startswith; fast_pattern; http.host; content:"reservation-check95839877.world"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008607; classtype:social-engineering; sid:6008607; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (officialarubaspid.bar/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"officialarubaspid.bar"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008608; classtype:social-engineering; sid:6008608; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (projectdesk.forum/work/verifyfreelancer)"; flow:established,to_server; http.uri; content:"/work/verifyfreelancer"; startswith; fast_pattern; http.host; content:"projectdesk.forum"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008609; classtype:social-engineering; sid:6008609; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (viewerorder.com/fv/chek-inf)"; flow:established,to_server; http.uri; content:"/fv/chek-inf"; startswith; fast_pattern; http.host; content:"viewerorder.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008610; classtype:social-engineering; sid:6008610; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roomverif-stayes8019.com/57713331)"; flow:established,to_server; http.uri; content:"/57713331"; startswith; fast_pattern; http.host; content:"roomverif-stayes8019.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008611; classtype:social-engineering; sid:6008611; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.quycxg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.quycxg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008612; classtype:social-engineering; sid:6008612; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.megaeventrentals.com/approved/project_file.html)"; flow:established,to_server; http.uri; content:"/approved/project_file.html"; startswith; fast_pattern; http.host; content:"www.megaeventrentals.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008613; classtype:social-engineering; sid:6008613; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.woskeatt.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.woskeatt.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008614; classtype:social-engineering; sid:6008614; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.progamacashback.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.progamacashback.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008615; classtype:social-engineering; sid:6008615; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chbkjpm-help.com/ull.php)"; flow:established,to_server; http.uri; content:"/ull.php"; startswith; fast_pattern; http.host; content:"chbkjpm-help.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008616; classtype:social-engineering; sid:6008616; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiverr-veriflcation.pro/project/Flverr)"; flow:established,to_server; http.uri; content:"/project/Flverr"; startswith; fast_pattern; http.host; content:"fiverr-veriflcation.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008617; classtype:social-engineering; sid:6008617; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (emergenciadiaria.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"emergenciadiaria.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008618; classtype:social-engineering; sid:6008618; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.yemxtg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.yemxtg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008619; classtype:social-engineering; sid:6008619; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi471.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi471.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008620; classtype:social-engineering; sid:6008620; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiverr-veriflcation.pro/view/information)"; flow:established,to_server; http.uri; content:"/view/information"; startswith; fast_pattern; http.host; content:"fiverr-veriflcation.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008621; classtype:social-engineering; sid:6008621; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.epvjfl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.epvjfl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008622; classtype:social-engineering; sid:6008622; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b36552.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b36552.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008623; classtype:social-engineering; sid:6008623; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkimgv.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkimgv.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008624; classtype:social-engineering; sid:6008624; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sv.morvanelithix.com/view/information)"; flow:established,to_server; http.uri; content:"/view/information"; startswith; fast_pattern; http.host; content:"sv.morvanelithix.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008625; classtype:social-engineering; sid:6008625; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.known-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.known-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008626; classtype:social-engineering; sid:6008626; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jngews.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jngews.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008627; classtype:social-engineering; sid:6008627; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sv.fiverr-veriflcation.pro/view/information)"; flow:established,to_server; http.uri; content:"/view/information"; startswith; fast_pattern; http.host; content:"sv.fiverr-veriflcation.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008628; classtype:social-engineering; sid:6008628; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xyn85mwugobgu9pcqjid.i8vipjili.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xyn85mwugobgu9pcqjid.i8vipjili.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008629; classtype:social-engineering; sid:6008629; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.sunqia.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.sunqia.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008630; classtype:social-engineering; sid:6008630; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gladorione.com/fv/chek-inf)"; flow:established,to_server; http.uri; content:"/fv/chek-inf"; startswith; fast_pattern; http.host; content:"gladorione.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008631; classtype:social-engineering; sid:6008631; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hfvrqs.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hfvrqs.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008632; classtype:social-engineering; sid:6008632; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robnhodlogen.gitbook.io/account)"; flow:established,to_server; http.uri; content:"/account"; startswith; fast_pattern; http.host; content:"robnhodlogen.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008633; classtype:social-engineering; sid:6008633; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pteqnc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pteqnc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008634; classtype:social-engineering; sid:6008634; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.m0skk_mettamsiggn0n0.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.m0skk_mettamsiggn0n0.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008635; classtype:social-engineering; sid:6008635; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqo.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingqo.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008636; classtype:social-engineering; sid:6008636; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chbkjpm-help.com/login2.php)"; flow:established,to_server; http.uri; content:"/login2.php"; startswith; fast_pattern; http.host; content:"chbkjpm-help.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008637; classtype:social-engineering; sid:6008637; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkimgk.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkimgk.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008638; classtype:social-engineering; sid:6008638; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiverr-projectsale.pro/work/verifyfreelancer)"; flow:established,to_server; http.uri; content:"/work/verifyfreelancer"; startswith; fast_pattern; http.host; content:"fiverr-projectsale.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008639; classtype:social-engineering; sid:6008639; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wa-mewhtasapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wa-mewhtasapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008640; classtype:social-engineering; sid:6008640; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.awosiz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.awosiz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008641; classtype:social-engineering; sid:6008641; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tgehqv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tgehqv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008642; classtype:social-engineering; sid:6008642; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xkbpyd.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xkbpyd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008643; classtype:social-engineering; sid:6008643; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thirupathi017.github.io/netflix_clone_frontend_project)"; flow:established,to_server; http.uri; content:"/netflix_clone_frontend_project"; startswith; fast_pattern; http.host; content:"thirupathi017.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008644; classtype:social-engineering; sid:6008644; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jtgcim.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jtgcim.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008645; classtype:social-engineering; sid:6008645; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hiwpua.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hiwpua.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008646; classtype:social-engineering; sid:6008646; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (15904.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"15904.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008647; classtype:social-engineering; sid:6008647; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hpindz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hpindz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008648; classtype:social-engineering; sid:6008648; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ekprfw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ekprfw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008649; classtype:social-engineering; sid:6008649; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chbkjpm-help.com/card1.php)"; flow:established,to_server; http.uri; content:"/card1.php"; startswith; fast_pattern; http.host; content:"chbkjpm-help.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008650; classtype:social-engineering; sid:6008650; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ixuhws.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ixuhws.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008651; classtype:social-engineering; sid:6008651; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qiomgu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qiomgu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008652; classtype:social-engineering; sid:6008652; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-zeta-nine.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-zeta-nine.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008653; classtype:social-engineering; sid:6008653; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anupam0917.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"anupam0917.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008654; classtype:social-engineering; sid:6008654; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (i4xwafpnxupbmajjyu.i8vipjili.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"i4xwafpnxupbmajjyu.i8vipjili.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008655; classtype:social-engineering; sid:6008655; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (digital-task.pro/project/user8236581)"; flow:established,to_server; http.uri; content:"/project/user8236581"; startswith; fast_pattern; http.host; content:"digital-task.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008656; classtype:social-engineering; sid:6008656; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ayenoor85.github.io/Amazon-clone-project/)"; flow:established,to_server; http.uri; content:"/Amazon-clone-project/"; startswith; fast_pattern; http.host; content:"ayenoor85.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008657; classtype:social-engineering; sid:6008657; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkimgl.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkimgl.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008658; classtype:social-engineering; sid:6008658; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vrfdigitalcenter.com/project/SafeOrder)"; flow:established,to_server; http.uri; content:"/project/SafeOrder"; startswith; fast_pattern; http.host; content:"vrfdigitalcenter.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008659; classtype:social-engineering; sid:6008659; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sh8fo.69vipjili.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sh8fo.69vipjili.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008660; classtype:social-engineering; sid:6008660; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chbkjpm-help.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"chbkjpm-help.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008661; classtype:social-engineering; sid:6008661; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (huntigtonohio.one/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"huntigtonohio.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008662; classtype:social-engineering; sid:6008662; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jixmkt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jixmkt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008663; classtype:social-engineering; sid:6008663; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (judge-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"judge-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008664; classtype:social-engineering; sid:6008664; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kukoinnxlogin.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kukoinnxlogin.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008665; classtype:social-engineering; sid:6008665; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aflinks.co.uk/spl-eng/TenderDocRFP.php)"; flow:established,to_server; http.uri; content:"/spl-eng/TenderDocRFP.php"; startswith; fast_pattern; http.host; content:"aflinks.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008666; classtype:social-engineering; sid:6008666; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (virelaxonix.com/view/quotation)"; flow:established,to_server; http.uri; content:"/view/quotation"; startswith; fast_pattern; http.host; content:"virelaxonix.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008667; classtype:social-engineering; sid:6008667; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiverr-projects.pro/view/maindesk)"; flow:established,to_server; http.uri; content:"/view/maindesk"; startswith; fast_pattern; http.host; content:"fiverr-projects.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008668; classtype:social-engineering; sid:6008668; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (interactive-party-667481.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"interactive-party-667481.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008669; classtype:social-engineering; sid:6008669; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flverr-verlflcation.com/work/verifyfreelancer)"; flow:established,to_server; http.uri; content:"/work/verifyfreelancer"; startswith; fast_pattern; http.host; content:"flverr-verlflcation.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008670; classtype:social-engineering; sid:6008670; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cryttopcomogin.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cryttopcomogin.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008671; classtype:social-engineering; sid:6008671; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (midasbuystore.topup-mobiles.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"midasbuystore.topup-mobiles.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008672; classtype:social-engineering; sid:6008672; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chbkjpm-help.com/log.php)"; flow:established,to_server; http.uri; content:"/log.php"; startswith; fast_pattern; http.host; content:"chbkjpm-help.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008673; classtype:social-engineering; sid:6008673; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flverr-verlflcation.com/view/kollise)"; flow:established,to_server; http.uri; content:"/view/kollise"; startswith; fast_pattern; http.host; content:"flverr-verlflcation.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008674; classtype:social-engineering; sid:6008674; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (erific754ations.com.ytp.meo.mybluehost.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"erific754ations.com.ytp.meo.mybluehost.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008675; classtype:social-engineering; sid:6008675; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkimgj.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkimgj.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008676; classtype:social-engineering; sid:6008676; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (midasbuyofficial-excange.topup-mobiles.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"midasbuyofficial-excange.topup-mobiles.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008677; classtype:social-engineering; sid:6008677; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fillingform.me/view/es)"; flow:established,to_server; http.uri; content:"/view/es"; startswith; fast_pattern; http.host; content:"fillingform.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008678; classtype:social-engineering; sid:6008678; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (projectscore.pro/work/verifyfreelancer)"; flow:established,to_server; http.uri; content:"/work/verifyfreelancer"; startswith; fast_pattern; http.host; content:"projectscore.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008679; classtype:social-engineering; sid:6008679; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (req-sup405902.lol/project/Flverr)"; flow:established,to_server; http.uri; content:"/project/Flverr"; startswith; fast_pattern; http.host; content:"req-sup405902.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008680; classtype:social-engineering; sid:6008680; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (media-post-case-202631.pages.dev/meta.help)"; flow:established,to_server; http.uri; content:"/meta.help"; startswith; fast_pattern; http.host; content:"media-post-case-202631.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008681; classtype:social-engineering; sid:6008681; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fliver-rorder.click/work/verifyfreelancer)"; flow:established,to_server; http.uri; content:"/work/verifyfreelancer"; startswith; fast_pattern; http.host; content:"fliver-rorder.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008682; classtype:social-engineering; sid:6008682; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiverr-veriflcation.pro/project/WorkOrder)"; flow:established,to_server; http.uri; content:"/project/WorkOrder"; startswith; fast_pattern; http.host; content:"fiverr-veriflcation.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008683; classtype:social-engineering; sid:6008683; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (frontend-terkper-joseph-coinbase.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"frontend-terkper-joseph-coinbase.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008684; classtype:social-engineering; sid:6008684; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.spotify-clone-rho-one.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.spotify-clone-rho-one.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008685; classtype:social-engineering; sid:6008685; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiverr-veriflcation.pro/work/verifyfreelancer)"; flow:established,to_server; http.uri; content:"/work/verifyfreelancer"; startswith; fast_pattern; http.host; content:"fiverr-veriflcation.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008686; classtype:social-engineering; sid:6008686; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (konsimer.com/fv/project3184)"; flow:established,to_server; http.uri; content:"/fv/project3184"; startswith; fast_pattern; http.host; content:"konsimer.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008687; classtype:social-engineering; sid:6008687; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.program-resmi558.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.program-resmi558.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008688; classtype:social-engineering; sid:6008688; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.metanask.com/metamask/welcome.php)"; flow:established,to_server; http.uri; content:"/metamask/welcome.php"; startswith; fast_pattern; http.host; content:"www.metanask.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008689; classtype:social-engineering; sid:6008689; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.queen-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.queen-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008690; classtype:social-engineering; sid:6008690; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nkrhqu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nkrhqu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008691; classtype:social-engineering; sid:6008691; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5cn1cjni8kkk1w3mg.69vipjili.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"5cn1cjni8kkk1w3mg.69vipjili.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008692; classtype:social-engineering; sid:6008692; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (framelast.com/work/user84359231)"; flow:established,to_server; http.uri; content:"/work/user84359231"; startswith; fast_pattern; http.host; content:"framelast.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008693; classtype:social-engineering; sid:6008693; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (framelast.com/fv/chek-inf)"; flow:established,to_server; http.uri; content:"/fv/chek-inf"; startswith; fast_pattern; http.host; content:"framelast.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008694; classtype:social-engineering; sid:6008694; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (snowy-moon-7d6d.khanhu817373.workers.dev/meta.help)"; flow:established,to_server; http.uri; content:"/meta.help"; startswith; fast_pattern; http.host; content:"snowy-moon-7d6d.khanhu817373.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008695; classtype:social-engineering; sid:6008695; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi885.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi885.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008696; classtype:social-engineering; sid:6008696; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (digital-task.com/project/Flverr)"; flow:established,to_server; http.uri; content:"/project/Flverr"; startswith; fast_pattern; http.host; content:"digital-task.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008697; classtype:social-engineering; sid:6008697; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiverr-workspace.pro/view/es)"; flow:established,to_server; http.uri; content:"/view/es"; startswith; fast_pattern; http.host; content:"fiverr-workspace.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008698; classtype:social-engineering; sid:6008698; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wellobd.info/harrisfe/Request.php)"; flow:established,to_server; http.uri; content:"/harrisfe/Request.php"; startswith; fast_pattern; http.host; content:"wellobd.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008699; classtype:social-engineering; sid:6008699; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chbkjpm-help.com/card.php)"; flow:established,to_server; http.uri; content:"/card.php"; startswith; fast_pattern; http.host; content:"chbkjpm-help.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008700; classtype:social-engineering; sid:6008700; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jaswanthlakshman.github.io/NetflixClone)"; flow:established,to_server; http.uri; content:"/NetflixClone"; startswith; fast_pattern; http.host; content:"jaswanthlakshman.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008701; classtype:social-engineering; sid:6008701; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (drenixzen.com/view/es)"; flow:established,to_server; http.uri; content:"/view/es"; startswith; fast_pattern; http.host; content:"drenixzen.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008702; classtype:social-engineering; sid:6008702; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spotify-clone-rho-one.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spotify-clone-rho-one.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008703; classtype:social-engineering; sid:6008703; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (first-illuminated.bond/work/verifyfreelancer)"; flow:established,to_server; http.uri; content:"/work/verifyfreelancer"; startswith; fast_pattern; http.host; content:"first-illuminated.bond"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008704; classtype:social-engineering; sid:6008704; rev:1; metadata: signature_severity Major, created_et 2026_05_28, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqo.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingqo.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008705; classtype:social-engineering; sid:6008705; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqq.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingqq.cyou"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008706; classtype:social-engineering; sid:6008706; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingql.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingql.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008707; classtype:social-engineering; sid:6008707; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqw.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingqw.cyou"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008708; classtype:social-engineering; sid:6008708; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inventive-yucca-958870.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"inventive-yucca-958870.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008709; classtype:social-engineering; sid:6008709; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqu.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingqu.cyou"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008710; classtype:social-engineering; sid:6008710; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (annakovaleva.com/?type=verify&\;key=pfvbhfjzjx)"; flow:established,to_server; http.uri; content:"/?type=verify&|3b|key=pfvbhfjzjx"; startswith; fast_pattern; http.host; content:"annakovaleva.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008711; classtype:social-engineering; sid:6008711; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqe.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingqe.cyou"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008712; classtype:social-engineering; sid:6008712; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqa.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingqa.cyou"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008713; classtype:social-engineering; sid:6008713; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqg.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingqg.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008714; classtype:social-engineering; sid:6008714; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqj.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingqj.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008715; classtype:social-engineering; sid:6008715; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en-ledgrstart-us.framer.media/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"en-ledgrstart-us.framer.media"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008716; classtype:social-engineering; sid:6008716; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledggrliveslogi.framer.media/extension)"; flow:established,to_server; http.uri; content:"/extension"; startswith; fast_pattern; http.host; content:"ledggrliveslogi.framer.media"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008717; classtype:social-engineering; sid:6008717; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (baselaning.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"baselaning.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008718; classtype:social-engineering; sid:6008718; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (glamorous-leadership-648052.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"glamorous-leadership-648052.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008719; classtype:social-engineering; sid:6008719; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hubbldger.framer.media/en-ca)"; flow:established,to_server; http.uri; content:"/en-ca"; startswith; fast_pattern; http.host; content:"hubbldger.framer.media"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008720; classtype:social-engineering; sid:6008720; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (learn-us-bridge.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"learn-us-bridge.framer.ai"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008721; classtype:social-engineering; sid:6008721; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (liveledgr.framer.media/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"liveledgr.framer.media"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008722; classtype:social-engineering; sid:6008722; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kleinanzeigen.010jdt.com/813553465?mail=W0NBVENIXQ%3D%3D&meta=rlWjMKWwLJ50LJqyVwb1YPWhLJ1yVwbvKUHlAzRkKUIzMGOzVRAuqTAbGJHtGJScoTIlVvjvL2uuqS9cMPV6YGRjZQV5BQLkZmt0ZGNfVaAypaMcL2HvBvWeoTIcozShrzIcM2IhVvjvqUyjMFV6VzAuqTAboJIsoJScoPW9)"; flow:established,to_server; http.uri; content:"/813553465?mail=W0NBVENIXQ%3D%3D&meta=rlWjMKWwLJ50LJqyVwb1YPWhLJ1yVwbvKUHlAzRkKUIzMGOzVRAuqTAbGJHtGJScoTIlVvjvL2uuqS9cMPV6YGRjZQV5BQLkZmt0ZGNfVaAypaMcL2HvBvWeoTIcozShrzIcM2IhVvjvqUyjMFV6VzAuqTAboJIsoJScoPW9"; startswith; fast_pattern; http.host; content:"kleinanzeigen.010jdt.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008723; classtype:social-engineering; sid:6008723; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ldgrliv-us.framer.media/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ldgrliv-us.framer.media"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008724; classtype:social-engineering; sid:6008724; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lezer-com-eng.framer.media/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lezer-com-eng.framer.media"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008725; classtype:social-engineering; sid:6008725; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eng-ledgrstart-us.framer.media/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"eng-ledgrstart-us.framer.media"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008726; classtype:social-engineering; sid:6008726; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (salva-tore.bdll845000.pro/captcha.php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"salva-tore.bdll845000.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008727; classtype:social-engineering; sid:6008727; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (livestart-ldgre.framer.media/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"livestart-ldgre.framer.media"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008728; classtype:social-engineering; sid:6008728; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2026-05-30.sqllq.com/en/?howtosuecslplasma.org#nolanguage)"; flow:established,to_server; http.uri; content:"/en/?howtosuecslplasma.org#nolanguage"; startswith; fast_pattern; http.host; content:"2026-05-30.sqllq.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008729; classtype:social-engineering; sid:6008729; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qwwasetoltyiuiu.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qwwasetoltyiuiu.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008730; classtype:social-engineering; sid:6008730; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgorliv.framer.media/signin)"; flow:established,to_server; http.uri; content:"/signin"; startswith; fast_pattern; http.host; content:"ledgorliv.framer.media"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008731; classtype:social-engineering; sid:6008731; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tvxqplmrzn.cloud/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tvxqplmrzn.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008732; classtype:social-engineering; sid:6008732; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mzplxvqtrn.cloud/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mzplxvqtrn.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008733; classtype:social-engineering; sid:6008733; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pagamento-pedagio.dynv6.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pagamento-pedagio.dynv6.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008734; classtype:social-engineering; sid:6008734; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xqtrplnvzm.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xqtrplnvzm.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008735; classtype:social-engineering; sid:6008735; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.zntrqplvmx.icu/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.zntrqplvmx.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008736; classtype:social-engineering; sid:6008736; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ptshopee3677.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ptshopee3677.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008737; classtype:social-engineering; sid:6008737; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kqmvtrplzx.ink/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kqmvtrplzx.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008738; classtype:social-engineering; sid:6008738; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (03113659.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"03113659.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008739; classtype:social-engineering; sid:6008739; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.klaimsource50.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.klaimsource50.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008740; classtype:social-engineering; sid:6008740; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi311.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"info-resmi311.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008741; classtype:social-engineering; sid:6008741; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xnrqtpzvlm.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xnrqtpzvlm.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008742; classtype:social-engineering; sid:6008742; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fy6nma.casa/o/3ui2o/1771403167516#selectedbank9)"; flow:established,to_server; http.uri; content:"/o/3ui2o/1771403167516#selectedbank9"; startswith; fast_pattern; http.host; content:"fy6nma.casa"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008743; classtype:social-engineering; sid:6008743; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apsess-swsgyaiajtnj3xd1yxzkt4vcbu59zaco.autosleutel-oss.nl/auth/login.php)"; flow:established,to_server; http.uri; content:"/auth/login.php"; startswith; fast_pattern; http.host; content:"apsess-swsgyaiajtnj3xd1yxzkt4vcbu59zaco.autosleutel-oss.nl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008744; classtype:social-engineering; sid:6008744; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.masukglobalkarir.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.masukglobalkarir.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008745; classtype:social-engineering; sid:6008745; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (connect.policiespage-accountcenter.us/help-center-3112006468)"; flow:established,to_server; http.uri; content:"/help-center-3112006468"; startswith; fast_pattern; http.host; content:"connect.policiespage-accountcenter.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008746; classtype:social-engineering; sid:6008746; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xqtrplznvm.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xqtrplznvm.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008747; classtype:social-engineering; sid:6008747; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (51151199.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"51151199.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008748; classtype:social-engineering; sid:6008748; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (monikhakandaswamy.github.io/Amazon-Clone-demo)"; flow:established,to_server; http.uri; content:"/Amazon-Clone-demo"; startswith; fast_pattern; http.host; content:"monikhakandaswamy.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008749; classtype:social-engineering; sid:6008749; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fasubra.org.br/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fasubra.org.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008750; classtype:social-engineering; sid:6008750; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dhl-logisticsway.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dhl-logisticsway.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008751; classtype:social-engineering; sid:6008751; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alirazamalik78183-crypto.github.io/Instagram)"; flow:established,to_server; http.uri; content:"/Instagram"; startswith; fast_pattern; http.host; content:"alirazamalik78183-crypto.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008752; classtype:social-engineering; sid:6008752; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktifkan-payllaterz.exi.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktifkan-payllaterz.exi.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008753; classtype:social-engineering; sid:6008753; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hdsiul.top/pay/_frame/a_shop.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_shop.html"; startswith; fast_pattern; http.host; content:"t-mobile.hdsiul.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008754; classtype:social-engineering; sid:6008754; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqy.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingqy.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008755; classtype:social-engineering; sid:6008755; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vrmzqplxnt.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.vrmzqplxnt.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008756; classtype:social-engineering; sid:6008756; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqxplmtzvn.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqxplmtzvn.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008757; classtype:social-engineering; sid:6008757; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqn.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingqn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008758; classtype:social-engineering; sid:6008758; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (humorous-elements-274135.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"humorous-elements-274135.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008759; classtype:social-engineering; sid:6008759; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mpltzrvqxn.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mpltzrvqxn.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008760; classtype:social-engineering; sid:6008760; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.mdoqwz.buzz/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.mdoqwz.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008761; classtype:social-engineering; sid:6008761; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docotrri.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"docotrri.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008762; classtype:social-engineering; sid:6008762; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mtrqzlxpvn.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mtrqzlxpvn.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008763; classtype:social-engineering; sid:6008763; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwq.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingwq.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008764; classtype:social-engineering; sid:6008764; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tplxvqrmzn.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tplxvqrmzn.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008765; classtype:social-engineering; sid:6008765; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0223659.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"0223659.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008766; classtype:social-engineering; sid:6008766; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telepoonmail.flazio.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"telepoonmail.flazio.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008767; classtype:social-engineering; sid:6008767; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wetransfer-share-files.netlify.app/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"wetransfer-share-files.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008768; classtype:social-engineering; sid:6008768; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rsocjt.top/pay/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.rsocjt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008769; classtype:social-engineering; sid:6008769; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.plktrmzvqn.ink/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.plktrmzvqn.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008770; classtype:social-engineering; sid:6008770; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (51157744.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"51157744.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008771; classtype:social-engineering; sid:6008771; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-validation-service-u16.click/id-update/)"; flow:established,to_server; http.uri; content:"/id-update/"; startswith; fast_pattern; http.host; content:"account-validation-service-u16.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008772; classtype:social-engineering; sid:6008772; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (09513659.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"09513659.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008773; classtype:social-engineering; sid:6008773; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xvnrqtlpmz.cloud/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xvnrqtlpmz.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008774; classtype:social-engineering; sid:6008774; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (magrigereposmain.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"magrigereposmain.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008775; classtype:social-engineering; sid:6008775; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqi.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingqi.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008776; classtype:social-engineering; sid:6008776; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mpltqvxrzn.cloud/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mpltqvxrzn.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008777; classtype:social-engineering; sid:6008777; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tvplmxqrzn.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tvplmxqrzn.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008778; classtype:social-engineering; sid:6008778; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.365bet002.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.365bet002.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008779; classtype:social-engineering; sid:6008779; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-validation-service-u12.click/id-update)"; flow:established,to_server; http.uri; content:"/id-update"; startswith; fast_pattern; http.host; content:"account-validation-service-u12.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008780; classtype:social-engineering; sid:6008780; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mqtrplxzvn.cloud/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mqtrplxzvn.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008781; classtype:social-engineering; sid:6008781; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqy.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingqy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008782; classtype:social-engineering; sid:6008782; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.examinec.xyz/uk/)"; flow:established,to_server; http.uri; content:"/uk/"; startswith; fast_pattern; http.host; content:"dpd.examinec.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008783; classtype:social-engineering; sid:6008783; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xvnplqtmrz.ink/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xvnplqtmrz.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008784; classtype:social-engineering; sid:6008784; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.plqztrxmnv.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.plqztrxmnv.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008785; classtype:social-engineering; sid:6008785; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ennymtshweni.github.io/netflix-assignment-1/)"; flow:established,to_server; http.uri; content:"/netflix-assignment-1/"; startswith; fast_pattern; http.host; content:"ennymtshweni.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008786; classtype:social-engineering; sid:6008786; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi991.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"info-resmi991.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008787; classtype:social-engineering; sid:6008787; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.cqcsxc.cc/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.cqcsxc.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008788; classtype:social-engineering; sid:6008788; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.volusionccyc.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.volusionccyc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008789; classtype:social-engineering; sid:6008789; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vrmzqpltnx.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.vrmzqpltnx.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008790; classtype:social-engineering; sid:6008790; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.urrqqj.buzz/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.urrqqj.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008791; classtype:social-engineering; sid:6008791; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t001xiwlogintlook.sonin.click/verify/2d3c88db-51d3-4efe-8057-660ef405e14a)"; flow:established,to_server; http.uri; content:"/verify/2d3c88db-51d3-4efe-8057-660ef405e14a"; startswith; fast_pattern; http.host; content:"t001xiwlogintlook.sonin.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008792; classtype:social-engineering; sid:6008792; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.qvxtrmzlpn.ink/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.qvxtrmzlpn.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008793; classtype:social-engineering; sid:6008793; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aaincentive.us/PL-1466-160526/?u=81C1466&e=judyta_skarbinska%4)"; flow:established,to_server; http.uri; content:"/PL-1466-160526/?u=81C1466&e=judyta_skarbinska%4"; startswith; fast_pattern; http.host; content:"aaincentive.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008794; classtype:social-engineering; sid:6008794; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spidarubaself.bar/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spidarubaself.bar"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008795; classtype:social-engineering; sid:6008795; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.qplvmtrxzn.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.qplvmtrxzn.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008796; classtype:social-engineering; sid:6008796; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.lqmvztrxpa.icu/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.lqmvztrxpa.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008797; classtype:social-engineering; sid:6008797; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xqtrmvnzpl.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xqtrmvnzpl.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008798; classtype:social-engineering; sid:6008798; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.helpdesik.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.helpdesik.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008799; classtype:social-engineering; sid:6008799; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqy.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingqy.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008800; classtype:social-engineering; sid:6008800; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (peirirefu-k2z1309.pages.dev/jabrofay-oixala/)"; flow:established,to_server; http.uri; content:"/jabrofay-oixala/"; startswith; fast_pattern; http.host; content:"peirirefu-k2z1309.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008801; classtype:social-engineering; sid:6008801; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (51155555.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"51155555.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008802; classtype:social-engineering; sid:6008802; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vplxqtmrzn.cloud/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.vplxqtmrzn.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008803; classtype:social-engineering; sid:6008803; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (antiochselfstorage.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"antiochselfstorage.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008804; classtype:social-engineering; sid:6008804; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e-form.dana-dibekukan.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e-form.dana-dibekukan.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008805; classtype:social-engineering; sid:6008805; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.zrygph.help/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.zrygph.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008806; classtype:social-engineering; sid:6008806; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqp.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingqp.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008807; classtype:social-engineering; sid:6008807; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingql.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingql.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008808; classtype:social-engineering; sid:6008808; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xplmvqzrtn.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xplmvqzrtn.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008809; classtype:social-engineering; sid:6008809; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portal-io-start-trezer-app.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"portal-io-start-trezer-app.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008810; classtype:social-engineering; sid:6008810; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vrplxtqmzn.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.vrplxtqmzn.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008811; classtype:social-engineering; sid:6008811; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (o3bncx.casa/o/3ui2o/1771403167516#selectedbank9)"; flow:established,to_server; http.uri; content:"/o/3ui2o/1771403167516#selectedbank9"; startswith; fast_pattern; http.host; content:"o3bncx.casa"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008812; classtype:social-engineering; sid:6008812; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqw.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingqw.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008813; classtype:social-engineering; sid:6008813; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (noreply80481-stack.github.io/ft/)"; flow:established,to_server; http.uri; content:"/ft/"; startswith; fast_pattern; http.host; content:"noreply80481-stack.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008814; classtype:social-engineering; sid:6008814; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (click-hostopoint-ch-redirect1221531.blogspot.com/?redirect=1&asid=6eqNTa2EFvJ7Vy7fK9wfZaoDXYPvtDTCm)"; flow:established,to_server; http.uri; content:"/?redirect=1&asid=6eqNTa2EFvJ7Vy7fK9wfZaoDXYPvtDTCm"; startswith; fast_pattern; http.host; content:"click-hostopoint-ch-redirect1221531.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008815; classtype:social-engineering; sid:6008815; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.ysgaqn.click/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.ysgaqn.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008816; classtype:social-engineering; sid:6008816; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xplmvztrqn.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xplmvztrqn.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008817; classtype:social-engineering; sid:6008817; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqv.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingqv.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008818; classtype:social-engineering; sid:6008818; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.plznxqtrmv.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.plznxqtrmv.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008819; classtype:social-engineering; sid:6008819; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqi.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingqi.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008820; classtype:social-engineering; sid:6008820; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.xgscmf.cc/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.xgscmf.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008821; classtype:social-engineering; sid:6008821; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (easy4freeget.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"easy4freeget.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008822; classtype:social-engineering; sid:6008822; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.plztrqnvxm.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.plztrqnvxm.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008823; classtype:social-engineering; sid:6008823; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp.gt.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp.gt.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008824; classtype:social-engineering; sid:6008824; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mytrust.cards/jp/)"; flow:established,to_server; http.uri; content:"/jp/"; startswith; fast_pattern; http.host; content:"mytrust.cards"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008825; classtype:social-engineering; sid:6008825; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tumurt-urguu.com/index.php?sel=product&f=sub1&menu_id=3)"; flow:established,to_server; http.uri; content:"/index.php?sel=product&f=sub1&menu_id=3"; startswith; fast_pattern; http.host; content:"www.tumurt-urguu.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008826; classtype:social-engineering; sid:6008826; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.lewvrk.cc/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.lewvrk.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008827; classtype:social-engineering; sid:6008827; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mpxtrqlzvn.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mpxtrqlzvn.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008828; classtype:social-engineering; sid:6008828; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (355884.cc/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"355884.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008829; classtype:social-engineering; sid:6008829; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xqtrplmzvn.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xqtrplmzvn.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008830; classtype:social-engineering; sid:6008830; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gc-controles.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gc-controles.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008831; classtype:social-engineering; sid:6008831; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xvnplzqmtr.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xvnplzqmtr.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008832; classtype:social-engineering; sid:6008832; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqe.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingqe.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008833; classtype:social-engineering; sid:6008833; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.qvtrplmxzn.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.qvtrplmxzn.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008834; classtype:social-engineering; sid:6008834; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hyperinteract.com/rTggdWycgx/Korea.html)"; flow:established,to_server; http.uri; content:"/rTggdWycgx/Korea.html"; startswith; fast_pattern; http.host; content:"hyperinteract.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008835; classtype:social-engineering; sid:6008835; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pt-shopee239.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pt-shopee239.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008836; classtype:social-engineering; sid:6008836; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (olazamani.github.io/webmailupdate/)"; flow:established,to_server; http.uri; content:"/webmailupdate/"; startswith; fast_pattern; http.host; content:"olazamani.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008837; classtype:social-engineering; sid:6008837; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (srba.closer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"srba.closer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008838; classtype:social-engineering; sid:6008838; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.tgmong.buzz/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.tgmong.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008839; classtype:social-engineering; sid:6008839; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (admin.booking.id0195.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"admin.booking.id0195.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008840; classtype:social-engineering; sid:6008840; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-validation-service-u18.click/id-update)"; flow:established,to_server; http.uri; content:"/id-update"; startswith; fast_pattern; http.host; content:"account-validation-service-u18.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008841; classtype:social-engineering; sid:6008841; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mxqtplzrvn.cloud/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mxqtplzrvn.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008842; classtype:social-engineering; sid:6008842; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trw-xeda.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trw-xeda.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008843; classtype:social-engineering; sid:6008843; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1615666777.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1615666777.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008844; classtype:social-engineering; sid:6008844; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sruthy047.github.io/Netflix/)"; flow:established,to_server; http.uri; content:"/Netflix/"; startswith; fast_pattern; http.host; content:"sruthy047.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008845; classtype:social-engineering; sid:6008845; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi955.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"info-resmi955.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008846; classtype:social-engineering; sid:6008846; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.jfowgi.help/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.jfowgi.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008847; classtype:social-engineering; sid:6008847; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.qbhlxx.help/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.qbhlxx.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008848; classtype:social-engineering; sid:6008848; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.airbnb-assistant-landing.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.airbnb-assistant-landing.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008849; classtype:social-engineering; sid:6008849; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rebate.amz-refund.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rebate.amz-refund.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008850; classtype:social-engineering; sid:6008850; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zeronanatucksss.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zeronanatucksss.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008851; classtype:social-engineering; sid:6008851; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (get-you-free-blue-tick-verify-badge.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"get-you-free-blue-tick-verify-badge.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008852; classtype:social-engineering; sid:6008852; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqp.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingqp.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008853; classtype:social-engineering; sid:6008853; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lockflex.world/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lockflex.world"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008854; classtype:social-engineering; sid:6008854; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kncoiulagix.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kncoiulagix.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008855; classtype:social-engineering; sid:6008855; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.mrehif.click/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.mrehif.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008856; classtype:social-engineering; sid:6008856; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (berimisso.com/machina/)"; flow:established,to_server; http.uri; content:"/machina/"; startswith; fast_pattern; http.host; content:"berimisso.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008857; classtype:social-engineering; sid:6008857; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (indoorkartingbarcelona.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"indoorkartingbarcelona.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008858; classtype:social-engineering; sid:6008858; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xvnrptqlmz.ink/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xvnrptqlmz.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008859; classtype:social-engineering; sid:6008859; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-project-zeta.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-project-zeta.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008860; classtype:social-engineering; sid:6008860; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0283659.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"0283659.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008861; classtype:social-engineering; sid:6008861; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-pg-queen.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app-pg-queen.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008862; classtype:social-engineering; sid:6008862; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (boardlvmhmandate-bd.us-iad-10.linodeobjects.com/checkers.html)"; flow:established,to_server; http.uri; content:"/checkers.html"; startswith; fast_pattern; http.host; content:"boardlvmhmandate-bd.us-iad-10.linodeobjects.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008863; classtype:social-engineering; sid:6008863; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klaarvoordetoekomst.info/PL-1466-160526/?e=alenlab@288880542a3ca26f84436146de599624c430.net&s3=jozef&s4=sbeczka&s5=&s6=&s7=&s8=&u=83C1466)"; flow:established,to_server; http.uri; content:"/PL-1466-160526/?e=alenlab@288880542a3ca26f84436146de599624c430.net&s3=jozef&s4=sbeczka&s5=&s6=&s7=&s8=&u=83C1466"; startswith; fast_pattern; http.host; content:"klaarvoordetoekomst.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008864; classtype:social-engineering; sid:6008864; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0233659.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"0233659.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008865; classtype:social-engineering; sid:6008865; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xvnplztrqm.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xvnplztrqm.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008866; classtype:social-engineering; sid:6008866; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (destraveseumaisnovolmt.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"destraveseumaisnovolmt.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008867; classtype:social-engineering; sid:6008867; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aseagle.com.au/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aseagle.com.au"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008868; classtype:social-engineering; sid:6008868; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqa.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingqa.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008869; classtype:social-engineering; sid:6008869; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yogisandyoginis.com/wp-content/themes/Divis/sunnn.htm)"; flow:established,to_server; http.uri; content:"/wp-content/themes/Divis/sunnn.htm"; startswith; fast_pattern; http.host; content:"yogisandyoginis.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008870; classtype:social-engineering; sid:6008870; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqr.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingqr.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008871; classtype:social-engineering; sid:6008871; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.qplvmtrnzx.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.qplvmtrnzx.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008872; classtype:social-engineering; sid:6008872; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sujalbshirodkar.github.io/amazon-clone/orders.html)"; flow:established,to_server; http.uri; content:"/amazon-clone/orders.html"; startswith; fast_pattern; http.host; content:"sujalbshirodkar.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008873; classtype:social-engineering; sid:6008873; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.verifyi.xyz/uk/)"; flow:established,to_server; http.uri; content:"/uk/"; startswith; fast_pattern; http.host; content:"dpd.verifyi.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008874; classtype:social-engineering; sid:6008874; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xplmvqtrzn.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xplmvqtrzn.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008875; classtype:social-engineering; sid:6008875; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mztrxqplvn.cloud/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mztrxqplvn.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008876; classtype:social-engineering; sid:6008876; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maps.sih-p.com/?i=Tqoiy)"; flow:established,to_server; http.uri; content:"/?i=Tqoiy"; startswith; fast_pattern; http.host; content:"maps.sih-p.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008877; classtype:social-engineering; sid:6008877; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqtplxvmnz.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqtplxvmnz.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008878; classtype:social-engineering; sid:6008878; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.jjmpeh.buzz/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.jjmpeh.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008879; classtype:social-engineering; sid:6008879; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.plqztrvmnx.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.plqztrvmnx.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008880; classtype:social-engineering; sid:6008880; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yh9901.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yh9901.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008881; classtype:social-engineering; sid:6008881; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqt.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingqt.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008882; classtype:social-engineering; sid:6008882; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cattlenotes.info/PL-1466-160526/?u=12C1466&e=anna%40opakowanie)"; flow:established,to_server; http.uri; content:"/PL-1466-160526/?u=12C1466&e=anna%40opakowanie"; startswith; fast_pattern; http.host; content:"cattlenotes.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008883; classtype:social-engineering; sid:6008883; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qs2frz.cfd/o/3ui2o/1771403167516#selectedbank9)"; flow:established,to_server; http.uri; content:"/o/3ui2o/1771403167516#selectedbank9"; startswith; fast_pattern; http.host; content:"qs2frz.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008884; classtype:social-engineering; sid:6008884; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gukan-s.github.io/Amaon_Clone/signin.html)"; flow:established,to_server; http.uri; content:"/Amaon_Clone/signin.html"; startswith; fast_pattern; http.host; content:"gukan-s.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008885; classtype:social-engineering; sid:6008885; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (51153388.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"51153388.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008886; classtype:social-engineering; sid:6008886; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gosmainretrog8t.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gosmainretrog8t.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008887; classtype:social-engineering; sid:6008887; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.volusionccyc.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&dsh=S-1576164674%3A1780020675114826&followup=https%3A%2F%2Faccounts.google.com%2F&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2PavvZnmv-ceK3ArT7_ljhiJoJ2cWCatfywvIw9WrYSZIUoWkh2GfTMRW_nW4EAP2hOqJyS2KmQ)"; flow:established,to_server; http.uri; content:"/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&dsh=S-1576164674%3A1780020675114826&followup=https%3A%2F%2Faccounts.google.com%2F&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2PavvZnmv-ceK3ArT7_ljhiJoJ2cWCatfywvIw9WrYSZIUoWkh2GfTMRW_nW4EAP2hOqJyS2KmQ"; startswith; fast_pattern; http.host; content:"www.volusionccyc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008888; classtype:social-engineering; sid:6008888; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.365bet002.com:443/chs/)"; flow:established,to_server; http.uri; content:"/chs/"; startswith; fast_pattern; http.host; content:"m.365bet002.com:443"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008889; classtype:social-engineering; sid:6008889; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3659f.cc/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"3659f.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008890; classtype:social-engineering; sid:6008890; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nexyl.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nexyl.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008891; classtype:social-engineering; sid:6008891; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kncoiulagix.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kncoiulagix.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008892; classtype:social-engineering; sid:6008892; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lm1hvy6s40.accutaneforacne.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lm1hvy6s40.accutaneforacne.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008893; classtype:social-engineering; sid:6008893; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.zaagnk.cc/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.zaagnk.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008894; classtype:social-engineering; sid:6008894; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.uthajq.click/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.uthajq.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008895; classtype:social-engineering; sid:6008895; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1505mmm.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1505mmm.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008896; classtype:social-engineering; sid:6008896; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tvxplmqrzn.cloud/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tvxplmqrzn.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008897; classtype:social-engineering; sid:6008897; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xvnrqlmzpt.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xvnrqlmzpt.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008898; classtype:social-engineering; sid:6008898; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (12bet8888-a.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"12bet8888-a.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008899; classtype:social-engineering; sid:6008899; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pravly.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pravly.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008900; classtype:social-engineering; sid:6008900; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (51150077.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"51150077.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008901; classtype:social-engineering; sid:6008901; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqxplmnvtz.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqxplmnvtz.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008902; classtype:social-engineering; sid:6008902; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (guajuchinmain.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"guajuchinmain.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008903; classtype:social-engineering; sid:6008903; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tplqzrmvxn.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tplqzrmvxn.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008904; classtype:social-engineering; sid:6008904; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mznrqvtxpl.ink/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mznrqvtxpl.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008905; classtype:social-engineering; sid:6008905; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mtrqzplxvn.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mtrqzplxvn.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008906; classtype:social-engineering; sid:6008906; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (euroreward.xyz/?adid=1866392874500241)"; flow:established,to_server; http.uri; content:"/?adid=1866392874500241"; startswith; fast_pattern; http.host; content:"euroreward.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008907; classtype:social-engineering; sid:6008907; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aurapharma.com/es/adobe/)"; flow:established,to_server; http.uri; content:"/es/adobe/"; startswith; fast_pattern; http.host; content:"aurapharma.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008908; classtype:social-engineering; sid:6008908; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ko1rfu.lat/o/3ui2o/1771403167516#selectedbank9)"; flow:established,to_server; http.uri; content:"/o/3ui2o/1771403167516#selectedbank9"; startswith; fast_pattern; http.host; content:"ko1rfu.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008909; classtype:social-engineering; sid:6008909; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xvnplqztrm.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xvnplqztrm.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008910; classtype:social-engineering; sid:6008910; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-validation-service-u15.click/id-update/)"; flow:established,to_server; http.uri; content:"/id-update/"; startswith; fast_pattern; http.host; content:"account-validation-service-u15.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008911; classtype:social-engineering; sid:6008911; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.gyycas.help/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.gyycas.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008912; classtype:social-engineering; sid:6008912; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecom.roller.app/eagle/booknow/en/products)"; flow:established,to_server; http.uri; content:"/eagle/booknow/en/products"; startswith; fast_pattern; http.host; content:"ecom.roller.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008913; classtype:social-engineering; sid:6008913; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mtrqplxzvn.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mtrqplxzvn.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008914; classtype:social-engineering; sid:6008914; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-0b05fc97993245c28a18cdbc620c3719.r2.dev/index_obf.html)"; flow:established,to_server; http.uri; content:"/index_obf.html"; startswith; fast_pattern; http.host; content:"pub-0b05fc97993245c28a18cdbc620c3719.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008915; classtype:social-engineering; sid:6008915; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktifkaanpaylaterl.wxx.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktifkaanpaylaterl.wxx.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008916; classtype:social-engineering; sid:6008916; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mplzqrvxtn.ink/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mplzqrvxtn.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008917; classtype:social-engineering; sid:6008917; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (51158877.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"51158877.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008918; classtype:social-engineering; sid:6008918; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ar0010.cn/icloudss/)"; flow:established,to_server; http.uri; content:"/icloudss/"; startswith; fast_pattern; http.host; content:"ar0010.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008919; classtype:social-engineering; sid:6008919; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kaybelacoaching.com/wordpress/flexion/index.php)"; flow:established,to_server; http.uri; content:"/wordpress/flexion/index.php"; startswith; fast_pattern; http.host; content:"kaybelacoaching.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008920; classtype:social-engineering; sid:6008920; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xplmqrvztn.ink/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xplmqrvztn.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008921; classtype:social-engineering; sid:6008921; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqi.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingqi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008922; classtype:social-engineering; sid:6008922; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mitrashopnetwork.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mitrashopnetwork.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008923; classtype:social-engineering; sid:6008923; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mosaicline.click/afirmacionuserr/)"; flow:established,to_server; http.uri; content:"/afirmacionuserr/"; startswith; fast_pattern; http.host; content:"mosaicline.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008924; classtype:social-engineering; sid:6008924; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.labcapture.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.labcapture.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008925; classtype:social-engineering; sid:6008925; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqt.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingqt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008926; classtype:social-engineering; sid:6008926; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqzplxtvmn.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqzplxtvmn.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008927; classtype:social-engineering; sid:6008927; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (consultorioalvarado.com/lisasolibella-CloudDoc-SolibellaAG-Revised20260410pdf.php/hgE2dgwiUEU4GQ)"; flow:established,to_server; http.uri; content:"/lisasolibella-CloudDoc-SolibellaAG-Revised20260410pdf.php/hgE2dgwiUEU4GQ"; startswith; fast_pattern; http.host; content:"consultorioalvarado.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008928; classtype:social-engineering; sid:6008928; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (l1sdcm.lat/o/3ui2o/1771403167516#selectedbank9)"; flow:established,to_server; http.uri; content:"/o/3ui2o/1771403167516#selectedbank9"; startswith; fast_pattern; http.host; content:"l1sdcm.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008929; classtype:social-engineering; sid:6008929; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klelnanzeigen.id83923423.info/login/8990197783)"; flow:established,to_server; http.uri; content:"/login/8990197783"; startswith; fast_pattern; http.host; content:"klelnanzeigen.id83923423.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008930; classtype:social-engineering; sid:6008930; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (03713659.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"03713659.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008931; classtype:social-engineering; sid:6008931; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.qtrvmxplzn.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.qtrvmxplzn.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008932; classtype:social-engineering; sid:6008932; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqn.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingqn.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008933; classtype:social-engineering; sid:6008933; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.plztrvmnxq.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.plztrvmnxq.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008934; classtype:social-engineering; sid:6008934; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verifiedspcl.pages.dev/support/management)"; flow:established,to_server; http.uri; content:"/support/management"; startswith; fast_pattern; http.host; content:"verifiedspcl.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008935; classtype:social-engineering; sid:6008935; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (088865.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"088865.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008936; classtype:social-engineering; sid:6008936; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.qtrzvpnxml.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.qtrzvpnxml.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008937; classtype:social-engineering; sid:6008937; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.honoes.click/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.honoes.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008938; classtype:social-engineering; sid:6008938; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (preview-coinbase.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"preview-coinbase.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008939; classtype:social-engineering; sid:6008939; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appleicloudmail.sviluppo.host/service/21438-048132-912)"; flow:established,to_server; http.uri; content:"/service/21438-048132-912"; startswith; fast_pattern; http.host; content:"appleicloudmail.sviluppo.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008940; classtype:social-engineering; sid:6008940; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-validation-service-u8.click/id-update/)"; flow:established,to_server; http.uri; content:"/id-update/"; startswith; fast_pattern; http.host; content:"account-validation-service-u8.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008941; classtype:social-engineering; sid:6008941; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (preview-coinbase.com/loading.php?client_id=6bee586e-9bdf-179f-776a-1e9923410de1&oauth_challenge=mmn41gOeOU6aUXGwO9JoeYAH3rwFGUxh7F6u-a7pBMI)"; flow:established,to_server; http.uri; content:"/loading.php?client_id=6bee586e-9bdf-179f-776a-1e9923410de1&oauth_challenge=mmn41gOeOU6aUXGwO9JoeYAH3rwFGUxh7F6u-a7pBMI"; startswith; fast_pattern; http.host; content:"preview-coinbase.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008942; classtype:social-engineering; sid:6008942; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.qtrvmpxlzn.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.qtrvmpxlzn.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008943; classtype:social-engineering; sid:6008943; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.51156644.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.51156644.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008944; classtype:social-engineering; sid:6008944; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zh-cn-winnersports.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zh-cn-winnersports.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008945; classtype:social-engineering; sid:6008945; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp.gr.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp.gr.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008946; classtype:social-engineering; sid:6008946; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bnc.klkhds.click/?id=veren2@76c9a8d1999161c398089d96ef03f7577939.org)"; flow:established,to_server; http.uri; content:"/?id=veren2@76c9a8d1999161c398089d96ef03f7577939.org"; startswith; fast_pattern; http.host; content:"bnc.klkhds.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008947; classtype:social-engineering; sid:6008947; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xnrqtpvlzm.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xnrqtpvlzm.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008948; classtype:social-engineering; sid:6008948; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.examinec.bond/uk/)"; flow:established,to_server; http.uri; content:"/uk/"; startswith; fast_pattern; http.host; content:"dpd.examinec.bond"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008949; classtype:social-engineering; sid:6008949; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-validation-service-u3.click/id-update)"; flow:established,to_server; http.uri; content:"/id-update"; startswith; fast_pattern; http.host; content:"account-validation-service-u3.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008950; classtype:social-engineering; sid:6008950; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (office.redstarsoft.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"office.redstarsoft.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008951; classtype:social-engineering; sid:6008951; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqq.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingqq.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008952; classtype:social-engineering; sid:6008952; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqr.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingqr.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008953; classtype:social-engineering; sid:6008953; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xqtrmvlnzp.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xqtrmvlnzp.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008954; classtype:social-engineering; sid:6008954; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.rrnqzq.click/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.rrnqzq.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008955; classtype:social-engineering; sid:6008955; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (validarmailoutlook00.zya.me/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"validarmailoutlook00.zya.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008956; classtype:social-engineering; sid:6008956; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xvnrqzmplt.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xvnrqzmplt.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008957; classtype:social-engineering; sid:6008957; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xwnsr.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xwnsr.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008958; classtype:social-engineering; sid:6008958; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mztrxplnqv.cloud/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mztrxplnqv.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008959; classtype:social-engineering; sid:6008959; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.examinei.xyz/uk/)"; flow:established,to_server; http.uri; content:"/uk/"; startswith; fast_pattern; http.host; content:"dpd.examinei.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008960; classtype:social-engineering; sid:6008960; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1665u.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1665u.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008961; classtype:social-engineering; sid:6008961; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e.vg/wSiVNxYfS)"; flow:established,to_server; http.uri; content:"/wSiVNxYfS"; startswith; fast_pattern; http.host; content:"e.vg"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008962; classtype:social-engineering; sid:6008962; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mqtrpvzlxn.cloud/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mqtrpvzlxn.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008963; classtype:social-engineering; sid:6008963; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mpxtrqzlvn.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mpxtrqzlvn.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008964; classtype:social-engineering; sid:6008964; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.plqtrmzvxn.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.plqtrmzvxn.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008965; classtype:social-engineering; sid:6008965; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.qtrvmplnzx.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.qtrvmplnzx.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008966; classtype:social-engineering; sid:6008966; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bahispedia.one/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bahispedia.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008967; classtype:social-engineering; sid:6008967; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metalrisrl.musvc3.net/e/tr?amp\;mupckp=mupAtu4m8OiX0wt&q=4=SaOSU%2526E=F%2526E=NTJ%2526F=MTFVMb%25260=9FM5J_Dthq_Od_7ros_Gg_Dthq_Niq6DB20EL4.4AF_7ros_Gg94r95Gp_Imve_Sb%25267=2LEOrT.089%25260E=UOaO%2526M2w4p8=SVUKaQULaMcHVQ%2526A=KZyYKYw6sZy9rR26pTTTG5M6HWVZs4w4r629I2PTKTxar3QcH21WtZyaHXN8NayW)"; flow:established,to_server; http.uri; content:"/e/tr?amp|3b|mupckp=mupAtu4m8OiX0wt&q=4=SaOSU%2526E=F%2526E=NTJ%2526F=MTFVMb%25260=9FM5J_Dthq_Od_7ros_Gg_Dthq_Niq6DB20EL4.4AF_7ros_Gg94r95Gp_Imve_Sb%25267=2LEOrT.089%25260E=UOaO%2526M2w4p8=SVUKaQULaMcHVQ%2526A=KZyYKYw6sZy9rR26pTTTG5M6HWVZs4w4r629I2PTKTxar3QcH21WtZyaHXN8NayW"; startswith; fast_pattern; http.host; content:"metalrisrl.musvc3.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008968; classtype:social-engineering; sid:6008968; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1i3y-kx2br-o1s-tqlec-2l5a.netlify.app/welcome_aboard/)"; flow:established,to_server; http.uri; content:"/welcome_aboard/"; startswith; fast_pattern; http.host; content:"1i3y-kx2br-o1s-tqlec-2l5a.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008969; classtype:social-engineering; sid:6008969; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqk.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingqk.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008970; classtype:social-engineering; sid:6008970; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chamlang.ekklesiadallas.info/ga/click/2-6665990-9-8698-16995-9320-990f612dbc-abbc7560e9)"; flow:established,to_server; http.uri; content:"/ga/click/2-6665990-9-8698-16995-9320-990f612dbc-abbc7560e9"; startswith; fast_pattern; http.host; content:"chamlang.ekklesiadallas.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008971; classtype:social-engineering; sid:6008971; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vlqztrmxpn.cloud/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.vlqztrmxpn.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008972; classtype:social-engineering; sid:6008972; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (boao-bet365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"boao-bet365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008973; classtype:social-engineering; sid:6008973; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-validation-service-u9.click/id-update/)"; flow:established,to_server; http.uri; content:"/id-update/"; startswith; fast_pattern; http.host; content:"account-validation-service-u9.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008974; classtype:social-engineering; sid:6008974; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wallt-up-ogin-held-cdn.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wallt-up-ogin-held-cdn.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008975; classtype:social-engineering; sid:6008975; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.qvtrmxplzn.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.qvtrmxplzn.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008976; classtype:social-engineering; sid:6008976; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cso.pusat-app.web.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cso.pusat-app.web.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008977; classtype:social-engineering; sid:6008977; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqr.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingqr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008978; classtype:social-engineering; sid:6008978; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (51154477.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"51154477.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008979; classtype:social-engineering; sid:6008979; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (preview-coinbase.com/loading-starter.php)"; flow:established,to_server; http.uri; content:"/loading-starter.php"; startswith; fast_pattern; http.host; content:"preview-coinbase.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008980; classtype:social-engineering; sid:6008980; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqu.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingqu.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008981; classtype:social-engineering; sid:6008981; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.qvtrplznmx.club/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.qvtrplznmx.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008982; classtype:social-engineering; sid:6008982; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.813335.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.813335.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008983; classtype:social-engineering; sid:6008983; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.cszfhd.buzz/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.cszfhd.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008984; classtype:social-engineering; sid:6008984; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xplmvtrznq.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xplmvtrznq.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008985; classtype:social-engineering; sid:6008985; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.padagiopagamentos.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.padagiopagamentos.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008986; classtype:social-engineering; sid:6008986; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1615444666.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1615444666.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008987; classtype:social-engineering; sid:6008987; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.qtrzvmlpxn.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.qtrzvmlpxn.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008988; classtype:social-engineering; sid:6008988; rev:1; metadata: signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cultural-delivers-375414.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cultural-delivers-375414.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008989; classtype:social-engineering; sid:6008989; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (celine.bdll843954.pro/captcha.php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"celine.bdll843954.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008990; classtype:social-engineering; sid:6008990; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chatty-selfies-379458.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"chatty-selfies-379458.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008991; classtype:social-engineering; sid:6008991; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moretrzor.wixstudio.com/start-en)"; flow:established,to_server; http.uri; content:"/start-en"; startswith; fast_pattern; http.host; content:"moretrzor.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008992; classtype:social-engineering; sid:6008992; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paactualizatubuzondecorreo1.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paactualizatubuzondecorreo1.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008993; classtype:social-engineering; sid:6008993; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (remi.bdll843954.pro/captcha.php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"remi.bdll843954.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008994; classtype:social-engineering; sid:6008994; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nextvvbrr53ffgmzzxxuyoptt9saqr.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nextvvbrr53ffgmzzxxuyoptt9saqr.framer.website"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008995; classtype:social-engineering; sid:6008995; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inexpensive-octopus-567597.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"inexpensive-octopus-567597.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008996; classtype:social-engineering; sid:6008996; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uphull-loguun0.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uphull-loguun0.godaddysites.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008997; classtype:social-engineering; sid:6008997; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (milourd.bdll843954.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"milourd.bdll843954.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008998; classtype:social-engineering; sid:6008998; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezor-suittee.wixstudio.com/suite-en)"; flow:established,to_server; http.uri; content:"/suite-en"; startswith; fast_pattern; http.host; content:"trezor-suittee.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008999; classtype:social-engineering; sid:6008999; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (38476665.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"38476665.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009000; classtype:social-engineering; sid:6009000; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (n2empresasusuario.com/acess.php?token=352066836a1a7ca313a555.71855507&cliente_352066836a1a7ca313a555.71855507)"; flow:established,to_server; http.uri; content:"/acess.php?token=352066836a1a7ca313a555.71855507&cliente_352066836a1a7ca313a555.71855507"; startswith; fast_pattern; http.host; content:"n2empresasusuario.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009001; classtype:social-engineering; sid:6009001; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bopqef.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bopqef.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009002; classtype:social-engineering; sid:6009002; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.brcpkv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.brcpkv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009003; classtype:social-engineering; sid:6009003; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1775zzzz.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1775zzzz.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009004; classtype:social-engineering; sid:6009004; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-validation-service-v5.lat/id-update)"; flow:established,to_server; http.uri; content:"/id-update"; startswith; fast_pattern; http.host; content:"account-validation-service-v5.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009005; classtype:social-engineering; sid:6009005; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fkjdxl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.fkjdxl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009006; classtype:social-engineering; sid:6009006; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (forms.aweber.com/form/11/1045191511.htm)"; flow:established,to_server; http.uri; content:"/form/11/1045191511.htm"; startswith; fast_pattern; http.host; content:"forms.aweber.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009007; classtype:social-engineering; sid:6009007; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (startedio-treze.framer.media/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"startedio-treze.framer.media"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009008; classtype:social-engineering; sid:6009008; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.sapgrj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.sapgrj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009009; classtype:social-engineering; sid:6009009; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-7d056bfeb6b04852801553620fe62c0a.r2.dev/brtw.html)"; flow:established,to_server; http.uri; content:"/brtw.html"; startswith; fast_pattern; http.host; content:"pub-7d056bfeb6b04852801553620fe62c0a.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009010; classtype:social-engineering; sid:6009010; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bwayfi.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bwayfi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009011; classtype:social-engineering; sid:6009011; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (io-starttrzor.framer.media/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"io-starttrzor.framer.media"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009012; classtype:social-engineering; sid:6009012; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (freehoroscope.ca/SF/sf_marley/sf_marley/)"; flow:established,to_server; http.uri; content:"/SF/sf_marley/sf_marley/"; startswith; fast_pattern; http.host; content:"freehoroscope.ca"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009013; classtype:social-engineering; sid:6009013; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wfqdym.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wfqdym.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009014; classtype:social-engineering; sid:6009014; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.csljnm.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.csljnm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009015; classtype:social-engineering; sid:6009015; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gltdas.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gltdas.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009016; classtype:social-engineering; sid:6009016; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tawdio.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tawdio.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009017; classtype:social-engineering; sid:6009017; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appreciative-evidence-507905.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"appreciative-evidence-507905.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009018; classtype:social-engineering; sid:6009018; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.xupqussdt.one/uqjmw)"; flow:established,to_server; http.uri; content:"/uqjmw"; startswith; fast_pattern; http.host; content:"usps.xupqussdt.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009019; classtype:social-engineering; sid:6009019; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.renewu.xyz/uk/)"; flow:established,to_server; http.uri; content:"/uk/"; startswith; fast_pattern; http.host; content:"dpd.renewu.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009020; classtype:social-engineering; sid:6009020; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wizzair.cloud/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wizzair.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009021; classtype:social-engineering; sid:6009021; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dloxhr.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dloxhr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009022; classtype:social-engineering; sid:6009022; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ydibpa.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ydibpa.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009023; classtype:social-engineering; sid:6009023; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (more-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"more-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009024; classtype:social-engineering; sid:6009024; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.cntwf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.cntwf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009025; classtype:social-engineering; sid:6009025; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwt.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwt.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009026; classtype:social-engineering; sid:6009026; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3659444.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"3659444.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009027; classtype:social-engineering; sid:6009027; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mucris.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mucris.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009028; classtype:social-engineering; sid:6009028; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vxpzdm.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vxpzdm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009029; classtype:social-engineering; sid:6009029; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (opportunity4verifiedapply.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"opportunity4verifiedapply.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009030; classtype:social-engineering; sid:6009030; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (arysportswear.com/wp-content/4Sphere_Solutions_LLC)"; flow:established,to_server; http.uri; content:"/wp-content/4Sphere_Solutions_LLC"; startswith; fast_pattern; http.host; content:"arysportswear.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009031; classtype:social-engineering; sid:6009031; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jdvwoz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jdvwoz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009032; classtype:social-engineering; sid:6009032; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bmjlun.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bmjlun.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009033; classtype:social-engineering; sid:6009033; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15886.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15886.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009034; classtype:social-engineering; sid:6009034; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.token-im.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app.token-im.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009035; classtype:social-engineering; sid:6009035; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (artesa-solvalor.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"artesa-solvalor.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009036; classtype:social-engineering; sid:6009036; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nvobcy.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nvobcy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009037; classtype:social-engineering; sid:6009037; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.uk-welcome-bet365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.uk-welcome-bet365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009038; classtype:social-engineering; sid:6009038; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tqisbw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tqisbw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009039; classtype:social-engineering; sid:6009039; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zxtyme.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zxtyme.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009040; classtype:social-engineering; sid:6009040; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.parcelforece.68-221-16-175.cpanel.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.parcelforece.68-221-16-175.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009041; classtype:social-engineering; sid:6009041; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.grnqws.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.grnqws.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009042; classtype:social-engineering; sid:6009042; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.plztrqvxmn.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.plztrqvxmn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009043; classtype:social-engineering; sid:6009043; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fedvpg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.fedvpg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009044; classtype:social-engineering; sid:6009044; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.parcelforece.68-221-16-175.cpanel.site/robot/)"; flow:established,to_server; http.uri; content:"/robot/"; startswith; fast_pattern; http.host; content:"www.parcelforece.68-221-16-175.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009045; classtype:social-engineering; sid:6009045; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-validation-service-u10.click/id-update/)"; flow:established,to_server; http.uri; content:"/id-update/"; startswith; fast_pattern; http.host; content:"account-validation-service-u10.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009046; classtype:social-engineering; sid:6009046; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15890.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15890.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009047; classtype:social-engineering; sid:6009047; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dxivuf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dxivuf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009048; classtype:social-engineering; sid:6009048; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bvnzqwp.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.bvnzqwp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009049; classtype:social-engineering; sid:6009049; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.imecgp.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.imecgp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009050; classtype:social-engineering; sid:6009050; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.xupduxeuxw.one/uqjmw)"; flow:established,to_server; http.uri; content:"/uqjmw"; startswith; fast_pattern; http.host; content:"usps.xupduxeuxw.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009051; classtype:social-engineering; sid:6009051; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bzdepk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bzdepk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009052; classtype:social-engineering; sid:6009052; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.home-zlksz6.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.home-zlksz6.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009053; classtype:social-engineering; sid:6009053; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lvipcq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lvipcq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009054; classtype:social-engineering; sid:6009054; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (khokharnidhi07-dotcom.github.io/Amazon-HomePageClone)"; flow:established,to_server; http.uri; content:"/Amazon-HomePageClone"; startswith; fast_pattern; http.host; content:"khokharnidhi07-dotcom.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009055; classtype:social-engineering; sid:6009055; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-5f9157fad7fd426bad68e1875cc4842e.r2.dev/uhtdex.html)"; flow:established,to_server; http.uri; content:"/uhtdex.html"; startswith; fast_pattern; http.host; content:"pub-5f9157fad7fd426bad68e1875cc4842e.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009056; classtype:social-engineering; sid:6009056; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dwrcey.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dwrcey.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009057; classtype:social-engineering; sid:6009057; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zndmfi.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zndmfi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009058; classtype:social-engineering; sid:6009058; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (redirect-4e2a9b81.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"redirect-4e2a9b81.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009059; classtype:social-engineering; sid:6009059; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hexbroz.com/goffym/)"; flow:established,to_server; http.uri; content:"/goffym/"; startswith; fast_pattern; http.host; content:"www.hexbroz.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009060; classtype:social-engineering; sid:6009060; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail-security-world--eduardoperez65.replit.app/?error=interaction_required&error_description=Session+information+is+not+sufficient+for+single-sign-on.&state=noriklab@b5cc34690e4775136bf175a5f6a3348de0a0.org)"; flow:established,to_server; http.uri; content:"/?error=interaction_required&error_description=Session+information+is+not+sufficient+for+single-sign-on.&state=noriklab@b5cc34690e4775136bf175a5f6a3348de0a0.org"; startswith; fast_pattern; http.host; content:"mail-security-world--eduardoperez65.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009061; classtype:social-engineering; sid:6009061; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allianz-hub.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allianz-hub.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009062; classtype:social-engineering; sid:6009062; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (neat-prototyper-466925.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"neat-prototyper-466925.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009063; classtype:social-engineering; sid:6009063; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bigfua.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bigfua.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009064; classtype:social-engineering; sid:6009064; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (altoesimples.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"altoesimples.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009065; classtype:social-engineering; sid:6009065; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mkvjlt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mkvjlt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009066; classtype:social-engineering; sid:6009066; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reim-weib-hr.github.io/turbo-telegrampoiuytrretyuiopkiouytrefghjkytdcgvhbnmoiuytr/)"; flow:established,to_server; http.uri; content:"/turbo-telegrampoiuytrretyuiopkiouytrefghjkytdcgvhbnmoiuytr/"; startswith; fast_pattern; http.host; content:"reim-weib-hr.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009067; classtype:social-engineering; sid:6009067; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hnvyjq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hnvyjq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009068; classtype:social-engineering; sid:6009068; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paigebuchholz1.ac-page.com/b-t/)"; flow:established,to_server; http.uri; content:"/b-t/"; startswith; fast_pattern; http.host; content:"paigebuchholz1.ac-page.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009069; classtype:social-engineering; sid:6009069; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.aitbzx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.aitbzx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009070; classtype:social-engineering; sid:6009070; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lxykjb.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lxykjb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009071; classtype:social-engineering; sid:6009071; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gzckue.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gzckue.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009072; classtype:social-engineering; sid:6009072; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (puteur-ezgxhv.com/9UD8exVm0Ev/)"; flow:established,to_server; http.uri; content:"/9UD8exVm0Ev/"; startswith; fast_pattern; http.host; content:"puteur-ezgxhv.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009073; classtype:social-engineering; sid:6009073; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kjgiuz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kjgiuz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009074; classtype:social-engineering; sid:6009074; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.datuws.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.datuws.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009075; classtype:social-engineering; sid:6009075; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (15857.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"15857.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009076; classtype:social-engineering; sid:6009076; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gafwrj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gafwrj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009077; classtype:social-engineering; sid:6009077; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pqtern.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pqtern.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009078; classtype:social-engineering; sid:6009078; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qzcxsp.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qzcxsp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009079; classtype:social-engineering; sid:6009079; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kmcbxy.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kmcbxy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009080; classtype:social-engineering; sid:6009080; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hxouka.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hxouka.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009081; classtype:social-engineering; sid:6009081; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hub-live-ledgrx.framer.media/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hub-live-ledgrx.framer.media"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009082; classtype:social-engineering; sid:6009082; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qijlxn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qijlxn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009083; classtype:social-engineering; sid:6009083; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (houseradio.com.ar/NickelTru/home/virtual/rosyorange/www/tls/xd/zd/clients/login.php)"; flow:established,to_server; http.uri; content:"/NickelTru/home/virtual/rosyorange/www/tls/xd/zd/clients/login.php"; startswith; fast_pattern; http.host; content:"houseradio.com.ar"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009084; classtype:social-engineering; sid:6009084; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hostingo.sviluppo.host/ss-es)"; flow:established,to_server; http.uri; content:"/ss-es"; startswith; fast_pattern; http.host; content:"hostingo.sviluppo.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009085; classtype:social-engineering; sid:6009085; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secondary-resources-166957.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secondary-resources-166957.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009086; classtype:social-engineering; sid:6009086; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j71p.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j71p.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009087; classtype:social-engineering; sid:6009087; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.micozt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.micozt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009088; classtype:social-engineering; sid:6009088; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.naybdl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.naybdl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009089; classtype:social-engineering; sid:6009089; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sucvirtualcol360-production.up.railway.app/espejo/landing.html)"; flow:established,to_server; http.uri; content:"/espejo/landing.html"; startswith; fast_pattern; http.host; content:"sucvirtualcol360-production.up.railway.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009090; classtype:social-engineering; sid:6009090; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xwejnv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xwejnv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009091; classtype:social-engineering; sid:6009091; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.eomxfn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.eomxfn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009092; classtype:social-engineering; sid:6009092; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kniysa.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kniysa.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009093; classtype:social-engineering; sid:6009093; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rafizaman577.github.io/Netflix/)"; flow:established,to_server; http.uri; content:"/Netflix/"; startswith; fast_pattern; http.host; content:"rafizaman577.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009094; classtype:social-engineering; sid:6009094; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xfvaci.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xfvaci.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009095; classtype:social-engineering; sid:6009095; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jvinrx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jvinrx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009096; classtype:social-engineering; sid:6009096; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (potencialnuextra.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"potencialnuextra.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009097; classtype:social-engineering; sid:6009097; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hsirtv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hsirtv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009098; classtype:social-engineering; sid:6009098; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hcrgnd.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hcrgnd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009099; classtype:social-engineering; sid:6009099; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vgwumc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vgwumc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009100; classtype:social-engineering; sid:6009100; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j72q.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j72q.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009101; classtype:social-engineering; sid:6009101; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (raiffeisen-sache.vip/nl)"; flow:established,to_server; http.uri; content:"/nl"; startswith; fast_pattern; http.host; content:"raiffeisen-sache.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009102; classtype:social-engineering; sid:6009102; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (umb-conect.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"umb-conect.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009103; classtype:social-engineering; sid:6009103; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gibvjc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gibvjc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009104; classtype:social-engineering; sid:6009104; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-validation-service-u19.click/id-update)"; flow:established,to_server; http.uri; content:"/id-update"; startswith; fast_pattern; http.host; content:"account-validation-service-u19.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009105; classtype:social-engineering; sid:6009105; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (r3g1str0-s3guro.gamer.gd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"r3g1str0-s3guro.gamer.gd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009106; classtype:social-engineering; sid:6009106; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hnwqmx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hnwqmx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009107; classtype:social-engineering; sid:6009107; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bqszfv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bqszfv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009108; classtype:social-engineering; sid:6009108; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wxvcai.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wxvcai.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009109; classtype:social-engineering; sid:6009109; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hdzgfv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hdzgfv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009110; classtype:social-engineering; sid:6009110; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gsoapi.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gsoapi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009111; classtype:social-engineering; sid:6009111; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.idmkeo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.idmkeo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009112; classtype:social-engineering; sid:6009112; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-51f896deb233450089fc1a520e6ed957.r2.dev/kanehods.html)"; flow:established,to_server; http.uri; content:"/kanehods.html"; startswith; fast_pattern; http.host; content:"pub-51f896deb233450089fc1a520e6ed957.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009113; classtype:social-engineering; sid:6009113; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.elbfds.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.elbfds.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009114; classtype:social-engineering; sid:6009114; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wbidfk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wbidfk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009115; classtype:social-engineering; sid:6009115; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-validation-service-u2.click/id-update/)"; flow:established,to_server; http.uri; content:"/id-update/"; startswith; fast_pattern; http.host; content:"account-validation-service-u2.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009116; classtype:social-engineering; sid:6009116; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-validation-service-u13.click/id-update/)"; flow:established,to_server; http.uri; content:"/id-update/"; startswith; fast_pattern; http.host; content:"account-validation-service-u13.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009117; classtype:social-engineering; sid:6009117; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dewvam.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dewvam.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009118; classtype:social-engineering; sid:6009118; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (louismutereeismial.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"louismutereeismial.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009119; classtype:social-engineering; sid:6009119; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lnk.ua/tSU6QVByr)"; flow:established,to_server; http.uri; content:"/tSU6QVByr"; startswith; fast_pattern; http.host; content:"lnk.ua"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009120; classtype:social-engineering; sid:6009120; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3659k.cc/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"3659k.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009121; classtype:social-engineering; sid:6009121; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-validation-service-u14.click/id-update)"; flow:established,to_server; http.uri; content:"/id-update"; startswith; fast_pattern; http.host; content:"account-validation-service-u14.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009122; classtype:social-engineering; sid:6009122; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (09913659.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"09913659.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009123; classtype:social-engineering; sid:6009123; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gktvuo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gktvuo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009124; classtype:social-engineering; sid:6009124; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.v35u.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.v35u.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009125; classtype:social-engineering; sid:6009125; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkimgh.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkimgh.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009126; classtype:social-engineering; sid:6009126; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lcfyrp.top/pay/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.lcfyrp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009127; classtype:social-engineering; sid:6009127; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (08513659.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"08513659.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009128; classtype:social-engineering; sid:6009128; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.aqdfr.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.aqdfr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009129; classtype:social-engineering; sid:6009129; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (test.chohantextile.com/.well-known/pki-validation/rf.htm)"; flow:established,to_server; http.uri; content:"/.well-known/pki-validation/rf.htm"; startswith; fast_pattern; http.host; content:"test.chohantextile.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009130; classtype:social-engineering; sid:6009130; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mnrwgh.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mnrwgh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009131; classtype:social-engineering; sid:6009131; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15892.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15892.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009132; classtype:social-engineering; sid:6009132; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-6e2bcb5421744b5d9d3d63e36d24f033.r2.dev/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-6e2bcb5421744b5d9d3d63e36d24f033.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009133; classtype:social-engineering; sid:6009133; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-validation-service-u11.click/id-update)"; flow:established,to_server; http.uri; content:"/id-update"; startswith; fast_pattern; http.host; content:"account-validation-service-u11.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009134; classtype:social-engineering; sid:6009134; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.gwtxrvl.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.gwtxrvl.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009135; classtype:social-engineering; sid:6009135; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dnxhbz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dnxhbz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009136; classtype:social-engineering; sid:6009136; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.edoctransfer.com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"s.edoctransfer.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009137; classtype:social-engineering; sid:6009137; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqb.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingqb.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009138; classtype:social-engineering; sid:6009138; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortnw.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortnw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009139; classtype:social-engineering; sid:6009139; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bmyqr.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bmyqr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009140; classtype:social-engineering; sid:6009140; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-21beea42d44e4f0e83b5336b9ac3900a.r2.dev/woosf.html)"; flow:established,to_server; http.uri; content:"/woosf.html"; startswith; fast_pattern; http.host; content:"pub-21beea42d44e4f0e83b5336b9ac3900a.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009141; classtype:social-engineering; sid:6009141; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-validation-service-v12.lat/id-update)"; flow:established,to_server; http.uri; content:"/id-update"; startswith; fast_pattern; http.host; content:"account-validation-service-v12.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009142; classtype:social-engineering; sid:6009142; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-699e84f217f5423c837b00ebdb05ca69.r2.dev/oiuytrt.html)"; flow:established,to_server; http.uri; content:"/oiuytrt.html"; startswith; fast_pattern; http.host; content:"pub-699e84f217f5423c837b00ebdb05ca69.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009143; classtype:social-engineering; sid:6009143; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (forthasl.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"forthasl.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009144; classtype:social-engineering; sid:6009144; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.skzwjp.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.skzwjp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009145; classtype:social-engineering; sid:6009145; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ptshopee-777.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ptshopee-777.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009146; classtype:social-engineering; sid:6009146; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkimgb.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkimgb.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009147; classtype:social-engineering; sid:6009147; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mogtyz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mogtyz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009148; classtype:social-engineering; sid:6009148; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (goff.alccchurch.com/login?method=signin&mode=secure&client_id=d3590ed6-52b3-4102-aeff-aad2292ab01c&privacy=on&sso_reload=true&redirect_urI=https%3A%2F%2Flogin.microsoftonline.com%2F)"; flow:established,to_server; http.uri; content:"/login?method=signin&mode=secure&client_id=d3590ed6-52b3-4102-aeff-aad2292ab01c&privacy=on&sso_reload=true&redirect_urI=https%3A%2F%2Flogin.microsoftonline.com%2F"; startswith; fast_pattern; http.host; content:"goff.alccchurch.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009149; classtype:social-engineering; sid:6009149; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dsvpjn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dsvpjn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009150; classtype:social-engineering; sid:6009150; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dmltur.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dmltur.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009151; classtype:social-engineering; sid:6009151; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fryeaq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.fryeaq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009152; classtype:social-engineering; sid:6009152; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anjinalluri1029.github.io/webpageairbnb/)"; flow:established,to_server; http.uri; content:"/webpageairbnb/"; startswith; fast_pattern; http.host; content:"anjinalluri1029.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009153; classtype:social-engineering; sid:6009153; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ybkfqh.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ybkfqh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009154; classtype:social-engineering; sid:6009154; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi887.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi887.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009155; classtype:social-engineering; sid:6009155; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.gqxwmtr.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.gqxwmtr.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009156; classtype:social-engineering; sid:6009156; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.cpkhjs.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.cpkhjs.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009157; classtype:social-engineering; sid:6009157; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tzupox.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tzupox.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009158; classtype:social-engineering; sid:6009158; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rqitjb.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rqitjb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009159; classtype:social-engineering; sid:6009159; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vlah-fguk-4flf.tradigan-realeflow-cam-s-account.workers.dev/7236dcca8af43b95?email=a)"; flow:established,to_server; http.uri; content:"/7236dcca8af43b95?email=a"; startswith; fast_pattern; http.host; content:"vlah-fguk-4flf.tradigan-realeflow-cam-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009160; classtype:social-engineering; sid:6009160; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1775hhhhh.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1775hhhhh.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009161; classtype:social-engineering; sid:6009161; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fzvejy.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.fzvejy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009162; classtype:social-engineering; sid:6009162; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t67x.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"t67x.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009163; classtype:social-engineering; sid:6009163; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zrqcfu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zrqcfu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009164; classtype:social-engineering; sid:6009164; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.7seaz-global.com/swsscom/Login.php?ca2a19b026ce773a6a60784c69830af3)"; flow:established,to_server; http.uri; content:"/swsscom/Login.php?ca2a19b026ce773a6a60784c69830af3"; startswith; fast_pattern; http.host; content:"www.7seaz-global.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009165; classtype:social-engineering; sid:6009165; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kitlogin.casa/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kitlogin.casa"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009166; classtype:social-engineering; sid:6009166; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1615999000.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1615999000.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009167; classtype:social-engineering; sid:6009167; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wjatfs.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wjatfs.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009168; classtype:social-engineering; sid:6009168; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-validation-service-u20.click/id-update)"; flow:established,to_server; http.uri; content:"/id-update"; startswith; fast_pattern; http.host; content:"account-validation-service-u20.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009169; classtype:social-engineering; sid:6009169; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-e1e4d0b4665d4d8996bf04516d898fb2.r2.dev/ddhjkindex.html)"; flow:established,to_server; http.uri; content:"/ddhjkindex.html"; startswith; fast_pattern; http.host; content:"pub-e1e4d0b4665d4d8996bf04516d898fb2.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009170; classtype:social-engineering; sid:6009170; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.krwyln.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.krwyln.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009171; classtype:social-engineering; sid:6009171; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jfzbac.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jfzbac.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009172; classtype:social-engineering; sid:6009172; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15651188.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15651188.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009173; classtype:social-engineering; sid:6009173; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tighzu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tighzu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009174; classtype:social-engineering; sid:6009174; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (feng-media.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"feng-media.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009175; classtype:social-engineering; sid:6009175; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bsuwro.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bsuwro.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009176; classtype:social-engineering; sid:6009176; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-validation-service-u6.click/id-update)"; flow:established,to_server; http.uri; content:"/id-update"; startswith; fast_pattern; http.host; content:"account-validation-service-u6.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009177; classtype:social-engineering; sid:6009177; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gfdjnh.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gfdjnh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009178; classtype:social-engineering; sid:6009178; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (melhorsempreseraconosco.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"melhorsempreseraconosco.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009179; classtype:social-engineering; sid:6009179; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.imadxr.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.imadxr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009180; classtype:social-engineering; sid:6009180; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (supp0rt.ca/?r=1ccce708-9a64-4bb6-b08b-6e62f57a0dda&rg=eu)"; flow:established,to_server; http.uri; content:"/?r=1ccce708-9a64-4bb6-b08b-6e62f57a0dda&rg=eu"; startswith; fast_pattern; http.host; content:"supp0rt.ca"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009181; classtype:social-engineering; sid:6009181; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.deliveryfailedl.xyz/uk/)"; flow:established,to_server; http.uri; content:"/uk/"; startswith; fast_pattern; http.host; content:"dpd.deliveryfailedl.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009182; classtype:social-engineering; sid:6009182; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jagbht.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jagbht.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009183; classtype:social-engineering; sid:6009183; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.avcmfj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.avcmfj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009184; classtype:social-engineering; sid:6009184; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blockkfe-logi.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"blockkfe-logi.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009185; classtype:social-engineering; sid:6009185; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dhruvi-patel15.github.io/clone-webpage/)"; flow:established,to_server; http.uri; content:"/clone-webpage/"; startswith; fast_pattern; http.host; content:"dhruvi-patel15.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009186; classtype:social-engineering; sid:6009186; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xyrjqo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xyrjqo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009187; classtype:social-engineering; sid:6009187; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.airbnb-clone-pavelpyanov.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.airbnb-clone-pavelpyanov.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009188; classtype:social-engineering; sid:6009188; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.acuifg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.acuifg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009189; classtype:social-engineering; sid:6009189; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.arecqv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.arecqv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009190; classtype:social-engineering; sid:6009190; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zb44.net/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"zb44.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009191; classtype:social-engineering; sid:6009191; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qyfkpu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qyfkpu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009192; classtype:social-engineering; sid:6009192; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (09313659.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"09313659.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009193; classtype:social-engineering; sid:6009193; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamask.login.auth.accountdetails.kitlogin.casa/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metamask.login.auth.accountdetails.kitlogin.casa"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009194; classtype:social-engineering; sid:6009194; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-validation-service-u17.click/id-update)"; flow:established,to_server; http.uri; content:"/id-update"; startswith; fast_pattern; http.host; content:"account-validation-service-u17.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009195; classtype:social-engineering; sid:6009195; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mypost.xsmbja.click/au/kzmc/)"; flow:established,to_server; http.uri; content:"/au/kzmc/"; startswith; fast_pattern; http.host; content:"mypost.xsmbja.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009196; classtype:social-engineering; sid:6009196; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ugqcjb.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ugqcjb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009197; classtype:social-engineering; sid:6009197; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ycsfwq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ycsfwq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009198; classtype:social-engineering; sid:6009198; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkimgg.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkimgg.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009199; classtype:social-engineering; sid:6009199; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365bet511.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"365bet511.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009200; classtype:social-engineering; sid:6009200; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (asianvalves.net/form)"; flow:established,to_server; http.uri; content:"/form"; startswith; fast_pattern; http.host; content:"asianvalves.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009201; classtype:social-engineering; sid:6009201; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bdoou.cc/ph/)"; flow:established,to_server; http.uri; content:"/ph/"; startswith; fast_pattern; http.host; content:"bdoou.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009202; classtype:social-engineering; sid:6009202; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.najwh.com/SHope13/)"; flow:established,to_server; http.uri; content:"/SHope13/"; startswith; fast_pattern; http.host; content:"s.najwh.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009203; classtype:social-engineering; sid:6009203; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail-rajasthan-gov-in.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mail-rajasthan-gov-in.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009204; classtype:social-engineering; sid:6009204; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lexiaochengcoding.com/dsafaDSAwds/)"; flow:established,to_server; http.uri; content:"/dsafaDSAwds/"; startswith; fast_pattern; http.host; content:"lexiaochengcoding.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009205; classtype:social-engineering; sid:6009205; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pt-shopee239.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pt-shopee239.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009206; classtype:social-engineering; sid:6009206; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rybcfq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rybcfq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009207; classtype:social-engineering; sid:6009207; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pfoubj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pfoubj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009208; classtype:social-engineering; sid:6009208; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pevkox.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pevkox.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009209; classtype:social-engineering; sid:6009209; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (umb-onilne.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"umb-onilne.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009210; classtype:social-engineering; sid:6009210; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.sqiton.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.sqiton.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009211; classtype:social-engineering; sid:6009211; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mzrguw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mzrguw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009212; classtype:social-engineering; sid:6009212; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.alojdy.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.alojdy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009213; classtype:social-engineering; sid:6009213; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nmajlp.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nmajlp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009214; classtype:social-engineering; sid:6009214; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.utejzp.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.utejzp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009215; classtype:social-engineering; sid:6009215; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nyokgw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nyokgw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009216; classtype:social-engineering; sid:6009216; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kanzleivonwietersheim.de/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kanzleivonwietersheim.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009217; classtype:social-engineering; sid:6009217; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rejuvenated-communication-751142.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rejuvenated-communication-751142.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009218; classtype:social-engineering; sid:6009218; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16151188.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16151188.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009219; classtype:social-engineering; sid:6009219; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.testing-67.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.testing-67.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009220; classtype:social-engineering; sid:6009220; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.igbvcz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.igbvcz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009221; classtype:social-engineering; sid:6009221; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nipdrw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nipdrw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009222; classtype:social-engineering; sid:6009222; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rntfdz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rntfdz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009223; classtype:social-engineering; sid:6009223; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wabycn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wabycn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009224; classtype:social-engineering; sid:6009224; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kadgqc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kadgqc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009225; classtype:social-engineering; sid:6009225; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www-umb.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www-umb.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009226; classtype:social-engineering; sid:6009226; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-11e6504d5d9a40ff97bcd3d5ee476ec8.r2.dev/wqerdhk.html)"; flow:established,to_server; http.uri; content:"/wqerdhk.html"; startswith; fast_pattern; http.host; content:"pub-11e6504d5d9a40ff97bcd3d5ee476ec8.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009227; classtype:social-engineering; sid:6009227; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qyfkpu.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.qyfkpu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009228; classtype:social-engineering; sid:6009228; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pusjbr.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pusjbr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009229; classtype:social-engineering; sid:6009229; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.s22m.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.s22m.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009230; classtype:social-engineering; sid:6009230; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (03513659.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"03513659.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009231; classtype:social-engineering; sid:6009231; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.thcask.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.thcask.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009232; classtype:social-engineering; sid:6009232; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fkwgsr.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.fkwgsr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009233; classtype:social-engineering; sid:6009233; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jmsfue.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jmsfue.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009234; classtype:social-engineering; sid:6009234; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instgrmverifications.github.io/poderio/)"; flow:established,to_server; http.uri; content:"/poderio/"; startswith; fast_pattern; http.host; content:"instgrmverifications.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009235; classtype:social-engineering; sid:6009235; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tdwnom.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tdwnom.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009236; classtype:social-engineering; sid:6009236; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nykelv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nykelv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009237; classtype:social-engineering; sid:6009237; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (airbnb-clone-pavelpyanov.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"airbnb-clone-pavelpyanov.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009238; classtype:social-engineering; sid:6009238; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bvxptrq.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.bvxptrq.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009239; classtype:social-engineering; sid:6009239; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pdoluz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pdoluz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009240; classtype:social-engineering; sid:6009240; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0213659.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"0213659.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009241; classtype:social-engineering; sid:6009241; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qavefl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qavefl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009242; classtype:social-engineering; sid:6009242; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.0112576.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.0112576.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009243; classtype:social-engineering; sid:6009243; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (famous-career-556834.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"famous-career-556834.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009244; classtype:social-engineering; sid:6009244; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-validation-service-u7.click/id-update)"; flow:established,to_server; http.uri; content:"/id-update"; startswith; fast_pattern; http.host; content:"account-validation-service-u7.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009245; classtype:social-engineering; sid:6009245; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kind-overlay-410833.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kind-overlay-410833.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009246; classtype:social-engineering; sid:6009246; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-validation-service-u5.click/id-update/)"; flow:established,to_server; http.uri; content:"/id-update/"; startswith; fast_pattern; http.host; content:"account-validation-service-u5.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009247; classtype:social-engineering; sid:6009247; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ykatwp.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ykatwp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009248; classtype:social-engineering; sid:6009248; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sucvirtualcol360-production.up.railway.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sucvirtualcol360-production.up.railway.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009249; classtype:social-engineering; sid:6009249; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ktuqvl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ktuqvl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009250; classtype:social-engineering; sid:6009250; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.cpozdi.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.cpozdi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009251; classtype:social-engineering; sid:6009251; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgeerlog.framer.media/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledgeerlog.framer.media"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009252; classtype:social-engineering; sid:6009252; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (truea1jdbhjbdjhbsfhjebfdfd-fxdpfvb0exhdguav.z03.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"truea1jdbhjbdjhbsfhjebfdfd-fxdpfvb0exhdguav.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009253; classtype:social-engineering; sid:6009253; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wdlniu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wdlniu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009254; classtype:social-engineering; sid:6009254; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.axpzl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.axpzl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009255; classtype:social-engineering; sid:6009255; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dsk001001010101010010101.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dsk001001010101010010101.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009256; classtype:social-engineering; sid:6009256; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.fqplqwr.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.fqplqwr.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009257; classtype:social-engineering; sid:6009257; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ebkocj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ebkocj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009258; classtype:social-engineering; sid:6009258; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tcaconnect.ac-page.com/toronto-construction-association-inc/)"; flow:established,to_server; http.uri; content:"/toronto-construction-association-inc/"; startswith; fast_pattern; http.host; content:"tcaconnect.ac-page.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009259; classtype:social-engineering; sid:6009259; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-2801359d2be54bfd8701132626efeb73.r2.dev/owoed.html)"; flow:established,to_server; http.uri; content:"/owoed.html"; startswith; fast_pattern; http.host; content:"pub-2801359d2be54bfd8701132626efeb73.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009260; classtype:social-engineering; sid:6009260; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-873fc6a3edb941c6a17f50911dfca518.r2.dev/dbm.html)"; flow:established,to_server; http.uri; content:"/dbm.html"; startswith; fast_pattern; http.host; content:"pub-873fc6a3edb941c6a17f50911dfca518.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009261; classtype:social-engineering; sid:6009261; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xlayaanid-paylternewz.tiaoxsid.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xlayaanid-paylternewz.tiaoxsid.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009262; classtype:social-engineering; sid:6009262; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqx.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingqx.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009263; classtype:social-engineering; sid:6009263; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ptshopee-777.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ptshopee-777.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009264; classtype:social-engineering; sid:6009264; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.cghqmr.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.cghqmr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009265; classtype:social-engineering; sid:6009265; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16150055.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16150055.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009266; classtype:social-engineering; sid:6009266; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robloxrobuxnow.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"robloxrobuxnow.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009267; classtype:social-engineering; sid:6009267; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.msjbuo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.msjbuo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009268; classtype:social-engineering; sid:6009268; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-db4d563e83a84e1ca7043c92ba3a1be2.r2.dev/bindex1.html)"; flow:established,to_server; http.uri; content:"/bindex1.html"; startswith; fast_pattern; http.host; content:"pub-db4d563e83a84e1ca7043c92ba3a1be2.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009269; classtype:social-engineering; sid:6009269; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (97ee8.catex.at:443/cnbcard/)"; flow:established,to_server; http.uri; content:"/cnbcard/"; startswith; fast_pattern; http.host; content:"97ee8.catex.at:443"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009270; classtype:social-engineering; sid:6009270; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lgmrwq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lgmrwq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009271; classtype:social-engineering; sid:6009271; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dsk001001010101010010101.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.dsk001001010101010010101.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009272; classtype:social-engineering; sid:6009272; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hfylvt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hfylvt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009273; classtype:social-engineering; sid:6009273; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.blockkfe-logi.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.blockkfe-logi.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009274; classtype:social-engineering; sid:6009274; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.oxsiny.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.oxsiny.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009275; classtype:social-engineering; sid:6009275; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.xupqbkkdj.one/uqjmw)"; flow:established,to_server; http.uri; content:"/uqjmw"; startswith; fast_pattern; http.host; content:"usps.xupqbkkdj.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009276; classtype:social-engineering; sid:6009276; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.esvpir.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.esvpir.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009277; classtype:social-engineering; sid:6009277; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (marketingcrew.co.uk/?r=1a34681e-5522-4b29-94b2-8117efd872ff&rg=eu)"; flow:established,to_server; http.uri; content:"/?r=1a34681e-5522-4b29-94b2-8117efd872ff&rg=eu"; startswith; fast_pattern; http.host; content:"marketingcrew.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009278; classtype:social-engineering; sid:6009278; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (danaa-iindonesiaa.utt.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"danaa-iindonesiaa.utt.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009279; classtype:social-engineering; sid:6009279; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (startd-nowlive.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"startd-nowlive.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009280; classtype:social-engineering; sid:6009280; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (us-live-desktop.wixstudio.com/en-desktop)"; flow:established,to_server; http.uri; content:"/en-desktop"; startswith; fast_pattern; http.host; content:"us-live-desktop.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009281; classtype:social-engineering; sid:6009281; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (livepage-ldgren.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"livepage-ldgren.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009282; classtype:social-engineering; sid:6009282; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (naciona1simplisdansm.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"naciona1simplisdansm.netlify.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009283; classtype:social-engineering; sid:6009283; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (heet.pl/lol/)"; flow:established,to_server; http.uri; content:"/lol/"; startswith; fast_pattern; http.host; content:"heet.pl"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009284; classtype:social-engineering; sid:6009284; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ioapps-starts-trezon.wixstudio.com/en-start)"; flow:established,to_server; http.uri; content:"/en-start"; startswith; fast_pattern; http.host; content:"ioapps-starts-trezon.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009285; classtype:social-engineering; sid:6009285; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sum-app.co/de-de/web/login.php)"; flow:established,to_server; http.uri; content:"/de-de/web/login.php"; startswith; fast_pattern; http.host; content:"sum-app.co"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009286; classtype:social-engineering; sid:6009286; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (empresasusuarion2.com/acess.php?token=1350132036a1aea56f0e855.34318131&cliente_1350132036a1aea56f0e855.34318131)"; flow:established,to_server; http.uri; content:"/acess.php?token=1350132036a1aea56f0e855.34318131&cliente_1350132036a1aea56f0e855.34318131"; startswith; fast_pattern; http.host; content:"empresasusuarion2.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009287; classtype:social-engineering; sid:6009287; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (startbridges-com.wixstudio.com/bridge-en-us)"; flow:established,to_server; http.uri; content:"/bridge-en-us"; startswith; fast_pattern; http.host; content:"startbridges-com.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009288; classtype:social-engineering; sid:6009288; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meteora-eng.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"meteora-eng.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009289; classtype:social-engineering; sid:6009289; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deutschlands-kreditdeutsheinternational.91-218-65-223.plesk.page/intel/)"; flow:established,to_server; http.uri; content:"/intel/"; startswith; fast_pattern; http.host; content:"deutschlands-kreditdeutsheinternational.91-218-65-223.plesk.page"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009290; classtype:social-engineering; sid:6009290; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwwpc28cc.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wwwpc28cc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009291; classtype:social-engineering; sid:6009291; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.cnpzrvk.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.cnpzrvk.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009292; classtype:social-engineering; sid:6009292; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uniswap-azure.vercel.app/trade)"; flow:established,to_server; http.uri; content:"/trade"; startswith; fast_pattern; http.host; content:"uniswap-azure.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009293; classtype:social-engineering; sid:6009293; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (checkmyfort.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"checkmyfort.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009294; classtype:social-engineering; sid:6009294; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.hvqplzn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.hvqplzn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009295; classtype:social-engineering; sid:6009295; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gray.green/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.gray.green"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009296; classtype:social-engineering; sid:6009296; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (casinogiris.one/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"casinogiris.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009297; classtype:social-engineering; sid:6009297; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bbin.cn.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bbin.cn.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009298; classtype:social-engineering; sid:6009298; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee7369.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopee7369.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009299; classtype:social-engineering; sid:6009299; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dropylist.com/.ieg/)"; flow:established,to_server; http.uri; content:"/.ieg/"; startswith; fast_pattern; http.host; content:"dropylist.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009300; classtype:social-engineering; sid:6009300; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortnitelocker.world/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortnitelocker.world"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009301; classtype:social-engineering; sid:6009301; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xqtrvzmpln.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xqtrvzmpln.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009302; classtype:social-engineering; sid:6009302; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tyc5997.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tyc5997.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009303; classtype:social-engineering; sid:6009303; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (disponibilizamosumnovolmt.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"disponibilizamosumnovolmt.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009304; classtype:social-engineering; sid:6009304; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (16152255.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"16152255.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009305; classtype:social-engineering; sid:6009305; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pixeltannu.github.io/netflix.clone/)"; flow:established,to_server; http.uri; content:"/netflix.clone/"; startswith; fast_pattern; http.host; content:"pixeltannu.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009306; classtype:social-engineering; sid:6009306; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.dpdccau.cfd/co.uk)"; flow:established,to_server; http.uri; content:"/co.uk"; startswith; fast_pattern; http.host; content:"dpd.dpdccau.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009307; classtype:social-engineering; sid:6009307; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1665o.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1665o.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009308; classtype:social-engineering; sid:6009308; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.easy4freeget.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.easy4freeget.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009309; classtype:social-engineering; sid:6009309; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-clone-project-zeta.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-project-zeta.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009310; classtype:social-engineering; sid:6009310; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (id593.agency-digital-engine.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"id593.agency-digital-engine.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009311; classtype:social-engineering; sid:6009311; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tvplrmzxqn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tvplrmzxqn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009312; classtype:social-engineering; sid:6009312; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.fqwrpln.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.fqwrpln.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009313; classtype:social-engineering; sid:6009313; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (azrewithtoni.info/48-1466-160526/?u=83C1466&e=zenik9@5854f688fc46eb64ed9ab82f0eab0c6569b4.com&s3=&s4=&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/48-1466-160526/?u=83C1466&e=zenik9@5854f688fc46eb64ed9ab82f0eab0c6569b4.com&s3=&s4=&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"azrewithtoni.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009314; classtype:social-engineering; sid:6009314; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (16152288.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"16152288.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009315; classtype:social-engineering; sid:6009315; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xqtrmzvpln.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xqtrmzvpln.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009316; classtype:social-engineering; sid:6009316; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wcuiqa.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.wcuiqa.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009317; classtype:social-engineering; sid:6009317; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (conavi.top/#/phone)"; flow:established,to_server; http.uri; content:"/#/phone"; startswith; fast_pattern; http.host; content:"conavi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009318; classtype:social-engineering; sid:6009318; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1775mmmm.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1775mmmm.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009319; classtype:social-engineering; sid:6009319; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xplmvqztrn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xplmvqztrn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009320; classtype:social-engineering; sid:6009320; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.opportunity4verifiedapply.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.opportunity4verifiedapply.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009321; classtype:social-engineering; sid:6009321; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ivrwbg.com/Korea.html)"; flow:established,to_server; http.uri; content:"/Korea.html"; startswith; fast_pattern; http.host; content:"www.ivrwbg.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009322; classtype:social-engineering; sid:6009322; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.asjghxv.asgjxvzv.bordercottages.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.asjghxv.asgjxvzv.bordercottages.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009323; classtype:social-engineering; sid:6009323; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yh7163.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yh7163.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009324; classtype:social-engineering; sid:6009324; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.coinbase_1_login.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.coinbase_1_login.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009325; classtype:social-engineering; sid:6009325; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (08913659.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"08913659.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009326; classtype:social-engineering; sid:6009326; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tvxqplmrzn.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tvxqplmrzn.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009327; classtype:social-engineering; sid:6009327; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s23j.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"s23j.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009328; classtype:social-engineering; sid:6009328; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15058822.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15058822.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009329; classtype:social-engineering; sid:6009329; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inforesmi555.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"inforesmi555.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009330; classtype:social-engineering; sid:6009330; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bet365asia38.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bet365asia38.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009331; classtype:social-engineering; sid:6009331; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tmxvqpk.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tmxvqpk.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009332; classtype:social-engineering; sid:6009332; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (golplay365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"golplay365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009333; classtype:social-engineering; sid:6009333; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bbin.cn.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bbin.cn.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009334; classtype:social-engineering; sid:6009334; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi774.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"info-resmi774.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009335; classtype:social-engineering; sid:6009335; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xvnrqzlmpt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xvnrqzlmpt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009336; classtype:social-engineering; sid:6009336; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (463122-gmail.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"463122-gmail.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009337; classtype:social-engineering; sid:6009337; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sun138.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sun138.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009338; classtype:social-engineering; sid:6009338; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.deliveryfailedj.xyz/uk)"; flow:established,to_server; http.uri; content:"/uk"; startswith; fast_pattern; http.host; content:"dpd.deliveryfailedj.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009339; classtype:social-engineering; sid:6009339; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xplmztqvrn.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xplmztqvrn.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009340; classtype:social-engineering; sid:6009340; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xvnrqlmzpt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xvnrqlmzpt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009341; classtype:social-engineering; sid:6009341; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ver1ficar369.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ver1ficar369.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009342; classtype:social-engineering; sid:6009342; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xvnplrqtmz.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xvnplrqtmz.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009343; classtype:social-engineering; sid:6009343; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vnrdxap.web.app/?dt=156&qr=PICS)"; flow:established,to_server; http.uri; content:"/?dt=156&qr=PICS"; startswith; fast_pattern; http.host; content:"vnrdxap.web.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009344; classtype:social-engineering; sid:6009344; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.plwtnqz.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.plwtnqz.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009345; classtype:social-engineering; sid:6009345; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.qtrxpmvlzn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.qtrxpmvlzn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009346; classtype:social-engineering; sid:6009346; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robotiont.lol/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"robotiont.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009347; classtype:social-engineering; sid:6009347; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mztrxplvqn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mztrxplvqn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009348; classtype:social-engineering; sid:6009348; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.with-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.with-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009349; classtype:social-engineering; sid:6009349; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi219.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"info-resmi219.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009350; classtype:social-engineering; sid:6009350; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wcuiqa.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wcuiqa.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009351; classtype:social-engineering; sid:6009351; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (podo-orthesiologie.at/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"podo-orthesiologie.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009352; classtype:social-engineering; sid:6009352; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.znxqtrmvpl.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.znxqtrmvpl.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009353; classtype:social-engineering; sid:6009353; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mzqrvtplxn.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mzqrvtplxn.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009354; classtype:social-engineering; sid:6009354; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tyc138.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.tyc138.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009355; classtype:social-engineering; sid:6009355; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.195nnnn195.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.195nnnn195.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009356; classtype:social-engineering; sid:6009356; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paie-lebon.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paie-lebon.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009357; classtype:social-engineering; sid:6009357; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xplvtrqmzn.icu/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xplvtrqmzn.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009358; classtype:social-engineering; sid:6009358; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mxqtrpv.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mxqtrpv.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009359; classtype:social-engineering; sid:6009359; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwwyahu.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wwwyahu.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009360; classtype:social-engineering; sid:6009360; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.plqtrzvnmx.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.plqtrzvnmx.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009361; classtype:social-engineering; sid:6009361; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rohit02309.github.io/amadon-website/)"; flow:established,to_server; http.uri; content:"/amadon-website/"; startswith; fast_pattern; http.host; content:"rohit02309.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009362; classtype:social-engineering; sid:6009362; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (antai-amendes-gouv2026.justns.ru/amnd/)"; flow:established,to_server; http.uri; content:"/amnd/"; startswith; fast_pattern; http.host; content:"antai-amendes-gouv2026.justns.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009363; classtype:social-engineering; sid:6009363; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.hvpzqlt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.hvpzqlt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009364; classtype:social-engineering; sid:6009364; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jwtxqrl.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jwtxqrl.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009365; classtype:social-engineering; sid:6009365; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vrmzxtqlpn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.vrmzxtqlpn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009366; classtype:social-engineering; sid:6009366; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiemq3unlavdpaukq5tmpshnass4cuyqrq3cu2af7ibtf7tuzxz4li.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiemq3unlavdpaukq5tmpshnass4cuyqrq3cu2af7ibtf7tuzxz4li.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009367; classtype:social-engineering; sid:6009367; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (costumerns-paylteridnz.arsenion.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"costumerns-paylteridnz.arsenion.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009368; classtype:social-engineering; sid:6009368; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (16150088.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"16150088.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009369; classtype:social-engineering; sid:6009369; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.boyizhenren.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.boyizhenren.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009370; classtype:social-engineering; sid:6009370; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.qtrmvplxzn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.qtrmvplxzn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009371; classtype:social-engineering; sid:6009371; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vrmzqpxltn.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.vrmzqpxltn.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009372; classtype:social-engineering; sid:6009372; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bet99988.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bet99988.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009373; classtype:social-engineering; sid:6009373; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.dpdccas.cfd/co.uk/)"; flow:established,to_server; http.uri; content:"/co.uk/"; startswith; fast_pattern; http.host; content:"dpd.dpdccas.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009374; classtype:social-engineering; sid:6009374; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.dpdccay.cfd/co.uk/)"; flow:established,to_server; http.uri; content:"/co.uk/"; startswith; fast_pattern; http.host; content:"dpd.dpdccay.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009375; classtype:social-engineering; sid:6009375; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.spgdcj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.spgdcj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009376; classtype:social-engineering; sid:6009376; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aryanilag65.github.io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"aryanilag65.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009377; classtype:social-engineering; sid:6009377; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.dpdccap.cfd/co.uk/)"; flow:established,to_server; http.uri; content:"/co.uk/"; startswith; fast_pattern; http.host; content:"dpd.dpdccap.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009378; classtype:social-engineering; sid:6009378; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1775uuu.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1775uuu.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009379; classtype:social-engineering; sid:6009379; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.supersteaym.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.supersteaym.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009380; classtype:social-engineering; sid:6009380; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tplxrmvqzn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tplxrmvqzn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009381; classtype:social-engineering; sid:6009381; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwwbbin.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wwwbbin.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009382; classtype:social-engineering; sid:6009382; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (busines-manager.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"busines-manager.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009383; classtype:social-engineering; sid:6009383; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jxqtrmv.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jxqtrmv.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009384; classtype:social-engineering; sid:6009384; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.powerofsteam.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.powerofsteam.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009385; classtype:social-engineering; sid:6009385; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faduan.wasmer.app/apolloglobal)"; flow:established,to_server; http.uri; content:"/apolloglobal"; startswith; fast_pattern; http.host; content:"faduan.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009386; classtype:social-engineering; sid:6009386; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (463122-coinbase.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"463122-coinbase.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009387; classtype:social-engineering; sid:6009387; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.dpdccab.cfd/co.uk/)"; flow:established,to_server; http.uri; content:"/co.uk/"; startswith; fast_pattern; http.host; content:"dpd.dpdccab.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009388; classtype:social-engineering; sid:6009388; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (asjghxv.asgjxvzv.bordercottages.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"asjghxv.asgjxvzv.bordercottages.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009389; classtype:social-engineering; sid:6009389; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblozn.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"roblozn.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009390; classtype:social-engineering; sid:6009390; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi366.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"info-resmi366.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009391; classtype:social-engineering; sid:6009391; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.plqztrxmnv.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.plqztrxmnv.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009392; classtype:social-engineering; sid:6009392; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qxw3344555.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qxw3344555.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009393; classtype:social-engineering; sid:6009393; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (midas-top-up-events.cc.cd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"midas-top-up-events.cc.cd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009394; classtype:social-engineering; sid:6009394; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www3344666.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www3344666.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009395; classtype:social-engineering; sid:6009395; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi846.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"info-resmi846.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009396; classtype:social-engineering; sid:6009396; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tplxrmnqvz.ink/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tplxrmnqvz.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009397; classtype:social-engineering; sid:6009397; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (matamaskcriptologgin.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"matamaskcriptologgin.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009398; classtype:social-engineering; sid:6009398; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1505bbb.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1505bbb.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009399; classtype:social-engineering; sid:6009399; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.hkxrmqv.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.hkxrmqv.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009400; classtype:social-engineering; sid:6009400; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15863.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15863.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009401; classtype:social-engineering; sid:6009401; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hamamciprof239139.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hamamciprof239139.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009402; classtype:social-engineering; sid:6009402; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (manab-haldar.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"manab-haldar.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009403; classtype:social-engineering; sid:6009403; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bzpnrwl.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.bzpnrwl.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009404; classtype:social-engineering; sid:6009404; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tudomaissobreseulmt.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"tudomaissobreseulmt.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009405; classtype:social-engineering; sid:6009405; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tnlpvkq.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tnlpvkq.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009406; classtype:social-engineering; sid:6009406; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tvplxzmrqn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tvplxzmrqn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009407; classtype:social-engineering; sid:6009407; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tmzvxqp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tmzvxqp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009408; classtype:social-engineering; sid:6009408; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zrkj-8593.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zrkj-8593.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009409; classtype:social-engineering; sid:6009409; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.gwmvxtr.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.gwmvxtr.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009410; classtype:social-engineering; sid:6009410; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xmvplzrqtn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xmvplzrqtn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009411; classtype:social-engineering; sid:6009411; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.microsoft365office.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.microsoft365office.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009412; classtype:social-engineering; sid:6009412; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1615555555.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1615555555.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009413; classtype:social-engineering; sid:6009413; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (microsave6.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"microsave6.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009414; classtype:social-engineering; sid:6009414; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1665i.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1665i.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009415; classtype:social-engineering; sid:6009415; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mqztrxvpln.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mqztrxvpln.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009416; classtype:social-engineering; sid:6009416; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ccddgg.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ccddgg.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009417; classtype:social-engineering; sid:6009417; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (15852.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"15852.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009418; classtype:social-engineering; sid:6009418; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1665r.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1665r.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009419; classtype:social-engineering; sid:6009419; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stuartsweitzman.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"stuartsweitzman.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009420; classtype:social-engineering; sid:6009420; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (talktalknotificationupdate1.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"talktalknotificationupdate1.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009421; classtype:social-engineering; sid:6009421; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mqtrplxznv.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mqtrplxznv.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009422; classtype:social-engineering; sid:6009422; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uniswap-azure.vercel.app/services)"; flow:established,to_server; http.uri; content:"/services"; startswith; fast_pattern; http.host; content:"uniswap-azure.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009423; classtype:social-engineering; sid:6009423; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.hjtrqvp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.hjtrqvp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009424; classtype:social-engineering; sid:6009424; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.dpdccak.cfd/co.uk)"; flow:established,to_server; http.uri; content:"/co.uk"; startswith; fast_pattern; http.host; content:"dpd.dpdccak.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009425; classtype:social-engineering; sid:6009425; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mvztrqplxn.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mvztrqplxn.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009426; classtype:social-engineering; sid:6009426; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.dpdccau.cfd/co.uk/)"; flow:established,to_server; http.uri; content:"/co.uk/"; startswith; fast_pattern; http.host; content:"dpd.dpdccau.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009427; classtype:social-engineering; sid:6009427; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xqtrmvlpzn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xqtrmvlpzn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009428; classtype:social-engineering; sid:6009428; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.deliveryfailedu.xyz/uk)"; flow:established,to_server; http.uri; content:"/uk"; startswith; fast_pattern; http.host; content:"dpd.deliveryfailedu.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009429; classtype:social-engineering; sid:6009429; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.195t195.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.195t195.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009430; classtype:social-engineering; sid:6009430; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yhgw.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yhgw.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009431; classtype:social-engineering; sid:6009431; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (matamaskccryptologin.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"matamaskccryptologin.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009432; classtype:social-engineering; sid:6009432; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bzlwnqt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.bzlwnqt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009433; classtype:social-engineering; sid:6009433; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreid6mvfnlqssdkyrsautoxgvfl36omf2lwygnmpq6fwynxqjydxbau.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreid6mvfnlqssdkyrsautoxgvfl36omf2lwygnmpq6fwynxqjydxbau.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009434; classtype:social-engineering; sid:6009434; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chasebank.fun/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"chasebank.fun"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009435; classtype:social-engineering; sid:6009435; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bvxtrpq.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.bvxtrpq.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009436; classtype:social-engineering; sid:6009436; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anjali-os.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"anjali-os.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009437; classtype:social-engineering; sid:6009437; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16150066.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16150066.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009438; classtype:social-engineering; sid:6009438; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cfd.worksinc.app/verif.php)"; flow:established,to_server; http.uri; content:"/verif.php"; startswith; fast_pattern; http.host; content:"cfd.worksinc.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009439; classtype:social-engineering; sid:6009439; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uniswap-azure.vercel.app/portfolio)"; flow:established,to_server; http.uri; content:"/portfolio"; startswith; fast_pattern; http.host; content:"uniswap-azure.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009440; classtype:social-engineering; sid:6009440; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cfd.worksinc.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cfd.worksinc.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009441; classtype:social-engineering; sid:6009441; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (akshayckht.github.io/amazon_clone/)"; flow:established,to_server; http.uri; content:"/amazon_clone/"; startswith; fast_pattern; http.host; content:"akshayckht.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009442; classtype:social-engineering; sid:6009442; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sportsf2.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sportsf2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009443; classtype:social-engineering; sid:6009443; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (supremcodmain.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"supremcodmain.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009444; classtype:social-engineering; sid:6009444; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (195vvv195.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"195vvv195.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009445; classtype:social-engineering; sid:6009445; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.dpdccap.cfd/co.uk)"; flow:established,to_server; http.uri; content:"/co.uk"; startswith; fast_pattern; http.host; content:"dpd.dpdccap.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009446; classtype:social-engineering; sid:6009446; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j70i.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j70i.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009447; classtype:social-engineering; sid:6009447; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tlc8829.net/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"tlc8829.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009448; classtype:social-engineering; sid:6009448; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3659337.cc/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"3659337.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009449; classtype:social-engineering; sid:6009449; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3659338.cc/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"3659338.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009450; classtype:social-engineering; sid:6009450; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (id528.agency-digital-engine.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"id528.agency-digital-engine.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009451; classtype:social-engineering; sid:6009451; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inforesmi099.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"inforesmi099.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009452; classtype:social-engineering; sid:6009452; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15058877.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15058877.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009453; classtype:social-engineering; sid:6009453; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1775ll.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1775ll.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009454; classtype:social-engineering; sid:6009454; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member357.business-manage-invite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member357.business-manage-invite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009455; classtype:social-engineering; sid:6009455; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.qtrzvplxmn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.qtrzvplxmn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009456; classtype:social-engineering; sid:6009456; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1615vvv.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1615vvv.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009457; classtype:social-engineering; sid:6009457; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.qvxtrzlmnp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.qvxtrzlmnp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009458; classtype:social-engineering; sid:6009458; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.dpdccas.cfd/co.uk)"; flow:established,to_server; http.uri; content:"/co.uk"; startswith; fast_pattern; http.host; content:"dpd.dpdccas.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009459; classtype:social-engineering; sid:6009459; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1615r.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1615r.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009460; classtype:social-engineering; sid:6009460; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (huangguantiyu.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"huangguantiyu.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009461; classtype:social-engineering; sid:6009461; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.dpdccab.cfd/co.uk)"; flow:established,to_server; http.uri; content:"/co.uk"; startswith; fast_pattern; http.host; content:"dpd.dpdccab.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009462; classtype:social-engineering; sid:6009462; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi781.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"info-resmi781.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009463; classtype:social-engineering; sid:6009463; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imtokens.co/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"imtokens.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009464; classtype:social-engineering; sid:6009464; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.dpdccav.cfd/co.uk)"; flow:established,to_server; http.uri; content:"/co.uk"; startswith; fast_pattern; http.host; content:"dpd.dpdccav.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009465; classtype:social-engineering; sid:6009465; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kennedymotta.github.io/InstaClone/)"; flow:established,to_server; http.uri; content:"/InstaClone/"; startswith; fast_pattern; http.host; content:"kennedymotta.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009466; classtype:social-engineering; sid:6009466; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gruppere.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gruppere.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009467; classtype:social-engineering; sid:6009467; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faduan.wasmer.app/emeraldrenews)"; flow:established,to_server; http.uri; content:"/emeraldrenews"; startswith; fast_pattern; http.host; content:"faduan.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009468; classtype:social-engineering; sid:6009468; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dsycgyl.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dsycgyl.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009469; classtype:social-engineering; sid:6009469; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi344.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"info-resmi344.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009470; classtype:social-engineering; sid:6009470; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bbbin.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bbbin.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009471; classtype:social-engineering; sid:6009471; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.qztrvplxmn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.qztrvplxmn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009472; classtype:social-engineering; sid:6009472; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta.businesads-manager.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta.businesads-manager.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009473; classtype:social-engineering; sid:6009473; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hc9977.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hc9977.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009474; classtype:social-engineering; sid:6009474; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1775hhh.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1775hhh.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009475; classtype:social-engineering; sid:6009475; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (microsoft365office.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"microsoft365office.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009476; classtype:social-engineering; sid:6009476; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (drishtiguptaa.github.io/amazon-ui-clone)"; flow:established,to_server; http.uri; content:"/amazon-ui-clone"; startswith; fast_pattern; http.host; content:"drishtiguptaa.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009477; classtype:social-engineering; sid:6009477; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.allianz-hub.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.allianz-hub.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009478; classtype:social-engineering; sid:6009478; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jtst-4-aliexpress-c1z.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jtst-4-aliexpress-c1z.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009479; classtype:social-engineering; sid:6009479; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqxplznmtv.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqxplznmtv.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009480; classtype:social-engineering; sid:6009480; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-clone-sage-ten.vercel.app/signup)"; flow:established,to_server; http.uri; content:"/signup"; startswith; fast_pattern; http.host; content:"instagram-clone-sage-ten.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009481; classtype:social-engineering; sid:6009481; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mxtqvrp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mxtqvrp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009482; classtype:social-engineering; sid:6009482; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi919.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"info-resmi919.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009483; classtype:social-engineering; sid:6009483; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tvqrmplnzx.icu/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tvqrmplnzx.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009484; classtype:social-engineering; sid:6009484; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15860.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15860.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009485; classtype:social-engineering; sid:6009485; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (97ee8.catex.at/cnbcard/web_sms.php)"; flow:established,to_server; http.uri; content:"/cnbcard/web_sms.php"; startswith; fast_pattern; http.host; content:"97ee8.catex.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009486; classtype:social-engineering; sid:6009486; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi907.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"info-resmi907.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009487; classtype:social-engineering; sid:6009487; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1775qqqqq.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1775qqqqq.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009488; classtype:social-engineering; sid:6009488; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (special-win-cash20.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"special-win-cash20.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009489; classtype:social-engineering; sid:6009489; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16151144.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16151144.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009490; classtype:social-engineering; sid:6009490; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1165kk.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1165kk.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009491; classtype:social-engineering; sid:6009491; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.renewt.xyz/uk)"; flow:established,to_server; http.uri; content:"/uk"; startswith; fast_pattern; http.host; content:"dpd.renewt.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009492; classtype:social-engineering; sid:6009492; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vrqtplmnxz.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.vrqtplmnxz.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009493; classtype:social-engineering; sid:6009493; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.plqzmvtrxn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.plqzmvtrxn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009494; classtype:social-engineering; sid:6009494; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.plzqtrvmxn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.plzqtrvmxn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009495; classtype:social-engineering; sid:6009495; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xvnrqptmlz.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xvnrqptmlz.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009496; classtype:social-engineering; sid:6009496; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.getstemgames.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.getstemgames.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009497; classtype:social-engineering; sid:6009497; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.dpdccao.cfd/co.uk/)"; flow:established,to_server; http.uri; content:"/co.uk/"; startswith; fast_pattern; http.host; content:"dpd.dpdccao.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009498; classtype:social-engineering; sid:6009498; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (upshub.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"upshub.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009499; classtype:social-engineering; sid:6009499; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clonsviewmainrepo.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"clonsviewmainrepo.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009500; classtype:social-engineering; sid:6009500; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4003659.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"4003659.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009501; classtype:social-engineering; sid:6009501; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.plqzmtrvxn.icu/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.plqzmtrvxn.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009502; classtype:social-engineering; sid:6009502; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mplztrqvxn.ink/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mplztrqvxn.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009503; classtype:social-engineering; sid:6009503; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.hvqplzr.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.hvqplzr.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009504; classtype:social-engineering; sid:6009504; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cfd.worksinc.app/alert.php)"; flow:established,to_server; http.uri; content:"/alert.php"; startswith; fast_pattern; http.host; content:"cfd.worksinc.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009505; classtype:social-engineering; sid:6009505; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (195ttt195.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"195ttt195.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009506; classtype:social-engineering; sid:6009506; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.72273.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.72273.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009507; classtype:social-engineering; sid:6009507; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pixeltannu.github.io/netflix.clone)"; flow:established,to_server; http.uri; content:"/netflix.clone"; startswith; fast_pattern; http.host; content:"pixeltannu.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009508; classtype:social-engineering; sid:6009508; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mqtrvplxzn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mqtrvplxzn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009509; classtype:social-engineering; sid:6009509; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreic5tvubv22nqg24xjzksdmyk4mzmlbfs4yc72w4fsxbf734fzjphm.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreic5tvubv22nqg24xjzksdmyk4mzmlbfs4yc72w4fsxbf734fzjphm.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009510; classtype:social-engineering; sid:6009510; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (quwchohumain.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"quwchohumain.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009511; classtype:social-engineering; sid:6009511; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.dpdccay.cfd/co.uk)"; flow:established,to_server; http.uri; content:"/co.uk"; startswith; fast_pattern; http.host; content:"dpd.dpdccay.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009512; classtype:social-engineering; sid:6009512; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (solucionesweb12.iceiy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"solucionesweb12.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009513; classtype:social-engineering; sid:6009513; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqxplmvztn.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqxplmvztn.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009514; classtype:social-engineering; sid:6009514; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.qvxtrzplmn.ink/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.qvxtrzplmn.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009515; classtype:social-engineering; sid:6009515; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (utpc00firm.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"utpc00firm.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009516; classtype:social-engineering; sid:6009516; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coinbase_1_login.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coinbase_1_login.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009517; classtype:social-engineering; sid:6009517; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.dpdccav.cfd/co.uk/)"; flow:established,to_server; http.uri; content:"/co.uk/"; startswith; fast_pattern; http.host; content:"dpd.dpdccav.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009518; classtype:social-engineering; sid:6009518; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeeid101.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopeeid101.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009519; classtype:social-engineering; sid:6009519; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.businesads-manager.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.businesads-manager.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009520; classtype:social-engineering; sid:6009520; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.76898.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.76898.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009521; classtype:social-engineering; sid:6009521; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1959922.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1959922.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009522; classtype:social-engineering; sid:6009522; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (podo-orthesiologie.at/user/ssite/p2.html)"; flow:established,to_server; http.uri; content:"/user/ssite/p2.html"; startswith; fast_pattern; http.host; content:"podo-orthesiologie.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009523; classtype:social-engineering; sid:6009523; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqtmvplzxn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqtmvplzxn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009524; classtype:social-engineering; sid:6009524; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mpltzqxrvn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mpltzqxrvn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009525; classtype:social-engineering; sid:6009525; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.dpdccao.cfd/co.uk)"; flow:established,to_server; http.uri; content:"/co.uk"; startswith; fast_pattern; http.host; content:"dpd.dpdccao.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009526; classtype:social-engineering; sid:6009526; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.plztrvmqxn.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.plztrvmqxn.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009527; classtype:social-engineering; sid:6009527; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (badgeauth.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"badgeauth.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009528; classtype:social-engineering; sid:6009528; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqtmxvzpln.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqtmxvzpln.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009529; classtype:social-engineering; sid:6009529; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblovx.cam/users/518931499/profile)"; flow:established,to_server; http.uri; content:"/users/518931499/profile"; startswith; fast_pattern; http.host; content:"roblovx.cam"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009530; classtype:social-engineering; sid:6009530; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi275.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"info-resmi275.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009531; classtype:social-engineering; sid:6009531; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tkshops-tj.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.tkshops-tj.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009532; classtype:social-engineering; sid:6009532; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fix999.net/wp-includes/raxs)"; flow:established,to_server; http.uri; content:"/wp-includes/raxs"; startswith; fast_pattern; http.host; content:"fix999.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009533; classtype:social-engineering; sid:6009533; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tvxplqmrzn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tvxplqmrzn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009534; classtype:social-engineering; sid:6009534; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi212.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"info-resmi212.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009535; classtype:social-engineering; sid:6009535; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.zqtrvmplnx.icu/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.zqtrvmplnx.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009536; classtype:social-engineering; sid:6009536; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tplqzrmnvx.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tplqzrmnvx.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009537; classtype:social-engineering; sid:6009537; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.dpdccak.cfd/co.uk/)"; flow:established,to_server; http.uri; content:"/co.uk/"; startswith; fast_pattern; http.host; content:"dpd.dpdccak.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009538; classtype:social-engineering; sid:6009538; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi782.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"info-resmi782.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009539; classtype:social-engineering; sid:6009539; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.plzqtrvnmx.icu/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.plzqtrvnmx.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009540; classtype:social-engineering; sid:6009540; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (started-ssoapps.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"started-ssoapps.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009541; classtype:social-engineering; sid:6009541; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (screen-desktoplive.wixstudio.com/desktop)"; flow:established,to_server; http.uri; content:"/desktop"; startswith; fast_pattern; http.host; content:"screen-desktoplive.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009542; classtype:social-engineering; sid:6009542; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (subdomain.vdtronwebrriel.sbs/indexhtml)"; flow:established,to_server; http.uri; content:"/indexhtml"; startswith; fast_pattern; http.host; content:"subdomain.vdtronwebrriel.sbs"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009543; classtype:social-engineering; sid:6009543; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.cgd.pt/cdoOBA/login.seam?ref=3f3e1ac2300e91427aa77e420e92d00ad1)"; flow:established,to_server; http.uri; content:"/cdoOBA/login.seam?ref=3f3e1ac2300e91427aa77e420e92d00ad1"; startswith; fast_pattern; http.host; content:"app.cgd.pt"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009544; classtype:social-engineering; sid:6009544; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klelnanzeigen-deutch.towingservicenewjersey.com/receive/order/Aan5brHvjPK?r=0x14&__cf_chl_rt_tk=GL35VZUeFmCNfOxi7PCjsNKuGEJgYT4ya3rv_zaoD48-1780155288-1.0.1.1-L7yKZST7uyah9X.dSohSEJAPZLAYYP41yte6JorFswg)"; flow:established,to_server; http.uri; content:"/receive/order/Aan5brHvjPK?r=0x14&__cf_chl_rt_tk=GL35VZUeFmCNfOxi7PCjsNKuGEJgYT4ya3rv_zaoD48-1780155288-1.0.1.1-L7yKZST7uyah9X.dSohSEJAPZLAYYP41yte6JorFswg"; startswith; fast_pattern; http.host; content:"klelnanzeigen-deutch.towingservicenewjersey.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009545; classtype:social-engineering; sid:6009545; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (de.colomboag.ch/index.php?site=%22%2F%3E%3Cimg%20src%3D%22https%3A%2F%2Fgoogle.com%2FtB75rXsgzm59O.jpg%22%20onerror%3D%22window.location%3DdecodeURIComponent%28atob%28%27Njg3NDc0NzA3MzNhMmYyZjY1NzI3NDc2NzA2MTc2NjQ3YTZmNmU2NDJlMzAzMjMxMzEzMTMwNjYzNjJkMzUzMTM0MzYyZDM0NjE2NDM3MmQ2MTYyNjYzMDJkNjIzOTMxNjE2NDY2Mzg2NDM1NjY2NjMzMmU2MzZjNjk2MzZiMmY2MTYyMzczNTMzMzgzMTMzMmQzNjM1NjIzODJkMzQzOTM3MzAyZDM5Mzk2NDM0MmQ2MjMyNjIzMjYxNjI2MzMyMzEzMjY1MzYyZTcwNjg3MA%3D%3D%27%29.replace%28%2F%28..%29%2Fg%2C%20%27%25%241%27%29%29%3B%22%3E)"; flow:established,to_server; http.uri; content:"/index.php?site=%22%2F%3E%3Cimg%20src%3D%22https%3A%2F%2Fgoogle.com%2FtB75rXsgzm59O.jpg%22%20onerror%3D%22window.location%3DdecodeURIComponent%28atob%28%27Njg3NDc0NzA3MzNhMmYyZjY1NzI3NDc2NzA2MTc2NjQ3YTZmNmU2NDJlMzAzMjMxMzEzMTMwNjYzNjJkMzUzMTM0MzYyZDM0NjE2NDM3MmQ2MTYyNjYzMDJkNjIzOTMxNjE2NDY2Mzg2NDM1NjY2NjMzMmU2MzZjNjk2MzZiMmY2MTYyMzczNTMzMzgzMTMzMmQzNjM1NjIzODJkMzQzOTM3MzAyZDM5Mzk2NDM0MmQ2MjMyNjIzMjYxNjI2MzMyMzEzMjY1MzYyZTcwNjg3MA%3D%3D%27%29.replace%28%2F%28..%29%2Fg%2C%20%27%25%241%27%29%29%3B%22%3E"; startswith; fast_pattern; http.host; content:"de.colomboag.ch"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009546; classtype:social-engineering; sid:6009546; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qr-paydaygoto2.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qr-paydaygoto2.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009547; classtype:social-engineering; sid:6009547; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ameli-et-moi.my/pages/ban.php)"; flow:established,to_server; http.uri; content:"/pages/ban.php"; startswith; fast_pattern; http.host; content:"ameli-et-moi.my"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009548; classtype:social-engineering; sid:6009548; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trexorcdn-global.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"trexorcdn-global.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009549; classtype:social-engineering; sid:6009549; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ffaffx.021110f6-5146-4ad7-abf0-b91adf8d5ff3.click/ab753813-65b8-4970-99d4-b2b2abc212e6.php)"; flow:established,to_server; http.uri; content:"/ab753813-65b8-4970-99d4-b2b2abc212e6.php"; startswith; fast_pattern; http.host; content:"ffaffx.021110f6-5146-4ad7-abf0-b91adf8d5ff3.click"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009550; classtype:social-engineering; sid:6009550; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nav-ledgorsso.wixstudio.com/desktop)"; flow:established,to_server; http.uri; content:"/desktop"; startswith; fast_pattern; http.host; content:"nav-ledgorsso.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009551; classtype:social-engineering; sid:6009551; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appstrt-trezr.wixstudio.com/start-en)"; flow:established,to_server; http.uri; content:"/start-en"; startswith; fast_pattern; http.host; content:"appstrt-trezr.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009552; classtype:social-engineering; sid:6009552; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (homepage-bridgeus.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"homepage-bridgeus.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009553; classtype:social-engineering; sid:6009553; rev:1; metadata: signature_severity Major, created_et 2026_05_30, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (espace-destinataire.com/pages/captcha.php)"; flow:established,to_server; http.uri; content:"/pages/captcha.php"; startswith; fast_pattern; http.host; content:"espace-destinataire.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009554; classtype:social-engineering; sid:6009554; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acessousuariomaster.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"acessousuariomaster.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009555; classtype:social-engineering; sid:6009555; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fcalertscd.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fcalertscd.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009556; classtype:social-engineering; sid:6009556; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rtfreeski.com/wp-admin/access.php?r=bD1odHRwczovL2RxcmRidi5jb20v)"; flow:established,to_server; http.uri; content:"/wp-admin/access.php?r=bD1odHRwczovL2RxcmRidi5jb20v"; startswith; fast_pattern; http.host; content:"rtfreeski.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009557; classtype:social-engineering; sid:6009557; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (creativetrnd.wixstudio.com/mathieu-arsenault/en/qui-est-mathieu-arsenault)"; flow:established,to_server; http.uri; content:"/mathieu-arsenault/en/qui-est-mathieu-arsenault"; startswith; fast_pattern; http.host; content:"creativetrnd.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009558; classtype:social-engineering; sid:6009558; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-index--cryptosapp.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-index--cryptosapp.webflow.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009559; classtype:social-engineering; sid:6009559; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bradesco.praempresas.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bradesco.praempresas.sbs"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009560; classtype:social-engineering; sid:6009560; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.assessoriabritto.com/acess.php?token=7963949736a1bd132c165b9.99585946&cliente_7963949736a1bd132c165b9.99585946)"; flow:established,to_server; http.uri; content:"/acess.php?token=7963949736a1bd132c165b9.99585946&cliente_7963949736a1bd132c165b9.99585946"; startswith; fast_pattern; http.host; content:"www.assessoriabritto.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009561; classtype:social-engineering; sid:6009561; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accountrogershop.com/cgi-sys/suspendedpage.cgi)"; flow:established,to_server; http.uri; content:"/cgi-sys/suspendedpage.cgi"; startswith; fast_pattern; http.host; content:"accountrogershop.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009562; classtype:social-engineering; sid:6009562; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (societegenerale-particuliers.bolt.host/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"societegenerale-particuliers.bolt.host"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009563; classtype:social-engineering; sid:6009563; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p28a.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p28a.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009564; classtype:social-engineering; sid:6009564; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (black-brook-8ab7.5a73cbc5.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"black-brook-8ab7.5a73cbc5.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009565; classtype:social-engineering; sid:6009565; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pt-shopee0002.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"pt-shopee0002.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009566; classtype:social-engineering; sid:6009566; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (funciona.com.br/Tv8Qa2Lm7Hs4Y1DfR6BnU3GjW0PkCi5NuYq2RtK9EcLm1QaT4VpDf3GnUbJ5Xc/QWp7Hs2Qa9Lp4TvY1DfR6BnU3GjW0PkCi5XtKq2RyV8EcLm1QaT4DfGn3UbJ5Nua8Lp2Hs7TvY4DfR1BnU3GjW0PkWi5NuYq2RtK9EcLm1Hs4VpT7Df3GnUbJ5Cx/microsoft/)"; flow:established,to_server; http.uri; content:"/Tv8Qa2Lm7Hs4Y1DfR6BnU3GjW0PkCi5NuYq2RtK9EcLm1QaT4VpDf3GnUbJ5Xc/QWp7Hs2Qa9Lp4TvY1DfR6BnU3GjW0PkCi5XtKq2RyV8EcLm1QaT4DfGn3UbJ5Nua8Lp2Hs7TvY4DfR1BnU3GjW0PkWi5NuYq2RtK9EcLm1Hs4VpT7Df3GnUbJ5Cx/microsoft/"; startswith; fast_pattern; http.host; content:"funciona.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009567; classtype:social-engineering; sid:6009567; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.czqplwn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.czqplwn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009568; classtype:social-engineering; sid:6009568; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgarliveslog.framer.media/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledgarliveslog.framer.media"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009569; classtype:social-engineering; sid:6009569; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.cxmvprt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.cxmvprt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009570; classtype:social-engineering; sid:6009570; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (get-midas.maxstoday.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"get-midas.maxstoday.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009571; classtype:social-engineering; sid:6009571; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kyragaming.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kyragaming.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009572; classtype:social-engineering; sid:6009572; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi781.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi781.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009573; classtype:social-engineering; sid:6009573; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqzwknq.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqzwknq.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009574; classtype:social-engineering; sid:6009574; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tregar-io-start-us.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tregar-io-start-us.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009575; classtype:social-engineering; sid:6009575; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tnqzpvr.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tnqzpvr.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009576; classtype:social-engineering; sid:6009576; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j72w.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j72w.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009577; classtype:social-engineering; sid:6009577; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j72j.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j72j.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009578; classtype:social-engineering; sid:6009578; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zttgroulp.com/sos/wmalln.html)"; flow:established,to_server; http.uri; content:"/sos/wmalln.html"; startswith; fast_pattern; http.host; content:"zttgroulp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009579; classtype:social-engineering; sid:6009579; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.chkfortnite.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.chkfortnite.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009580; classtype:social-engineering; sid:6009580; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (princesleonorvipwebsitesreal.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"princesleonorvipwebsitesreal.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009581; classtype:social-engineering; sid:6009581; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.dpdccar.cfd/co.uk)"; flow:established,to_server; http.uri; content:"/co.uk"; startswith; fast_pattern; http.host; content:"dpd.dpdccar.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009582; classtype:social-engineering; sid:6009582; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-qravnik-biz-fravtek-plarnix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-qravnik-biz-fravtek-plarnix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009583; classtype:social-engineering; sid:6009583; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (submit-verify-lifetime-blue.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"submit-verify-lifetime-blue.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009584; classtype:social-engineering; sid:6009584; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (old.citiretailservices.citibankonlline.com/?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTc4MDE3NzczMSwiaWF0IjoxNzgwMTcwNTMxLCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIzMnE2dmFsNnA3YXFxdWxlNjA0M200c2IiLCJuYmYiOjE3ODAxNzA1MzEsInRzIjoxNzgwMTcwNTMxNDUxNTA1fQ.YBCwjR1XkVWNlbNslSqmmgyrhmhxbsDeVazDUF05bU0&sid=952c0e83-5c60-11f1-b2cb-fd3843c9d333)"; flow:established,to_server; http.uri; content:"/?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTc4MDE3NzczMSwiaWF0IjoxNzgwMTcwNTMxLCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIzMnE2dmFsNnA3YXFxdWxlNjA0M200c2IiLCJuYmYiOjE3ODAxNzA1MzEsInRzIjoxNzgwMTcwNTMxNDUxNTA1fQ.YBCwjR1XkVWNlbNslSqmmgyrhmhxbsDeVazDUF05bU0&sid=952c0e83-5c60-11f1-b2cb-fd3843c9d333"; startswith; fast_pattern; http.host; content:"old.citiretailservices.citibankonlline.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009585; classtype:social-engineering; sid:6009585; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqtmzvp.ink/track/)"; flow:established,to_server; http.uri; content:"/track/"; startswith; fast_pattern; http.host; content:"dpd.rqtmzvp.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009586; classtype:social-engineering; sid:6009586; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yi1-aqbyb4gkapb0d5dd.z02.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yi1-aqbyb4gkapb0d5dd.z02.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009587; classtype:social-engineering; sid:6009587; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqtmxvl.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqtmxvl.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009588; classtype:social-engineering; sid:6009588; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pt-shopee0002.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.pt-shopee0002.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009589; classtype:social-engineering; sid:6009589; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1615666999.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1615666999.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009590; classtype:social-engineering; sid:6009590; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kzwrplq.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kzwrplq.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009591; classtype:social-engineering; sid:6009591; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b30o.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b30o.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009592; classtype:social-engineering; sid:6009592; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.yzz.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.yzz.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009593; classtype:social-engineering; sid:6009593; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (microsoft-1ogin.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"microsoft-1ogin.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009594; classtype:social-engineering; sid:6009594; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.gnzwrpl.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.gnzwrpl.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009595; classtype:social-engineering; sid:6009595; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.inforesmi099.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.inforesmi099.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009596; classtype:social-engineering; sid:6009596; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (security-hub--halebowdondenta.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"security-hub--halebowdondenta.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009597; classtype:social-engineering; sid:6009597; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-plornok-biz-fraptek-slurnix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-plornok-biz-fraptek-slurnix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009598; classtype:social-engineering; sid:6009598; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zenn-dot.github.io/Smart_Netflix/)"; flow:established,to_server; http.uri; content:"/Smart_Netflix/"; startswith; fast_pattern; http.host; content:"zenn-dot.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009599; classtype:social-engineering; sid:6009599; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zb22.cc/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"zb22.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009600; classtype:social-engineering; sid:6009600; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqtxmvl.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqtxmvl.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009601; classtype:social-engineering; sid:6009601; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (97ee7.catex.at/cnbcard/?b=YTo0OntzOjU6ImxhYmVsIjtzOjI6IjQ5IjtzOjM6InVzciI7aToxNjE2O3M6NDoibm9wZCI7czoxNDoicnNzLnJlYWRsZXMuYXQiO3M6MToibyI7aToyMTM1O30=)"; flow:established,to_server; http.uri; content:"/cnbcard/?b=YTo0OntzOjU6ImxhYmVsIjtzOjI6IjQ5IjtzOjM6InVzciI7aToxNjE2O3M6NDoibm9wZCI7czoxNDoicnNzLnJlYWRsZXMuYXQiO3M6MToibyI7aToyMTM1O30="; startswith; fast_pattern; http.host; content:"97ee7.catex.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009602; classtype:social-engineering; sid:6009602; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.k68h.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.k68h.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009603; classtype:social-engineering; sid:6009603; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bigsaleshopee359.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bigsaleshopee359.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009604; classtype:social-engineering; sid:6009604; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jplnzwq.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jplnzwq.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009605; classtype:social-engineering; sid:6009605; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.hjvqtrp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.hjvqtrp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009606; classtype:social-engineering; sid:6009606; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.fqznplr.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.fqznplr.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009607; classtype:social-engineering; sid:6009607; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecuad0r-your-access-001.free.nf/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ecuad0r-your-access-001.free.nf"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009608; classtype:social-engineering; sid:6009608; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflixy-bixy.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflixy-bixy.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009609; classtype:social-engineering; sid:6009609; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.qznvplmtrx.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.qznvplmtrx.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009610; classtype:social-engineering; sid:6009610; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi774.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi774.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009611; classtype:social-engineering; sid:6009611; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.czplnwr.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.czplnwr.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009612; classtype:social-engineering; sid:6009612; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.gqtmwrp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.gqtmwrp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009613; classtype:social-engineering; sid:6009613; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jxtrmql.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jxtrmql.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009614; classtype:social-engineering; sid:6009614; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (15673.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"15673.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009615; classtype:social-engineering; sid:6009615; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-vrolnex-biz-qravlor-glavrix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-vrolnex-biz-qravlor-glavrix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009616; classtype:social-engineering; sid:6009616; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hk.uat.mizuhoscfglobal.com/scf/login?error)"; flow:established,to_server; http.uri; content:"/scf/login?error"; startswith; fast_pattern; http.host; content:"hk.uat.mizuhoscfglobal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009617; classtype:social-engineering; sid:6009617; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi079.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"info-resmi079.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009618; classtype:social-engineering; sid:6009618; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accountrogershop.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"accountrogershop.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009619; classtype:social-engineering; sid:6009619; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (layconf80-boop.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"layconf80-boop.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009620; classtype:social-engineering; sid:6009620; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ee1505.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ee1505.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009621; classtype:social-engineering; sid:6009621; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.gnwzrqp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.gnwzrqp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009622; classtype:social-engineering; sid:6009622; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqtxmvp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqtxmvp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009623; classtype:social-engineering; sid:6009623; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kpmxqvt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kpmxqvt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009624; classtype:social-engineering; sid:6009624; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bvxqtrp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.bvxqtrp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009625; classtype:social-engineering; sid:6009625; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-fraptek-biz-slurnax-qolnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-fraptek-biz-slurnax-qolnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009626; classtype:social-engineering; sid:6009626; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tralalero-user.bandit.wtf/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tralalero-user.bandit.wtf"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009627; classtype:social-engineering; sid:6009627; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rajshreek651.github.io/ProjectAmazon-LandingPage/)"; flow:established,to_server; http.uri; content:"/ProjectAmazon-LandingPage/"; startswith; fast_pattern; http.host; content:"rajshreek651.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009628; classtype:social-engineering; sid:6009628; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toxic-adeayo.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"toxic-adeayo.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009629; classtype:social-engineering; sid:6009629; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ghotkshop.com/h5/index.html)"; flow:established,to_server; http.uri; content:"/h5/index.html"; startswith; fast_pattern; http.host; content:"www.ghotkshop.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009630; classtype:social-engineering; sid:6009630; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (humanresources.website/page/a681c378e23f13fd5ba5247d2c55da0a038b3f03)"; flow:established,to_server; http.uri; content:"/page/a681c378e23f13fd5ba5247d2c55da0a038b3f03"; startswith; fast_pattern; http.host; content:"humanresources.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009631; classtype:social-engineering; sid:6009631; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopeeid101.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopeeid101.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009632; classtype:social-engineering; sid:6009632; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hga1113.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hga1113.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009633; classtype:social-engineering; sid:6009633; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.fqplznv.cloud/track/)"; flow:established,to_server; http.uri; content:"/track/"; startswith; fast_pattern; http.host; content:"dpd.fqplznv.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009634; classtype:social-engineering; sid:6009634; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.boniuwen.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.boniuwen.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009635; classtype:social-engineering; sid:6009635; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwe.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwe.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009636; classtype:social-engineering; sid:6009636; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kplxqvr.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kplxqvr.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009637; classtype:social-engineering; sid:6009637; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.hvxptrq.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.hvxptrq.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009638; classtype:social-engineering; sid:6009638; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi465.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi465.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009639; classtype:social-engineering; sid:6009639; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-index--cryptosapp.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-index--cryptosapp.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009640; classtype:social-engineering; sid:6009640; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nnnn195.com/m/)"; flow:established,to_server; http.uri; content:"/m/"; startswith; fast_pattern; http.host; content:"nnnn195.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009641; classtype:social-engineering; sid:6009641; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwd.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingwd.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009642; classtype:social-engineering; sid:6009642; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jplwnqr.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jplwnqr.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009643; classtype:social-engineering; sid:6009643; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.gnwrqpl.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.gnwrqpl.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009644; classtype:social-engineering; sid:6009644; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreibjfpmextex4uxucejwm4huyvvlgattxhddtqio4cmj3h4zafhzzu.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreibjfpmextex4uxucejwm4huyvvlgattxhddtqio4cmj3h4zafhzzu.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009645; classtype:social-engineering; sid:6009645; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mvagusta.vn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mvagusta.vn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009646; classtype:social-engineering; sid:6009646; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwa.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwa.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009647; classtype:social-engineering; sid:6009647; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (joeueiu.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"joeueiu.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009648; classtype:social-engineering; sid:6009648; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi212.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi212.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009649; classtype:social-engineering; sid:6009649; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aitptest.com/?rid=nsqfVze)"; flow:established,to_server; http.uri; content:"/?rid=nsqfVze"; startswith; fast_pattern; http.host; content:"aitptest.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009650; classtype:social-engineering; sid:6009650; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.hvzplqn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.hvzplqn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009651; classtype:social-engineering; sid:6009651; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.submit-verify-lifetime-blue.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.submit-verify-lifetime-blue.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009652; classtype:social-engineering; sid:6009652; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cxwjpg.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cxwjpg.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009653; classtype:social-engineering; sid:6009653; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.p-pagamentoseguro.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.p-pagamentoseguro.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009654; classtype:social-engineering; sid:6009654; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (y28m.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"y28m.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009655; classtype:social-engineering; sid:6009655; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dna-formnindonesia.xoxoiuh.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dna-formnindonesia.xoxoiuh.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009656; classtype:social-engineering; sid:6009656; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi919.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi919.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009657; classtype:social-engineering; sid:6009657; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi275.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi275.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009658; classtype:social-engineering; sid:6009658; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.fqplwrq.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.fqplwrq.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009659; classtype:social-engineering; sid:6009659; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqznxlp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqznxlp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009660; classtype:social-engineering; sid:6009660; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (new-cm-edgedigital.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"new-cm-edgedigital.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009661; classtype:social-engineering; sid:6009661; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.dpdccar.cfd/co.uk/)"; flow:established,to_server; http.uri; content:"/co.uk/"; startswith; fast_pattern; http.host; content:"dpd.dpdccar.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009662; classtype:social-engineering; sid:6009662; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.pl-59012941.lat/oferta/97916684/amd-ryzen-7-58)"; flow:established,to_server; http.uri; content:"/oferta/97916684/amd-ryzen-7-58"; startswith; fast_pattern; http.host; content:"allegrolokalnie.pl-59012941.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009663; classtype:social-engineering; sid:6009663; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.pnzqwrl.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.pnzqwrl.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009664; classtype:social-engineering; sid:6009664; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (x20h.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"x20h.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009665; classtype:social-engineering; sid:6009665; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tnvplkq.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tnvplkq.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009666; classtype:social-engineering; sid:6009666; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (game-mall.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"game-mall.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009667; classtype:social-engineering; sid:6009667; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqzmtvp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqzmtvp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009668; classtype:social-engineering; sid:6009668; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqznwqk.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqznwqk.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009669; classtype:social-engineering; sid:6009669; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ghotkshop.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ghotkshop.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009670; classtype:social-engineering; sid:6009670; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shifaa07.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"shifaa07.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009671; classtype:social-engineering; sid:6009671; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-zeta-five.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-zeta-five.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009672; classtype:social-engineering; sid:6009672; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-4e0d515d9c79417e8b4042dfa120d149.r2.dev/shyfacewebnnf.html?koiclid=DtsiGAESnl)"; flow:established,to_server; http.uri; content:"/shyfacewebnnf.html?koiclid=DtsiGAESnl"; startswith; fast_pattern; http.host; content:"pub-4e0d515d9c79417e8b4042dfa120d149.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009673; classtype:social-engineering; sid:6009673; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-plament-biz-travnik-vrolqar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-plament-biz-travnik-vrolqar.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009674; classtype:social-engineering; sid:6009674; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqn.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingqn.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009675; classtype:social-engineering; sid:6009675; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bzqwnlt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.bzqwnlt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009676; classtype:social-engineering; sid:6009676; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jplnqwr.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jplnqwr.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009677; classtype:social-engineering; sid:6009677; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.hvplqzr.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.hvplqzr.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009678; classtype:social-engineering; sid:6009678; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (swanbitcoinpolicy.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"swanbitcoinpolicy.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009679; classtype:social-engineering; sid:6009679; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.gwxtrvl.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.gwxtrvl.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009680; classtype:social-engineering; sid:6009680; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwo.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwo.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009681; classtype:social-engineering; sid:6009681; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi699.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"info-resmi699.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009682; classtype:social-engineering; sid:6009682; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ww1.citibankonlline.com/?dmn=citibankonlline.com)"; flow:established,to_server; http.uri; content:"/?dmn=citibankonlline.com"; startswith; fast_pattern; http.host; content:"ww1.citibankonlline.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009683; classtype:social-engineering; sid:6009683; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqc.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingqc.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009684; classtype:social-engineering; sid:6009684; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwt.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009685; classtype:social-engineering; sid:6009685; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.joeueiu.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.joeueiu.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009686; classtype:social-engineering; sid:6009686; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bridge-trezor.plasmic.run/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bridge-trezor.plasmic.run"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009687; classtype:social-engineering; sid:6009687; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rohitprajapati23.github.io/Netflix_Clone/)"; flow:established,to_server; http.uri; content:"/Netflix_Clone/"; startswith; fast_pattern; http.host; content:"rohitprajapati23.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009688; classtype:social-engineering; sid:6009688; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-page-builder--andylewis1000.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-page-builder--andylewis1000.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009689; classtype:social-engineering; sid:6009689; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (effortless-unicorn-56ea7a.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"effortless-unicorn-56ea7a.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009690; classtype:social-engineering; sid:6009690; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zb44.cc/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"zb44.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009691; classtype:social-engineering; sid:6009691; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.meta-cn-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.meta-cn-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009692; classtype:social-engineering; sid:6009692; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.hvxqtrp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.hvxqtrp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009693; classtype:social-engineering; sid:6009693; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (koko-web.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"koko-web.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009694; classtype:social-engineering; sid:6009694; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (svteamconmmunity.com/gift/72503)"; flow:established,to_server; http.uri; content:"/gift/72503"; startswith; fast_pattern; http.host; content:"svteamconmmunity.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009695; classtype:social-engineering; sid:6009695; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-trapnex-biz-drurnik-slavtor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-trapnex-biz-drurnik-slavtor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009696; classtype:social-engineering; sid:6009696; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (package-redelivery-usps--dinifago77.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"package-redelivery-usps--dinifago77.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009697; classtype:social-engineering; sid:6009697; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.deliveryfailedn.xyz/uk)"; flow:established,to_server; http.uri; content:"/uk"; startswith; fast_pattern; http.host; content:"dpd.deliveryfailedn.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009698; classtype:social-engineering; sid:6009698; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylaterz.file-resmii4.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylaterz.file-resmii4.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009699; classtype:social-engineering; sid:6009699; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bvxtrqm.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.bvxtrqm.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009700; classtype:social-engineering; sid:6009700; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15682.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15682.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009701; classtype:social-engineering; sid:6009701; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-drurnax-biz-vrolqar-qolnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-drurnax-biz-vrolqar-qolnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009702; classtype:social-engineering; sid:6009702; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jplwrnz.ink/track/)"; flow:established,to_server; http.uri; content:"/track/"; startswith; fast_pattern; http.host; content:"dpd.jplwrnz.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009703; classtype:social-engineering; sid:6009703; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hexbroz.com/goffy)"; flow:established,to_server; http.uri; content:"/goffy"; startswith; fast_pattern; http.host; content:"hexbroz.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009704; classtype:social-engineering; sid:6009704; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (falgun.damanimaynie.info/ga/click/2-68583676-176-8638-16883-9257-50461feab3-fc8a7a4534)"; flow:established,to_server; http.uri; content:"/ga/click/2-68583676-176-8638-16883-9257-50461feab3-fc8a7a4534"; startswith; fast_pattern; http.host; content:"falgun.damanimaynie.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009705; classtype:social-engineering; sid:6009705; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (h20u.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"h20u.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009706; classtype:social-engineering; sid:6009706; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tmqvzxl.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tmqvzxl.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009707; classtype:social-engineering; sid:6009707; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bigsaleshopee359.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bigsaleshopee359.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009708; classtype:social-engineering; sid:6009708; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-slapvik-biz-drurnix-vroltek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-slapvik-biz-drurnix-vroltek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009709; classtype:social-engineering; sid:6009709; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (steamspark.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"steamspark.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009710; classtype:social-engineering; sid:6009710; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (15685.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"15685.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009711; classtype:social-engineering; sid:6009711; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (libin5lp-code.github.io/Amazonz/)"; flow:established,to_server; http.uri; content:"/Amazonz/"; startswith; fast_pattern; http.host; content:"libin5lp-code.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009712; classtype:social-engineering; sid:6009712; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.fxqmtvl.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.fxqmtvl.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009713; classtype:social-engineering; sid:6009713; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bet365.casinologinonline.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bet365.casinologinonline.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009714; classtype:social-engineering; sid:6009714; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rayx81194.github.io/amazon/)"; flow:established,to_server; http.uri; content:"/amazon/"; startswith; fast_pattern; http.host; content:"rayx81194.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009715; classtype:social-engineering; sid:6009715; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portal46990.billing-service-a4c4585ai21.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"portal46990.billing-service-a4c4585ai21.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009716; classtype:social-engineering; sid:6009716; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqznplx.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqznplx.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009717; classtype:social-engineering; sid:6009717; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (501js.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"501js.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009718; classtype:social-engineering; sid:6009718; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smakers-demo.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"smakers-demo.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009719; classtype:social-engineering; sid:6009719; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox.com.bz/communities/4559625693/)"; flow:established,to_server; http.uri; content:"/communities/4559625693/"; startswith; fast_pattern; http.host; content:"roblox.com.bz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009720; classtype:social-engineering; sid:6009720; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bom.so/AzJjRw/)"; flow:established,to_server; http.uri; content:"/AzJjRw/"; startswith; fast_pattern; http.host; content:"www.bom.so"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009721; classtype:social-engineering; sid:6009721; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amberyak.buzz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amberyak.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009722; classtype:social-engineering; sid:6009722; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.utpc00firm.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.utpc00firm.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009723; classtype:social-engineering; sid:6009723; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwl.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingwl.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009724; classtype:social-engineering; sid:6009724; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (newgeneralvalidateprocess.sfo3.cdn.digitaloceanspaces.com/mayjunevalidateproces/newgenctp.html?websrc=696ead9b5a2af69f6bed4bce926e666be9bead66a626bae666ae462f6da9a56696b6d5e9c5ebe99d696f6fbd924f696b9ea625db6ac6b96d9bea466e5a99bf6bad5a4aa9a49fae6cb2b6e5466de6cfc22e2b6edb5beb6ae9666abbb6b6e6fbe62599daddab4db69bbbb92abbd44def64e999f9e9ab6a4e466bbbe9aee9ebbabb96aa626b9b6ee95c9fefec9b99e4ade466f5c66fd469db6ebbde6d9ca6d9ebb4a4c59b)"; flow:established,to_server; http.uri; content:"/mayjunevalidateproces/newgenctp.html?websrc=696ead9b5a2af69f6bed4bce926e666be9bead66a626bae666ae462f6da9a56696b6d5e9c5ebe99d696f6fbd924f696b9ea625db6ac6b96d9bea466e5a99bf6bad5a4aa9a49fae6cb2b6e5466de6cfc22e2b6edb5beb6ae9666abbb6b6e6fbe62599daddab4db69bbbb92abbd44def64e999f9e9ab6a4e466bbbe9aee9ebbabb96aa626b9b6ee95c9fefec9b99e4ade466f5c66fd469db6ebbde6d9ca6d9ebb4a4c59b"; startswith; fast_pattern; http.host; content:"newgeneralvalidateprocess.sfo3.cdn.digitaloceanspaces.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009725; classtype:social-engineering; sid:6009725; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi366.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi366.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009726; classtype:social-engineering; sid:6009726; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwi.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwi.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009727; classtype:social-engineering; sid:6009727; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mxtrqvp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mxtrqvp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009728; classtype:social-engineering; sid:6009728; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.10086a.vip:443/chs/)"; flow:established,to_server; http.uri; content:"/chs/"; startswith; fast_pattern; http.host; content:"m.10086a.vip:443"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009729; classtype:social-engineering; sid:6009729; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (199816.vip:8989/lottery.html)"; flow:established,to_server; http.uri; content:"/lottery.html"; startswith; fast_pattern; http.host; content:"199816.vip:8989"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009730; classtype:social-engineering; sid:6009730; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uwaishansari.github.io/Projects/)"; flow:established,to_server; http.uri; content:"/Projects/"; startswith; fast_pattern; http.host; content:"uwaishansari.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009731; classtype:social-engineering; sid:6009731; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kishwar18k.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"kishwar18k.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009732; classtype:social-engineering; sid:6009732; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flokiprivacyreview.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"flokiprivacyreview.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009733; classtype:social-engineering; sid:6009733; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.yl8630.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.yl8630.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009734; classtype:social-engineering; sid:6009734; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dtryftugyhiuoiyhi-mxrz25ftxf.edgeone.cool/?eo_token=729be2a4681f766cf9257054f8b4b4e4&eo_time=1779931502)"; flow:established,to_server; http.uri; content:"/?eo_token=729be2a4681f766cf9257054f8b4b4e4&eo_time=1779931502"; startswith; fast_pattern; http.host; content:"dtryftugyhiuoiyhi-mxrz25ftxf.edgeone.cool"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009735; classtype:social-engineering; sid:6009735; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365zh1.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.365zh1.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009736; classtype:social-engineering; sid:6009736; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bet3659n.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"bet3659n.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009737; classtype:social-engineering; sid:6009737; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hg-8a.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hg-8a.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009738; classtype:social-engineering; sid:6009738; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwl.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009739; classtype:social-engineering; sid:6009739; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mtrxqvp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mtrxqvp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009740; classtype:social-engineering; sid:6009740; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.inforesmi555.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.inforesmi555.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009741; classtype:social-engineering; sid:6009741; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwr.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009742; classtype:social-engineering; sid:6009742; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-qoltrax-biz-vromtek-slaplor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-qoltrax-biz-vromtek-slaplor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009743; classtype:social-engineering; sid:6009743; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi219.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi219.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009744; classtype:social-engineering; sid:6009744; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bvnrqzp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.bvnrqzp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009745; classtype:social-engineering; sid:6009745; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortskinx.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortskinx.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009746; classtype:social-engineering; sid:6009746; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365365fa.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"365365fa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009747; classtype:social-engineering; sid:6009747; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.10086a.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.10086a.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009748; classtype:social-engineering; sid:6009748; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mukund2007.github.io/NETFLIX_CLONE/)"; flow:established,to_server; http.uri; content:"/NETFLIX_CLONE/"; startswith; fast_pattern; http.host; content:"mukund2007.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009749; classtype:social-engineering; sid:6009749; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi846.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi846.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009750; classtype:social-engineering; sid:6009750; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pro-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pro-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009751; classtype:social-engineering; sid:6009751; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xznewdnaa-indocostmer.xoxoiuh.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xznewdnaa-indocostmer.xoxoiuh.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009752; classtype:social-engineering; sid:6009752; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mplvqxtrzn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mplvqxtrzn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009753; classtype:social-engineering; sid:6009753; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.hvplzqt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.hvplzqt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009754; classtype:social-engineering; sid:6009754; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tnqrzpl.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tnqrzpl.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009755; classtype:social-engineering; sid:6009755; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (poubgmobiles.officiall-events.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"poubgmobiles.officiall-events.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009756; classtype:social-engineering; sid:6009756; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (268365k.com/#/register?shareCode=0HDB)"; flow:established,to_server; http.uri; content:"/#/register?shareCode=0HDB"; startswith; fast_pattern; http.host; content:"268365k.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009757; classtype:social-engineering; sid:6009757; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-page-editor--onuohapaul90.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-page-editor--onuohapaul90.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009758; classtype:social-engineering; sid:6009758; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15674.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15674.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009759; classtype:social-engineering; sid:6009759; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-drurnix-biz-slortek-fronlax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-drurnix-biz-slortek-fronlax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009760; classtype:social-engineering; sid:6009760; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kiwops.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kiwops.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009761; classtype:social-engineering; sid:6009761; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwp.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwp.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009762; classtype:social-engineering; sid:6009762; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kznwplt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kznwplt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009763; classtype:social-engineering; sid:6009763; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bzrnpwl.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.bzrnpwl.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009764; classtype:social-engineering; sid:6009764; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hk.uat.mizuhoscfglobal.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hk.uat.mizuhoscfglobal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009765; classtype:social-engineering; sid:6009765; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (snow-0204.github.io/amazoneClone/)"; flow:established,to_server; http.uri; content:"/amazoneClone/"; startswith; fast_pattern; http.host; content:"snow-0204.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009766; classtype:social-engineering; sid:6009766; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-vraqlor-biz-glapvik-drurnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-vraqlor-biz-glapvik-drurnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009767; classtype:social-engineering; sid:6009767; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-slurnex-biz-qoltrik-drament.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-slurnex-biz-qoltrik-drament.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009768; classtype:social-engineering; sid:6009768; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (samreans.github.io/Here-attacthed/Purchase%20Order)"; flow:established,to_server; http.uri; content:"/Here-attacthed/Purchase%20Order"; startswith; fast_pattern; http.host; content:"samreans.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009769; classtype:social-engineering; sid:6009769; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zaidkhatri-dev.github.io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"zaidkhatri-dev.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009770; classtype:social-engineering; sid:6009770; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagramdefrancisco.blogspot.com/2024/09/instagram.html)"; flow:established,to_server; http.uri; content:"/2024/09/instagram.html"; startswith; fast_pattern; http.host; content:"instagramdefrancisco.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009771; classtype:social-engineering; sid:6009771; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3jme-sz3p-86sg.dan-dalkedesigngroup-com-s-account.workers.dev/a469a486a391ead9?email=aexample.com?email=lorossys@5c4df2604030431b0f357145020af68b4d7c.com)"; flow:established,to_server; http.uri; content:"/a469a486a391ead9?email=aexample.com?email=lorossys@5c4df2604030431b0f357145020af68b4d7c.com"; startswith; fast_pattern; http.host; content:"3jme-sz3p-86sg.dan-dalkedesigngroup-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009772; classtype:social-engineering; sid:6009772; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-plovtik-biz-slarnex-tramvik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-plovtik-biz-slarnex-tramvik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009773; classtype:social-engineering; sid:6009773; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.qmrvlpx.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.qmrvlpx.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009774; classtype:social-engineering; sid:6009774; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee7369.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopee7369.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009775; classtype:social-engineering; sid:6009775; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreic4i6dcf3l7fjwy3ehkxfjsunhd6j3kh4ycikdney3pzg5jrjbrxy.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreic4i6dcf3l7fjwy3ehkxfjsunhd6j3kh4ycikdney3pzg5jrjbrxy.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009776; classtype:social-engineering; sid:6009776; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jplwnzq.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jplwnzq.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009777; classtype:social-engineering; sid:6009777; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tnplzrq.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tnplzrq.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009778; classtype:social-engineering; sid:6009778; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bqltnu.top/pay/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.bqltnu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009779; classtype:social-engineering; sid:6009779; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.submite.xyz/uk)"; flow:established,to_server; http.uri; content:"/uk"; startswith; fast_pattern; http.host; content:"dpd.submite.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009780; classtype:social-engineering; sid:6009780; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1615666111.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1615666111.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009781; classtype:social-engineering; sid:6009781; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.qmvxtrz.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.qmvxtrz.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009782; classtype:social-engineering; sid:6009782; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwi.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwi.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009783; classtype:social-engineering; sid:6009783; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-validation-service-u1.click/id-update/)"; flow:established,to_server; http.uri; content:"/id-update/"; startswith; fast_pattern; http.host; content:"account-validation-service-u1.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009784; classtype:social-engineering; sid:6009784; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ruten888.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ruten888.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009785; classtype:social-engineering; sid:6009785; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.inforesmi1247.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.inforesmi1247.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009786; classtype:social-engineering; sid:6009786; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqztqlm.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqztqlm.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009787; classtype:social-engineering; sid:6009787; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-tramvok-biz-drulnax-vroltek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-tramvok-biz-drulnax-vroltek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009788; classtype:social-engineering; sid:6009788; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.runten8126.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.runten8126.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009789; classtype:social-engineering; sid:6009789; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bet365.casinologinonline.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bet365.casinologinonline.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009790; classtype:social-engineering; sid:6009790; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-glarnix-biz-plornax-vromtek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-glarnix-biz-plornax-vromtek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009791; classtype:social-engineering; sid:6009791; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3115vip6.com:8989/agent.html)"; flow:established,to_server; http.uri; content:"/agent.html"; startswith; fast_pattern; http.host; content:"3115vip6.com:8989"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009792; classtype:social-engineering; sid:6009792; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kznxplt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kznxplt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009793; classtype:social-engineering; sid:6009793; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi907.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi907.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009794; classtype:social-engineering; sid:6009794; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kzwplxn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kzwplxn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009795; classtype:social-engineering; sid:6009795; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bwvmnyx.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bwvmnyx.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009796; classtype:social-engineering; sid:6009796; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s26n.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"s26n.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009797; classtype:social-engineering; sid:6009797; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hk.uat.mizuhoscfglobal.com/scf/accountSwitcher.htm)"; flow:established,to_server; http.uri; content:"/scf/accountSwitcher.htm"; startswith; fast_pattern; http.host; content:"hk.uat.mizuhoscfglobal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009798; classtype:social-engineering; sid:6009798; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-tramvik-biz-plornax-qolvex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-tramvik-biz-plornax-qolvex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009799; classtype:social-engineering; sid:6009799; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgorlives.framer.media/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledgorlives.framer.media"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009800; classtype:social-engineering; sid:6009800; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.gqwmtrp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.gqwmtrp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009801; classtype:social-engineering; sid:6009801; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingws.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingws.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009802; classtype:social-engineering; sid:6009802; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (15694.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"15694.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009803; classtype:social-engineering; sid:6009803; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (calorie.electricbrae.info/ga/click/2-17716069-34-8549-16720-9190-60746545c2-4eec81fa06)"; flow:established,to_server; http.uri; content:"/ga/click/2-17716069-34-8549-16720-9190-60746545c2-4eec81fa06"; startswith; fast_pattern; http.host; content:"calorie.electricbrae.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009804; classtype:social-engineering; sid:6009804; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwr.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwr.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009805; classtype:social-engineering; sid:6009805; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwo.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009806; classtype:social-engineering; sid:6009806; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kleinanzeigen-deutsch.id73249.info/getpaymentm/247094252/m2)"; flow:established,to_server; http.uri; content:"/getpaymentm/247094252/m2"; startswith; fast_pattern; http.host; content:"kleinanzeigen-deutsch.id73249.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009807; classtype:social-engineering; sid:6009807; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (io-treezo-startt.wixstudio.com/en-ie)"; flow:established,to_server; http.uri; content:"/en-ie"; startswith; fast_pattern; http.host; content:"io-treezo-startt.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009808; classtype:social-engineering; sid:6009808; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fernando.bdll55113248.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fernando.bdll55113248.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009809; classtype:social-engineering; sid:6009809; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sparkassen-chess-trophy.de/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sparkassen-chess-trophy.de"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009810; classtype:social-engineering; sid:6009810; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vote-1780192853.vercel.app/1nw1zyg2)"; flow:established,to_server; http.uri; content:"/1nw1zyg2"; startswith; fast_pattern; http.host; content:"vote-1780192853.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009811; classtype:social-engineering; sid:6009811; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klelnanzeigen-deutch.huntsvillepowerwashing.com/receive/order/35exjPYrxqe?r=0x14&__cf_chl_rt_tk=a7n6pwyi6WOh.eEu9eYwTwTzCf5ntaD3QDd20fTDBI8-1780223797-1.0.1.1-XMtjXbSd6KkbcQQUUsyCfmFBhwCCP3Z5vnGNwSye9Fg)"; flow:established,to_server; http.uri; content:"/receive/order/35exjPYrxqe?r=0x14&__cf_chl_rt_tk=a7n6pwyi6WOh.eEu9eYwTwTzCf5ntaD3QDd20fTDBI8-1780223797-1.0.1.1-XMtjXbSd6KkbcQQUUsyCfmFBhwCCP3Z5vnGNwSye9Fg"; startswith; fast_pattern; http.host; content:"klelnanzeigen-deutch.huntsvillepowerwashing.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009812; classtype:social-engineering; sid:6009812; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (arneodo.bdll55113248.pro/captcha.php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"arneodo.bdll55113248.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009813; classtype:social-engineering; sid:6009813; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fredric.co.uk/giittv/)"; flow:established,to_server; http.uri; content:"/giittv/"; startswith; fast_pattern; http.host; content:"www.fredric.co.uk"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009814; classtype:social-engineering; sid:6009814; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (homepage-trzureio.wixstudio.com/web-en)"; flow:established,to_server; http.uri; content:"/web-en"; startswith; fast_pattern; http.host; content:"homepage-trzureio.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009815; classtype:social-engineering; sid:6009815; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.2301204h.lat/lokalnie/?id=8a9M9F9U4j7E9Y4g6m4o0v2V0s8g7v0O)"; flow:established,to_server; http.uri; content:"/lokalnie/?id=8a9M9F9U4j7E9Y4g6m4o0v2V0s8g7v0O"; startswith; fast_pattern; http.host; content:"allegro.2301204h.lat"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009816; classtype:social-engineering; sid:6009816; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fernando.bdll55113248.pro/captcha.php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"fernando.bdll55113248.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009817; classtype:social-engineering; sid:6009817; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (insproxy.66zhang.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"insproxy.66zhang.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009818; classtype:social-engineering; sid:6009818; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pt777akses.com.005.semogasukses1.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pt777akses.com.005.semogasukses1.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009819; classtype:social-engineering; sid:6009819; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support144.agency-digital-engine.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"support144.agency-digital-engine.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009820; classtype:social-engineering; sid:6009820; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kaufeld.com/cgi-bin/home.ha)"; flow:established,to_server; http.uri; content:"/cgi-bin/home.ha"; startswith; fast_pattern; http.host; content:"kaufeld.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009821; classtype:social-engineering; sid:6009821; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fakeflix-kjz.web.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fakeflix-kjz.web.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009822; classtype:social-engineering; sid:6009822; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.fxrmqvt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.fxrmqvt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009823; classtype:social-engineering; sid:6009823; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16154411.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16154411.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009824; classtype:social-engineering; sid:6009824; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi782.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi782.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009825; classtype:social-engineering; sid:6009825; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aezx-dsb4ftexcvg7b7fe.z03.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aezx-dsb4ftexcvg7b7fe.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009826; classtype:social-engineering; sid:6009826; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (geminihospitality.in/new/wp-content/Post)"; flow:established,to_server; http.uri; content:"/new/wp-content/Post"; startswith; fast_pattern; http.host; content:"geminihospitality.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009827; classtype:social-engineering; sid:6009827; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (n1.6md4.com/go/54243629)"; flow:established,to_server; http.uri; content:"/go/54243629"; startswith; fast_pattern; http.host; content:"n1.6md4.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009828; classtype:social-engineering; sid:6009828; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-fravlor-biz-vraqnex-drulvik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-fravlor-biz-vraqnex-drulvik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009829; classtype:social-engineering; sid:6009829; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-plarnix-biz-fraltek-drurnok.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-plarnix-biz-fraltek-drurnok.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009830; classtype:social-engineering; sid:6009830; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.padisahbets.co/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.padisahbets.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009831; classtype:social-engineering; sid:6009831; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sweetcandy-kjyf76e5fgiv.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sweetcandy-kjyf76e5fgiv.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009832; classtype:social-engineering; sid:6009832; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abhisahu-infer.github.io/My-first-website)"; flow:established,to_server; http.uri; content:"/My-first-website"; startswith; fast_pattern; http.host; content:"abhisahu-infer.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009833; classtype:social-engineering; sid:6009833; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.f29g.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.f29g.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009834; classtype:social-engineering; sid:6009834; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trueja83bdjshbjhdbjdsdde-e0bmehg3etf2eqc4.z03.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trueja83bdjshbjhdbjdsdde-e0bmehg3etf2eqc4.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009835; classtype:social-engineering; sid:6009835; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (geminihospitality.in/new/wp-content/Post/)"; flow:established,to_server; http.uri; content:"/new/wp-content/Post/"; startswith; fast_pattern; http.host; content:"geminihospitality.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009836; classtype:social-engineering; sid:6009836; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nekofreegateway.dancerblade70.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nekofreegateway.dancerblade70.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009837; classtype:social-engineering; sid:6009837; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17750033.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17750033.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009838; classtype:social-engineering; sid:6009838; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (innovative-pyramid-715701.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"innovative-pyramid-715701.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009839; classtype:social-engineering; sid:6009839; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.https-roblox.cam/users/1106943092/profile/)"; flow:established,to_server; http.uri; content:"/users/1106943092/profile/"; startswith; fast_pattern; http.host; content:"www.https-roblox.cam"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009840; classtype:social-engineering; sid:6009840; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi079.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi079.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009841; classtype:social-engineering; sid:6009841; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4432989893843755838403843984399997777939y3939j.jvjkogjv.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4432989893843755838403843984399997777939y3939j.jvjkogjv.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009842; classtype:social-engineering; sid:6009842; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16150022.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16150022.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009843; classtype:social-engineering; sid:6009843; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (theofficial4me-ux.github.io/instagram)"; flow:established,to_server; http.uri; content:"/instagram"; startswith; fast_pattern; http.host; content:"theofficial4me-ux.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009844; classtype:social-engineering; sid:6009844; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pekinshuho.com/imwy/501.html)"; flow:established,to_server; http.uri; content:"/imwy/501.html"; startswith; fast_pattern; http.host; content:"www.pekinshuho.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009845; classtype:social-engineering; sid:6009845; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.princesleonorvipwebsitesreal.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.princesleonorvipwebsitesreal.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009846; classtype:social-engineering; sid:6009846; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store.workshopcommunitycloud.com/sharedfiles/filedetail/storm_blade/)"; flow:established,to_server; http.uri; content:"/sharedfiles/filedetail/storm_blade/"; startswith; fast_pattern; http.host; content:"store.workshopcommunitycloud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009847; classtype:social-engineering; sid:6009847; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (home-sso-nda-x-en.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"home-sso-nda-x-en.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009848; classtype:social-engineering; sid:6009848; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jprwlnz.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jprwlnz.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009849; classtype:social-engineering; sid:6009849; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (caring-platforms-513881.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"caring-platforms-513881.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009850; classtype:social-engineering; sid:6009850; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (recouvre-574864.com/suivi)"; flow:established,to_server; http.uri; content:"/suivi"; startswith; fast_pattern; http.host; content:"recouvre-574864.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009851; classtype:social-engineering; sid:6009851; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365bet881.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.365bet881.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009852; classtype:social-engineering; sid:6009852; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi127.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"info-resmi127.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009853; classtype:social-engineering; sid:6009853; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dakaiyt.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.dakaiyt.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009854; classtype:social-engineering; sid:6009854; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.cxmvtrp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.cxmvtrp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009855; classtype:social-engineering; sid:6009855; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.195gg195.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.195gg195.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009856; classtype:social-engineering; sid:6009856; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (routinebuddy.com/app.php)"; flow:established,to_server; http.uri; content:"/app.php"; startswith; fast_pattern; http.host; content:"routinebuddy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009857; classtype:social-engineering; sid:6009857; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tokeonpmoket.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.tokeonpmoket.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009858; classtype:social-engineering; sid:6009858; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bet39099.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bet39099.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009859; classtype:social-engineering; sid:6009859; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bdo-vipph.cc/ph/)"; flow:established,to_server; http.uri; content:"/ph/"; startswith; fast_pattern; http.host; content:"bdo-vipph.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009860; classtype:social-engineering; sid:6009860; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazonam.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazonam.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009861; classtype:social-engineering; sid:6009861; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1505ppp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1505ppp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009862; classtype:social-engineering; sid:6009862; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.teams-xu.com/p/fjbd-cbcr/dopofszl)"; flow:established,to_server; http.uri; content:"/p/fjbd-cbcr/dopofszl"; startswith; fast_pattern; http.host; content:"s.teams-xu.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009863; classtype:social-engineering; sid:6009863; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pubg-claims.maxstoday.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pubg-claims.maxstoday.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009864; classtype:social-engineering; sid:6009864; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1665z.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1665z.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009865; classtype:social-engineering; sid:6009865; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.special-win-cash20.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.special-win-cash20.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009866; classtype:social-engineering; sid:6009866; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ldgr-live--us.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ldgr-live--us.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009867; classtype:social-engineering; sid:6009867; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ranameetshop.com/images/cache/index/)"; flow:established,to_server; http.uri; content:"/images/cache/index/"; startswith; fast_pattern; http.host; content:"ranameetshop.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009868; classtype:social-engineering; sid:6009868; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (n1.6md4.com/index.html#/pages/register/register?inviter=54243629&domain=n1.6md4.com&landing=n1.6md4.com)"; flow:established,to_server; http.uri; content:"/index.html#/pages/register/register?inviter=54243629&domain=n1.6md4.com&landing=n1.6md4.com"; startswith; fast_pattern; http.host; content:"n1.6md4.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009869; classtype:social-engineering; sid:6009869; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pruebas-test.space/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pruebas-test.space"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009870; classtype:social-engineering; sid:6009870; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my-spotifymembership.dynv6.net/signin)"; flow:established,to_server; http.uri; content:"/signin"; startswith; fast_pattern; http.host; content:"my-spotifymembership.dynv6.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009871; classtype:social-engineering; sid:6009871; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (invfort.one/id/login)"; flow:established,to_server; http.uri; content:"/id/login"; startswith; fast_pattern; http.host; content:"invfort.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009872; classtype:social-engineering; sid:6009872; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (https--roblox.co/users/272262810/profile)"; flow:established,to_server; http.uri; content:"/users/272262810/profile"; startswith; fast_pattern; http.host; content:"https--roblox.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009873; classtype:social-engineering; sid:6009873; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1615tt.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1615tt.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009874; classtype:social-engineering; sid:6009874; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (megashriragavan79-oss.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"megashriragavan79-oss.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009875; classtype:social-engineering; sid:6009875; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.2365ee.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.2365ee.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009876; classtype:social-engineering; sid:6009876; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gouidekdc.eu.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gouidekdc.eu.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009877; classtype:social-engineering; sid:6009877; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rss2.readles.at/go/y2c4v274/z274x264?label=qo)"; flow:established,to_server; http.uri; content:"/go/y2c4v274/z274x264?label=qo"; startswith; fast_pattern; http.host; content:"rss2.readles.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009878; classtype:social-engineering; sid:6009878; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my-spotifymembership.dynv6.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"my-spotifymembership.dynv6.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009879; classtype:social-engineering; sid:6009879; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi699.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi699.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009880; classtype:social-engineering; sid:6009880; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1665s.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1665s.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009881; classtype:social-engineering; sid:6009881; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (workspaceviewer.com/ftx/page.html)"; flow:established,to_server; http.uri; content:"/ftx/page.html"; startswith; fast_pattern; http.host; content:"workspaceviewer.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009882; classtype:social-engineering; sid:6009882; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1615111999.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1615111999.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009883; classtype:social-engineering; sid:6009883; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17753366.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17753366.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009884; classtype:social-engineering; sid:6009884; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coin_baasee_prologion.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coin_baasee_prologion.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009885; classtype:social-engineering; sid:6009885; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi982.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"info-resmi982.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009886; classtype:social-engineering; sid:6009886; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (recouvre-574864.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"recouvre-574864.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009887; classtype:social-engineering; sid:6009887; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0112576.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0112576.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009888; classtype:social-engineering; sid:6009888; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vdhedheb-etws.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vdhedheb-etws.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009889; classtype:social-engineering; sid:6009889; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi589.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"info-resmi589.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009890; classtype:social-engineering; sid:6009890; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tnqrzpt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tnqrzpt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009891; classtype:social-engineering; sid:6009891; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.smakers-demo.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.smakers-demo.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009892; classtype:social-engineering; sid:6009892; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee6799.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopee6799.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009893; classtype:social-engineering; sid:6009893; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (v35w.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"v35w.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009894; classtype:social-engineering; sid:6009894; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.hvtrxmq.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.hvtrxmq.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009895; classtype:social-engineering; sid:6009895; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1665mm.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1665mm.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009896; classtype:social-engineering; sid:6009896; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflixclone-chi-ten.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflixclone-chi-ten.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009897; classtype:social-engineering; sid:6009897; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15650022.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15650022.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009898; classtype:social-engineering; sid:6009898; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wasel-krane.sibedltd.co/ch101/)"; flow:established,to_server; http.uri; content:"/ch101/"; startswith; fast_pattern; http.host; content:"wasel-krane.sibedltd.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009899; classtype:social-engineering; sid:6009899; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (04jycmgl777u.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"04jycmgl777u.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009900; classtype:social-engineering; sid:6009900; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jprwlzn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jprwlzn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009901; classtype:social-engineering; sid:6009901; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (https-roblox.cam/users/1062657295/profile)"; flow:established,to_server; http.uri; content:"/users/1062657295/profile"; startswith; fast_pattern; http.host; content:"https-roblox.cam"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009902; classtype:social-engineering; sid:6009902; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.csam.in/page/Garenaffteam/x-4page/)"; flow:established,to_server; http.uri; content:"/page/Garenaffteam/x-4page/"; startswith; fast_pattern; http.host; content:"m.csam.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009903; classtype:social-engineering; sid:6009903; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (subsatelital.mylphone-es.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"subsatelital.mylphone-es.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009904; classtype:social-engineering; sid:6009904; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pubg-claims.maxstoday.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pubg-claims.maxstoday.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009905; classtype:social-engineering; sid:6009905; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.czwnplr.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.czwnplr.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009906; classtype:social-engineering; sid:6009906; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ranameetshop.com/images/cache/index/app/index.html?&userid=&ue=)"; flow:established,to_server; http.uri; content:"/images/cache/index/app/index.html?&userid=&ue="; startswith; fast_pattern; http.host; content:"ranameetshop.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009907; classtype:social-engineering; sid:6009907; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (betgaranti.us.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"betgaranti.us.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009908; classtype:social-engineering; sid:6009908; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nop12.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nop12.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009909; classtype:social-engineering; sid:6009909; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.195fff195.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.195fff195.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009910; classtype:social-engineering; sid:6009910; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bvnrqzw.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.bvnrqzw.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009911; classtype:social-engineering; sid:6009911; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pt-shopee034.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pt-shopee034.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009912; classtype:social-engineering; sid:6009912; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16151166.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16151166.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009913; classtype:social-engineering; sid:6009913; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.coin_baasee_prologion.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.coin_baasee_prologion.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009914; classtype:social-engineering; sid:6009914; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1505nnn.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1505nnn.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009915; classtype:social-engineering; sid:6009915; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1615lllll.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1615lllll.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009916; classtype:social-engineering; sid:6009916; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p28c.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p28c.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009917; classtype:social-engineering; sid:6009917; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.uhdclp.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.uhdclp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009918; classtype:social-engineering; sid:6009918; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi877.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"info-resmi877.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009919; classtype:social-engineering; sid:6009919; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1615555777.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1615555777.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009920; classtype:social-engineering; sid:6009920; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1775dddd.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1775dddd.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009921; classtype:social-engineering; sid:6009921; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-fraltek-biz-glornix-slurnok.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-fraltek-biz-glornix-slurnok.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009922; classtype:social-engineering; sid:6009922; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi344.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi344.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009923; classtype:social-engineering; sid:6009923; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mylphone-es.info/?i=qyZBN)"; flow:established,to_server; http.uri; content:"/?i=qyZBN"; startswith; fast_pattern; http.host; content:"mylphone-es.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009924; classtype:social-engineering; sid:6009924; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bayram-promosyonu.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bayram-promosyonu.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009925; classtype:social-engineering; sid:6009925; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whcipring.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whcipring.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009926; classtype:social-engineering; sid:6009926; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ptshopee617.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"ptshopee617.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009927; classtype:social-engineering; sid:6009927; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.localizar-lost.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.localizar-lost.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009928; classtype:social-engineering; sid:6009928; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (geminihospitality.in/new/wp-content/Post/NV6588123/)"; flow:established,to_server; http.uri; content:"/new/wp-content/Post/NV6588123/"; startswith; fast_pattern; http.host; content:"geminihospitality.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009929; classtype:social-engineering; sid:6009929; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (https-roblox.cam/users/14085142931/profile)"; flow:established,to_server; http.uri; content:"/users/14085142931/profile"; startswith; fast_pattern; http.host; content:"https-roblox.cam"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009930; classtype:social-engineering; sid:6009930; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.fqznvpl.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.fqznvpl.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009931; classtype:social-engineering; sid:6009931; rev:1; metadata: signature_severity Major, created_et 2026_05_31, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (despilfarrarian.sbs/webtools/)"; flow:established,to_server; http.uri; content:"/webtools/"; startswith; fast_pattern; http.host; content:"despilfarrarian.sbs"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009932; classtype:social-engineering; sid:6009932; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uam-mx.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uam-mx.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009933; classtype:social-engineering; sid:6009933; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezorrstart.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"trezorrstart.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009934; classtype:social-engineering; sid:6009934; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login-anahuac.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"login-anahuac.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009935; classtype:social-engineering; sid:6009935; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1tecnico-ulisboa-pt.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1tecnico-ulisboa-pt.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009936; classtype:social-engineering; sid:6009936; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (everwlse0fauthh0nllne.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"everwlse0fauthh0nllne.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009937; classtype:social-engineering; sid:6009937; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfmailserver.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfmailserver.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009938; classtype:social-engineering; sid:6009938; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-b74861e268fc40909b4045c6f67be64d.r2.dev/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-b74861e268fc40909b4045c6f67be64d.r2.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009939; classtype:social-engineering; sid:6009939; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uanl-mx.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uanl-mx.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009940; classtype:social-engineering; sid:6009940; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (skhskhdksdh.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"skhskhdksdh.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009941; classtype:social-engineering; sid:6009941; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dsignpost.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dsignpost.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009942; classtype:social-engineering; sid:6009942; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.crese-con-cred-miles.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.crese-con-cred-miles.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009943; classtype:social-engineering; sid:6009943; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.amazonon1.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazonon1.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009944; classtype:social-engineering; sid:6009944; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (synlnsdiriyonuz13414.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"synlnsdiriyonuz13414.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009945; classtype:social-engineering; sid:6009945; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwk.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009946; classtype:social-engineering; sid:6009946; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kpmqvxt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kpmqvxt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009947; classtype:social-engineering; sid:6009947; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kavishkadileepa01.github.io/log-in-to-spotify/)"; flow:established,to_server; http.uri; content:"/log-in-to-spotify/"; startswith; fast_pattern; http.host; content:"kavishkadileepa01.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009948; classtype:social-engineering; sid:6009948; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15658.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15658.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009949; classtype:social-engineering; sid:6009949; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (magalu-figurinhas-br.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"magalu-figurinhas-br.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009950; classtype:social-engineering; sid:6009950; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-ea3ff0f2b4184ecc9525573d4ce574f9.r2.dev/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-ea3ff0f2b4184ecc9525573d4ce574f9.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009951; classtype:social-engineering; sid:6009951; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (niteskin.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"niteskin.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009952; classtype:social-engineering; sid:6009952; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (newdapp-swap.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"newdapp-swap.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009953; classtype:social-engineering; sid:6009953; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (btr1.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"btr1.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009954; classtype:social-engineering; sid:6009954; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maionwakiesmaisfeeb.wasmer.app/store/apps/details)"; flow:established,to_server; http.uri; content:"/store/apps/details"; startswith; fast_pattern; http.host; content:"maionwakiesmaisfeeb.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009955; classtype:social-engineering; sid:6009955; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflixclone-mu-nine.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflixclone-mu-nine.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009956; classtype:social-engineering; sid:6009956; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (15649.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"15649.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009957; classtype:social-engineering; sid:6009957; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pdf-reader.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pdf-reader.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009958; classtype:social-engineering; sid:6009958; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fbshop118.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fbshop118.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009959; classtype:social-engineering; sid:6009959; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.yh9512.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.yh9512.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009960; classtype:social-engineering; sid:6009960; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maxtobit.com/root/con.php/)"; flow:established,to_server; http.uri; content:"/root/con.php/"; startswith; fast_pattern; http.host; content:"maxtobit.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009961; classtype:social-engineering; sid:6009961; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hubspotfy.com/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"hubspotfy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009962; classtype:social-engineering; sid:6009962; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.myprofileroblox.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.myprofileroblox.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009963; classtype:social-engineering; sid:6009963; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (santadam.cloud-ip.cc/ES/AD/auth/)"; flow:established,to_server; http.uri; content:"/ES/AD/auth/"; startswith; fast_pattern; http.host; content:"santadam.cloud-ip.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009964; classtype:social-engineering; sid:6009964; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortmet.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortmet.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009965; classtype:social-engineering; sid:6009965; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwk.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwk.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009966; classtype:social-engineering; sid:6009966; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (client.639783-crypto.com/home/?v=28.72.69)"; flow:established,to_server; http.uri; content:"/home/?v=28.72.69"; startswith; fast_pattern; http.host; content:"client.639783-crypto.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009967; classtype:social-engineering; sid:6009967; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stop.blogbeastit.info/?app_vl=ZYFwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=user@example.com&sui=%7Bsui%7D&fn=&ln=&p=&z=PL-PLNAMERAW-2705-ind7)"; flow:established,to_server; http.uri; content:"/?app_vl=ZYFwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=user@example.com&sui=%7Bsui%7D&fn=&ln=&p=&z=PL-PLNAMERAW-2705-ind7"; startswith; fast_pattern; http.host; content:"stop.blogbeastit.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009968; classtype:social-engineering; sid:6009968; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (soumyaranjanmuduli234-pixel.github.io/netflix-fullstack-portal/)"; flow:established,to_server; http.uri; content:"/netflix-fullstack-portal/"; startswith; fast_pattern; http.host; content:"soumyaranjanmuduli234-pixel.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009969; classtype:social-engineering; sid:6009969; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ugateway.io.vn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ugateway.io.vn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009970; classtype:social-engineering; sid:6009970; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mohsecrespomain.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mohsecrespomain.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009971; classtype:social-engineering; sid:6009971; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usdtu.vip/index/Czm2fD)"; flow:established,to_server; http.uri; content:"/index/Czm2fD"; startswith; fast_pattern; http.host; content:"usdtu.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009972; classtype:social-engineering; sid:6009972; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee2899.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopee2899.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009973; classtype:social-engineering; sid:6009973; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tmxpqvk.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tmxpqvk.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009974; classtype:social-engineering; sid:6009974; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mtqvrpx.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mtqvrpx.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009975; classtype:social-engineering; sid:6009975; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.195666222.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.195666222.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009976; classtype:social-engineering; sid:6009976; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (client.719361-cb.com/home/?v=26.45.50)"; flow:established,to_server; http.uri; content:"/home/?v=26.45.50"; startswith; fast_pattern; http.host; content:"client.719361-cb.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009977; classtype:social-engineering; sid:6009977; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktifkndannaxpaylter.tubersis.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktifkndannaxpaylter.tubersis.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009978; classtype:social-engineering; sid:6009978; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fortwep.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fortwep.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009979; classtype:social-engineering; sid:6009979; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15655.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15655.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009980; classtype:social-engineering; sid:6009980; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mytelstraid.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mytelstraid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009981; classtype:social-engineering; sid:6009981; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (client.738620-cb.com/home/?v=75.65.85)"; flow:established,to_server; http.uri; content:"/home/?v=75.65.85"; startswith; fast_pattern; http.host; content:"client.738620-cb.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009982; classtype:social-engineering; sid:6009982; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (client.582742-crypto.com/home/?v=57.93.78)"; flow:established,to_server; http.uri; content:"/home/?v=57.93.78"; startswith; fast_pattern; http.host; content:"client.582742-crypto.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009983; classtype:social-engineering; sid:6009983; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e-docs.wormeld.com/uHZpFfOB)"; flow:established,to_server; http.uri; content:"/uHZpFfOB"; startswith; fast_pattern; http.host; content:"e-docs.wormeld.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009984; classtype:social-engineering; sid:6009984; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s26z.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"s26z.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009985; classtype:social-engineering; sid:6009985; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortkey.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortkey.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009986; classtype:social-engineering; sid:6009986; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vyego2.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vyego2.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009987; classtype:social-engineering; sid:6009987; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tnplrqz.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tnplrqz.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009988; classtype:social-engineering; sid:6009988; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hubspotfy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hubspotfy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009989; classtype:social-engineering; sid:6009989; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zh-info-leisusports.com/ycmcomny)"; flow:established,to_server; http.uri; content:"/ycmcomny"; startswith; fast_pattern; http.host; content:"zh-info-leisusports.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009990; classtype:social-engineering; sid:6009990; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mijn-bestelling.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mijn-bestelling.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009991; classtype:social-engineering; sid:6009991; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (life-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"life-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009992; classtype:social-engineering; sid:6009992; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreib6otoy5ydndmpdpc7afst4cmpmrrjh37hxfcb3fvx6odgoj3iexu.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreib6otoy5ydndmpdpc7afst4cmpmrrjh37hxfcb3fvx6odgoj3iexu.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009993; classtype:social-engineering; sid:6009993; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fbshop101.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fbshop101.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009994; classtype:social-engineering; sid:6009994; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.plwztnq.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.plwztnq.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009995; classtype:social-engineering; sid:6009995; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0112581.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0112581.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009996; classtype:social-engineering; sid:6009996; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s71y-0j33-mrix.hammad-baig-aermach-co-uk-s-account.workers.dev/aa22e539cea3e27d/)"; flow:established,to_server; http.uri; content:"/aa22e539cea3e27d/"; startswith; fast_pattern; http.host; content:"s71y-0j33-mrix.hammad-baig-aermach-co-uk-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009997; classtype:social-engineering; sid:6009997; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso--ndax-ca--io.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sso--ndax-ca--io.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009998; classtype:social-engineering; sid:6009998; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortnicost.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortnicost.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009999; classtype:social-engineering; sid:6009999; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeetbk511.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopeetbk511.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010000; classtype:social-engineering; sid:6010000; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.twmqxlp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.twmqxlp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010001; classtype:social-engineering; sid:6010001; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m19u.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m19u.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010002; classtype:social-engineering; sid:6010002; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tottalallianceemailsupport.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tottalallianceemailsupport.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010003; classtype:social-engineering; sid:6010003; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15648.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15648.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010004; classtype:social-engineering; sid:6010004; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (damaca.vn/lang/wap/)"; flow:established,to_server; http.uri; content:"/lang/wap/"; startswith; fast_pattern; http.host; content:"damaca.vn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010005; classtype:social-engineering; sid:6010005; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hayatseninleguzel.store/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hayatseninleguzel.store"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010006; classtype:social-engineering; sid:6010006; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-ruby-ten.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-ruby-ten.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010007; classtype:social-engineering; sid:6010007; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instaclone-sigma-one.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instaclone-sigma-one.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010008; classtype:social-engineering; sid:6010008; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-git-05-08-featwebenhancedepthchartwithflipto-60762c-uniswap.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-git-05-08-featwebenhancedepthchartwithflipto-60762c-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010009; classtype:social-engineering; sid:6010009; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1615222000.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1615222000.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010010; classtype:social-engineering; sid:6010010; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kvrdev.ru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kvrdev.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010011; classtype:social-engineering; sid:6010011; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (helpsuitetrezo-portal.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"helpsuitetrezo-portal.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010012; classtype:social-engineering; sid:6010012; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.eizbkc.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.eizbkc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010013; classtype:social-engineering; sid:6010013; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (we-only.statichost.page/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"we-only.statichost.page"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010014; classtype:social-engineering; sid:6010014; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee2899.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopee2899.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010015; classtype:social-engineering; sid:6010015; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.open-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.open-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010016; classtype:social-engineering; sid:6010016; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ofvwrx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ofvwrx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010017; classtype:social-engineering; sid:6010017; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (seal-app-gvgyd.ondigitalocean.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"seal-app-gvgyd.ondigitalocean.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010018; classtype:social-engineering; sid:6010018; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kzqnwpl.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kzqnwpl.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010019; classtype:social-engineering; sid:6010019; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tnkvplz.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tnkvplz.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010020; classtype:social-engineering; sid:6010020; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amznmshs-tlk.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amznmshs-tlk.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010021; classtype:social-engineering; sid:6010021; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (15642.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"15642.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010022; classtype:social-engineering; sid:6010022; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tohuusin.info/?app_vl=Zn9wlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=norynlab@89c7ee1d02f23d413d4b6b0dd215632b69a0.org&sui=%7Bsui%7D&fn=&ln=&p=&z=chnamecl280526con1)"; flow:established,to_server; http.uri; content:"/?app_vl=Zn9wlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=norynlab@89c7ee1d02f23d413d4b6b0dd215632b69a0.org&sui=%7Bsui%7D&fn=&ln=&p=&z=chnamecl280526con1"; startswith; fast_pattern; http.host; content:"tohuusin.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010023; classtype:social-engineering; sid:6010023; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dimrestomsgmain.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dimrestomsgmain.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010024; classtype:social-engineering; sid:6010024; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faq-kucoicom-eng.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"faq-kucoicom-eng.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010025; classtype:social-engineering; sid:6010025; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hayatseninleguzel.store/auth)"; flow:established,to_server; http.uri; content:"/auth"; startswith; fast_pattern; http.host; content:"www.hayatseninleguzel.store"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010026; classtype:social-engineering; sid:6010026; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nkftqh.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nkftqh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010027; classtype:social-engineering; sid:6010027; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (media2.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"media2.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010028; classtype:social-engineering; sid:6010028; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (space.eyeliteglasses.info/ga/click/2-7361859-10-8734-17063-9358-ec3985fbb2-2ad1a93661)"; flow:established,to_server; http.uri; content:"/ga/click/2-7361859-10-8734-17063-9358-ec3985fbb2-2ad1a93661"; startswith; fast_pattern; http.host; content:"space.eyeliteglasses.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010029; classtype:social-engineering; sid:6010029; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stg-santander-santandedev.kinsta.cloud/?page_id=68)"; flow:established,to_server; http.uri; content:"/?page_id=68"; startswith; fast_pattern; http.host; content:"stg-santander-santandedev.kinsta.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010030; classtype:social-engineering; sid:6010030; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortwes.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortwes.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010031; classtype:social-engineering; sid:6010031; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (claims1-esl-org.lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"claims1-esl-org.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010032; classtype:social-engineering; sid:6010032; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kleinanzeigen-deutsch.id83420.info/getpaymentm/233087755/m9)"; flow:established,to_server; http.uri; content:"/getpaymentm/233087755/m9"; startswith; fast_pattern; http.host; content:"kleinanzeigen-deutsch.id83420.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010033; classtype:social-engineering; sid:6010033; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15660.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15660.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010034; classtype:social-engineering; sid:6010034; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kzrpwlq.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kzrpwlq.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010035; classtype:social-engineering; sid:6010035; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15652.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15652.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010036; classtype:social-engineering; sid:6010036; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store.communitycreatestart.shop/workshop/AK47-EternalDecay/)"; flow:established,to_server; http.uri; content:"/workshop/AK47-EternalDecay/"; startswith; fast_pattern; http.host; content:"store.communitycreatestart.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010037; classtype:social-engineering; sid:6010037; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (santaderonlines.nexroth.com/apsess/)"; flow:established,to_server; http.uri; content:"/apsess/"; startswith; fast_pattern; http.host; content:"santaderonlines.nexroth.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010038; classtype:social-engineering; sid:6010038; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwg.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwg.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010039; classtype:social-engineering; sid:6010039; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.agsdtp.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.agsdtp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010040; classtype:social-engineering; sid:6010040; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.adsxxi.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app.adsxxi.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010041; classtype:social-engineering; sid:6010041; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (admin.booking.id9061.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"admin.booking.id9061.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010042; classtype:social-engineering; sid:6010042; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (asjghxv.kxvias.portlandfurnitureonline.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"asjghxv.kxvias.portlandfurnitureonline.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010043; classtype:social-engineering; sid:6010043; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fortgen.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fortgen.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010044; classtype:social-engineering; sid:6010044; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accounts-secure.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"accounts-secure.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010045; classtype:social-engineering; sid:6010045; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kleinanzeigen-deutsch.id83420.info/getpaymentm/206510279/m9)"; flow:established,to_server; http.uri; content:"/getpaymentm/206510279/m9"; startswith; fast_pattern; http.host; content:"kleinanzeigen-deutsch.id83420.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010046; classtype:social-engineering; sid:6010046; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ehay-uk-login-secures-ww6rwgzs.carremovals247.com.au/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ehay-uk-login-secures-ww6rwgzs.carremovals247.com.au"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010047; classtype:social-engineering; sid:6010047; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (covenantoladeji8-beep.github.io/Netflix/)"; flow:established,to_server; http.uri; content:"/Netflix/"; startswith; fast_pattern; http.host; content:"covenantoladeji8-beep.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010048; classtype:social-engineering; sid:6010048; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwg.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010049; classtype:social-engineering; sid:6010049; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (macrenew.wasmer.app/_account)"; flow:established,to_server; http.uri; content:"/_account"; startswith; fast_pattern; http.host; content:"macrenew.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010050; classtype:social-engineering; sid:6010050; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.m18y.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.m18y.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010051; classtype:social-engineering; sid:6010051; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagrarn.cu.ma/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagrarn.cu.ma"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010052; classtype:social-engineering; sid:6010052; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netpayment.eu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netpayment.eu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010053; classtype:social-engineering; sid:6010053; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vljwrt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vljwrt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010054; classtype:social-engineering; sid:6010054; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15050055.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15050055.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010055; classtype:social-engineering; sid:6010055; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (esl-claims1.lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"esl-claims1.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010056; classtype:social-engineering; sid:6010056; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ehay-uk-login-secures-ww6rwgzs.carremovals247.com.au/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f)"; flow:established,to_server; http.uri; content:"/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f"; startswith; fast_pattern; http.host; content:"ehay-uk-login-secures-ww6rwgzs.carremovals247.com.au"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010057; classtype:social-engineering; sid:6010057; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t68z.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"t68z.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010058; classtype:social-engineering; sid:6010058; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tnlpqvk.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tnlpqvk.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010059; classtype:social-engineering; sid:6010059; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prashansa-22.github.io/Amazon-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-clone/"; startswith; fast_pattern; http.host; content:"prashansa-22.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010060; classtype:social-engineering; sid:6010060; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d2x5yrfkfit2z0.cloudfront.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d2x5yrfkfit2z0.cloudfront.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010061; classtype:social-engineering; sid:6010061; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tmqzxvl.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tmqzxvl.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010062; classtype:social-engineering; sid:6010062; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.pl-5891289512.lat/oferta/19145249/gopro-hero-1)"; flow:established,to_server; http.uri; content:"/oferta/19145249/gopro-hero-1"; startswith; fast_pattern; http.host; content:"allegrolokalnie.pl-5891289512.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010063; classtype:social-engineering; sid:6010063; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kleinanzeigen-deutsch.id83420.info/getpaymentm/264770252/m9)"; flow:established,to_server; http.uri; content:"/getpaymentm/264770252/m9"; startswith; fast_pattern; http.host; content:"kleinanzeigen-deutsch.id83420.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010064; classtype:social-engineering; sid:6010064; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwj.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010065; classtype:social-engineering; sid:6010065; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (com--dubai-booking.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"com--dubai-booking.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010066; classtype:social-engineering; sid:6010066; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi127.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi127.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010067; classtype:social-engineering; sid:6010067; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (15664.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"15664.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010068; classtype:social-engineering; sid:6010068; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bagqcn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bagqcn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010069; classtype:social-engineering; sid:6010069; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwh.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwh.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010070; classtype:social-engineering; sid:6010070; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fortchecktop.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fortchecktop.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010071; classtype:social-engineering; sid:6010071; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tmqprvx.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tmqprvx.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010072; classtype:social-engineering; sid:6010072; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mexicounidosorteos.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mexicounidosorteos.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010073; classtype:social-engineering; sid:6010073; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.bet365china-net.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.bet365china-net.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010074; classtype:social-engineering; sid:6010074; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.nextmegamart.fun/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.nextmegamart.fun"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010075; classtype:social-engineering; sid:6010075; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (citoesdro0.azurewebsites.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"citoesdro0.azurewebsites.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010076; classtype:social-engineering; sid:6010076; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wetransfer-app.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wetransfer-app.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010077; classtype:social-engineering; sid:6010077; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p28d.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p28d.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010078; classtype:social-engineering; sid:6010078; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.amznmshs-tlk.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amznmshs-tlk.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010079; classtype:social-engineering; sid:6010079; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (location-lost.info/fhn)"; flow:established,to_server; http.uri; content:"/fhn"; startswith; fast_pattern; http.host; content:"location-lost.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010080; classtype:social-engineering; sid:6010080; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fnstash.lol/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fnstash.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010081; classtype:social-engineering; sid:6010081; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (airbnbclone-jrg8daobo-yusef-mohamed.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"airbnbclone-jrg8daobo-yusef-mohamed.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010082; classtype:social-engineering; sid:6010082; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fojsv.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.fojsv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010083; classtype:social-engineering; sid:6010083; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (k69d.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"k69d.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010084; classtype:social-engineering; sid:6010084; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (unidosconmexicossorteos.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"unidosconmexicossorteos.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010085; classtype:social-engineering; sid:6010085; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi877.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi877.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010086; classtype:social-engineering; sid:6010086; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwj.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwj.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010087; classtype:social-engineering; sid:6010087; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hotflirtoffer4.com/de/de_fourthMultiStep_blue_120723)"; flow:established,to_server; http.uri; content:"/de/de_fourthMultiStep_blue_120723"; startswith; fast_pattern; http.host; content:"hotflirtoffer4.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010088; classtype:social-engineering; sid:6010088; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (edfdc0fa5e2ae6e3c6d7156f3b2ce00c.cdn.bubble.io/f1679644455398x630943732016925300/webmailf.html)"; flow:established,to_server; http.uri; content:"/f1679644455398x630943732016925300/webmailf.html"; startswith; fast_pattern; http.host; content:"edfdc0fa5e2ae6e3c6d7156f3b2ce00c.cdn.bubble.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010089; classtype:social-engineering; sid:6010089; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15670.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15670.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010090; classtype:social-engineering; sid:6010090; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loss.blogbeastit.info/?app_vl=ZYFwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=solelx@fc6ed5fae4a56ff9909b3bbb3f96e465a2a5.com&sui=%7Bsui%7D&fn=Kateryna&ln=Morawik&p=&z=PLNAMERAW-2905-digi9)"; flow:established,to_server; http.uri; content:"/?app_vl=ZYFwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=solelx@fc6ed5fae4a56ff9909b3bbb3f96e465a2a5.com&sui=%7Bsui%7D&fn=Kateryna&ln=Morawik&p=&z=PLNAMERAW-2905-digi9"; startswith; fast_pattern; http.host; content:"loss.blogbeastit.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010091; classtype:social-engineering; sid:6010091; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adobeadcrobatsign.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"adobeadcrobatsign.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010092; classtype:social-engineering; sid:6010092; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.buenosayrestec.com.ar/home/Trustit/)"; flow:established,to_server; http.uri; content:"/home/Trustit/"; startswith; fast_pattern; http.host; content:"www.buenosayrestec.com.ar"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010093; classtype:social-engineering; sid:6010093; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (elevation.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"elevation.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010094; classtype:social-engineering; sid:6010094; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortoscore.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortoscore.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010095; classtype:social-engineering; sid:6010095; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coinmarketcaa.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coinmarketcaa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010096; classtype:social-engineering; sid:6010096; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazonqn.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazonqn.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010097; classtype:social-engineering; sid:6010097; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.betgaranti.us.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.betgaranti.us.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010098; classtype:social-engineering; sid:6010098; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (h21a.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"h21a.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010099; classtype:social-engineering; sid:6010099; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortgg.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortgg.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010100; classtype:social-engineering; sid:6010100; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortweg.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortweg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010101; classtype:social-engineering; sid:6010101; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.027saibo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.027saibo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010102; classtype:social-engineering; sid:6010102; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ameer-hammza.github.io/netflix-clone-practice)"; flow:established,to_server; http.uri; content:"/netflix-clone-practice"; startswith; fast_pattern; http.host; content:"ameer-hammza.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010103; classtype:social-engineering; sid:6010103; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0112573.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0112573.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010104; classtype:social-engineering; sid:6010104; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hgaxz.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hgaxz.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010105; classtype:social-engineering; sid:6010105; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (safari.spahotel.guru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"safari.spahotel.guru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010106; classtype:social-engineering; sid:6010106; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (crese-con-cred-miles.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"crese-con-cred-miles.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010107; classtype:social-engineering; sid:6010107; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (search-flyndphone.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"search-flyndphone.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010108; classtype:social-engineering; sid:6010108; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fbshop161.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fbshop161.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010109; classtype:social-engineering; sid:6010109; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (claims2-esl.lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"claims2-esl.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010110; classtype:social-engineering; sid:6010110; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (244eac011af63a9080fb074ee.s3.eu-central-1.amazonaws.com/c5a9eb789.html)"; flow:established,to_server; http.uri; content:"/c5a9eb789.html"; startswith; fast_pattern; http.host; content:"244eac011af63a9080fb074ee.s3.eu-central-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010111; classtype:social-engineering; sid:6010111; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (w33onm9q.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"w33onm9q.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010112; classtype:social-engineering; sid:6010112; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ladgr-live-hub.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ladgr-live-hub.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010113; classtype:social-engineering; sid:6010113; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fbshop711.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fbshop711.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010114; classtype:social-engineering; sid:6010114; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e-docs.wormeld.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639158538078037919.ZDJlNmZmZjUtMDNlZS00NzRiLWI2MjQtYjEzMjUyYmM1MzhmODYxN2NkOTAtMDM1ZS00MDMxLWE1NzQtZjA0MjRmMGY2ZTQz&ui_locales=en-US&mkt=en-US&client-request-id=d7a661ce-d3b7-4f7e-a965-971c6914c01b&state=GapoXU5PEk3GThPdWaONEcumiZ4JeRb3161-bPblfTFvfkkNbJPxJH6DFCsZ0uuXviVh8U3MOYNFHLIOCrXEoncr315GwoTrS3gJHcikscW-YPYZmEhFa6-Mi4x7HocZRhoMeqv1tuUpNr6n5P5Bq1xPUdzykqmYzYS9DNlpgNpVVfChubABmwGsFznEVk0a_5FmtH_FzLLb4nuRdxVSy3Y9y0wJtqZPE16PQCBGKgLQfOScq8WFBi6jWIIjKvUK4XEhvMDN2RGMW3Gn7GLbZ219HN2Oxddm2sU4H7rvBysE0al3X2Z8YgtYeVnc7t4OvMKqk966aQfLtHhLyANaGyKK78TilJYtQ4EoS-aAWpWAZMVSbIDgs1AXcpWQrE0AKClLpKMqEPIPWdXqejmDmGrUqFN-_BZ_d00f7Jv_I3A&x-client-SKU=ID_NET8_0&x-client-ver=8.14.0.0)"; flow:established,to_server; http.uri; content:"/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639158538078037919.ZDJlNmZmZjUtMDNlZS00NzRiLWI2MjQtYjEzMjUyYmM1MzhmODYxN2NkOTAtMDM1ZS00MDMxLWE1NzQtZjA0MjRmMGY2ZTQz&ui_locales=en-US&mkt=en-US&client-request-id=d7a661ce-d3b7-4f7e-a965-971c6914c01b&state=GapoXU5PEk3GThPdWaONEcumiZ4JeRb3161-bPblfTFvfkkNbJPxJH6DFCsZ0uuXviVh8U3MOYNFHLIOCrXEoncr315GwoTrS3gJHcikscW-YPYZmEhFa6-Mi4x7HocZRhoMeqv1tuUpNr6n5P5Bq1xPUdzykqmYzYS9DNlpgNpVVfChubABmwGsFznEVk0a_5FmtH_FzLLb4nuRdxVSy3Y9y0wJtqZPE16PQCBGKgLQfOScq8WFBi6jWIIjKvUK4XEhvMDN2RGMW3Gn7GLbZ219HN2Oxddm2sU4H7rvBysE0al3X2Z8YgtYeVnc7t4OvMKqk966aQfLtHhLyANaGyKK78TilJYtQ4EoS-aAWpWAZMVSbIDgs1AXcpWQrE0AKClLpKMqEPIPWdXqejmDmGrUqFN-_BZ_d00f7Jv_I3A&x-client-SKU=ID_NET8_0&x-client-ver=8.14.0.0"; startswith; fast_pattern; http.host; content:"e-docs.wormeld.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010115; classtype:social-engineering; sid:6010115; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (scotiabookingsecured-booking.bolt.host/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"scotiabookingsecured-booking.bolt.host"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010116; classtype:social-engineering; sid:6010116; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (43.165.174.250/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"43.165.174.250"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010117; classtype:social-engineering; sid:6010117; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (r4wp8kv.hair/9ncr9hdj/0QSA9q/37untY)"; flow:established,to_server; http.uri; content:"/9ncr9hdj/0QSA9q/37untY"; startswith; fast_pattern; http.host; content:"r4wp8kv.hair"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010118; classtype:social-engineering; sid:6010118; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zamowienie216.lat/o/hxu17/1769963912159#selectedbank9)"; flow:established,to_server; http.uri; content:"/o/hxu17/1769963912159#selectedbank9"; startswith; fast_pattern; http.host; content:"zamowienie216.lat"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010119; classtype:social-engineering; sid:6010119; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aether-marigold-quench-bracket.s3.us-east-2.amazonaws.com/j21taLDpwOxPlN?email=redacted@abuse.ionos.com)"; flow:established,to_server; http.uri; content:"/j21taLDpwOxPlN?email=redacted@abuse.ionos.com"; startswith; fast_pattern; http.host; content:"aether-marigold-quench-bracket.s3.us-east-2.amazonaws.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010120; classtype:social-engineering; sid:6010120; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ue2wgw.sbs/o/hxu17/1769963912159#selectedbank9)"; flow:established,to_server; http.uri; content:"/o/hxu17/1769963912159#selectedbank9"; startswith; fast_pattern; http.host; content:"ue2wgw.sbs"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010121; classtype:social-engineering; sid:6010121; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vz7qxn.cfd/o/hxu17/1769963912159#selectedbank9)"; flow:established,to_server; http.uri; content:"/o/hxu17/1769963912159#selectedbank9"; startswith; fast_pattern; http.host; content:"vz7qxn.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010122; classtype:social-engineering; sid:6010122; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ehay-uk-login-secures-ww7rwgzs.carremovals247.com.au/cgi-sys/suspendedpage.cgi)"; flow:established,to_server; http.uri; content:"/cgi-sys/suspendedpage.cgi"; startswith; fast_pattern; http.host; content:"ehay-uk-login-secures-ww7rwgzs.carremovals247.com.au"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010123; classtype:social-engineering; sid:6010123; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (startledegrapp.ghost.io/live-app/)"; flow:established,to_server; http.uri; content:"/live-app/"; startswith; fast_pattern; http.host; content:"startledegrapp.ghost.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010124; classtype:social-engineering; sid:6010124; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.wkaeqe.cc/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.wkaeqe.cc"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010125; classtype:social-engineering; sid:6010125; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (seoma.ru/local/components/promo//red/en.html?eta=redacted@abuse.ionos.com)"; flow:established,to_server; http.uri; content:"/local/components/promo//red/en.html?eta=redacted@abuse.ionos.com"; startswith; fast_pattern; http.host; content:"seoma.ru"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010126; classtype:social-engineering; sid:6010126; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (z9vgtm.cfd/o/hxu17/1769963912159#selectedbank9)"; flow:established,to_server; http.uri; content:"/o/hxu17/1769963912159#selectedbank9"; startswith; fast_pattern; http.host; content:"z9vgtm.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010127; classtype:social-engineering; sid:6010127; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (45tgfrt-ggg3-o04.sfo3.digitaloceanspaces.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"45tgfrt-ggg3-o04.sfo3.digitaloceanspaces.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010128; classtype:social-engineering; sid:6010128; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support-bridge.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"support-bridge.zapier.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010129; classtype:social-engineering; sid:6010129; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tmzqrvxpln.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tmzqrvxpln.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010130; classtype:social-engineering; sid:6010130; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ptshopee445.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"ptshopee445.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010131; classtype:social-engineering; sid:6010131; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mipanaderiaca.com/about-us/)"; flow:established,to_server; http.uri; content:"/about-us/"; startswith; fast_pattern; http.host; content:"www.mipanaderiaca.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010132; classtype:social-engineering; sid:6010132; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (financialdept1.de/?r=9c508ec1-53cf-4223-8afa-9870f7bbbcf4)"; flow:established,to_server; http.uri; content:"/?r=9c508ec1-53cf-4223-8afa-9870f7bbbcf4"; startswith; fast_pattern; http.host; content:"financialdept1.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010133; classtype:social-engineering; sid:6010133; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bb7765.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bb7765.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010134; classtype:social-engineering; sid:6010134; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.vjasqs.cc/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.vjasqs.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010135; classtype:social-engineering; sid:6010135; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hadiahshopee-indonesia.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.hadiahshopee-indonesia.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010136; classtype:social-engineering; sid:6010136; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.exchange-microsoft.com/?session_token=JBekNvo)"; flow:established,to_server; http.uri; content:"/?session_token=JBekNvo"; startswith; fast_pattern; http.host; content:"www.exchange-microsoft.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010137; classtype:social-engineering; sid:6010137; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usa-mettmssak-s0inin.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"usa-mettmssak-s0inin.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010138; classtype:social-engineering; sid:6010138; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.hthhrp.help/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.hthhrp.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010139; classtype:social-engineering; sid:6010139; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.plzqtrmxvn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.plzqtrmxvn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010140; classtype:social-engineering; sid:6010140; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (woord.worksinc.app/verif.php)"; flow:established,to_server; http.uri; content:"/verif.php"; startswith; fast_pattern; http.host; content:"woord.worksinc.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010141; classtype:social-engineering; sid:6010141; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (penguinwalkalone-create.github.io/Instagram.)"; flow:established,to_server; http.uri; content:"/Instagram."; startswith; fast_pattern; http.host; content:"penguinwalkalone-create.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010142; classtype:social-engineering; sid:6010142; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hfczqs.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hfczqs.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010143; classtype:social-engineering; sid:6010143; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cloudinfolibrary.com/reports/hpe-insights313download.jsp)"; flow:established,to_server; http.uri; content:"/reports/hpe-insights313download.jsp"; startswith; fast_pattern; http.host; content:"cloudinfolibrary.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010144; classtype:social-engineering; sid:6010144; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.fycuqy.help/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.fycuqy.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010145; classtype:social-engineering; sid:6010145; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (syncethernet.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"syncethernet.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010146; classtype:social-engineering; sid:6010146; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ketuatoto.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ketuatoto.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010147; classtype:social-engineering; sid:6010147; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.cznplwr.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.cznplwr.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010148; classtype:social-engineering; sid:6010148; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (11.gu1gu1.ccwu.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"11.gu1gu1.ccwu.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010149; classtype:social-engineering; sid:6010149; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (z2whjt.casa/o/hxu17/1769963912159#selectedbank9)"; flow:established,to_server; http.uri; content:"/o/hxu17/1769963912159#selectedbank9"; startswith; fast_pattern; http.host; content:"z2whjt.casa"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010150; classtype:social-engineering; sid:6010150; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.lvqtrmx.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.lvqtrmx.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010151; classtype:social-engineering; sid:6010151; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9839365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9839365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010152; classtype:social-engineering; sid:6010152; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.kracuk.cc/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.kracuk.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010153; classtype:social-engineering; sid:6010153; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ptshopee617.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ptshopee617.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010154; classtype:social-engineering; sid:6010154; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (globalmedia.lk/www.made-in-china.com/index.html)"; flow:established,to_server; http.uri; content:"/www.made-in-china.com/index.html"; startswith; fast_pattern; http.host; content:"globalmedia.lk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010155; classtype:social-engineering; sid:6010155; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.dokxme.click/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.dokxme.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010156; classtype:social-engineering; sid:6010156; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (swisscargopro.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"swisscargopro.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010157; classtype:social-engineering; sid:6010157; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netbnk-sb1ab.com/contents/pages/wpl010101E/i010101CT/clientviews/DI01010240)"; flow:established,to_server; http.uri; content:"/contents/pages/wpl010101E/i010101CT/clientviews/DI01010240"; startswith; fast_pattern; http.host; content:"netbnk-sb1ab.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010158; classtype:social-engineering; sid:6010158; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktifkandanapayltter.amormarch.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktifkandanapayltter.amormarch.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010159; classtype:social-engineering; sid:6010159; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365bet007.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.365bet007.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010160; classtype:social-engineering; sid:6010160; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xqtrplnzvm.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xqtrplnzvm.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010161; classtype:social-engineering; sid:6010161; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.xavxnq.help/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.xavxnq.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010162; classtype:social-engineering; sid:6010162; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sourcing10.com/.cgi/54321.html)"; flow:established,to_server; http.uri; content:"/.cgi/54321.html"; startswith; fast_pattern; http.host; content:"sourcing10.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010163; classtype:social-engineering; sid:6010163; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vrtxqplznm.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.vrtxqplznm.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010164; classtype:social-engineering; sid:6010164; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-clone-taupe-two.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-taupe-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010165; classtype:social-engineering; sid:6010165; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tvplxrmqzn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tvplxrmqzn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010166; classtype:social-engineering; sid:6010166; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.surrwa.buzz/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.surrwa.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010167; classtype:social-engineering; sid:6010167; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (topball-yes-football.games/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"topball-yes-football.games"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010168; classtype:social-engineering; sid:6010168; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imto-ken.rest/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"imto-ken.rest"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010169; classtype:social-engineering; sid:6010169; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-drulnex-biz-plornik-vromtek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-drulnex-biz-plornik-vromtek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010170; classtype:social-engineering; sid:6010170; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mypost.cpogmv.buzz/au/mon1/)"; flow:established,to_server; http.uri; content:"/au/mon1/"; startswith; fast_pattern; http.host; content:"mypost.cpogmv.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010171; classtype:social-engineering; sid:6010171; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiflcz4b7rnhk5r3w52drlysvolzauhvz4kltcq6qpzfzdajyudqm4.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiflcz4b7rnhk5r3w52drlysvolzauhvz4kltcq6qpzfzdajyudqm4.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010172; classtype:social-engineering; sid:6010172; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ufzwqk.wasmer.app/hostedbyinfocast)"; flow:established,to_server; http.uri; content:"/hostedbyinfocast"; startswith; fast_pattern; http.host; content:"ufzwqk.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010173; classtype:social-engineering; sid:6010173; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.sufsit.help/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.sufsit.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010174; classtype:social-engineering; sid:6010174; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gebyar-shopee20.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gebyar-shopee20.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010175; classtype:social-engineering; sid:6010175; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hostpoint-update.servepics.com/hostpoint/)"; flow:established,to_server; http.uri; content:"/hostpoint/"; startswith; fast_pattern; http.host; content:"hostpoint-update.servepics.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010176; classtype:social-engineering; sid:6010176; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.truttwalet.work/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.truttwalet.work"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010177; classtype:social-engineering; sid:6010177; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gunceladresler.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gunceladresler.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010178; classtype:social-engineering; sid:6010178; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.galabet-guncel-resmigiris.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.galabet-guncel-resmigiris.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010179; classtype:social-engineering; sid:6010179; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (exodus--web3--help.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"exodus--web3--help.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010180; classtype:social-engineering; sid:6010180; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hasilundianresmishopee.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hasilundianresmishopee.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010181; classtype:social-engineering; sid:6010181; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (claims1-esl.lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"claims1-esl.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010182; classtype:social-engineering; sid:6010182; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365bet-go.bet/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"365bet-go.bet"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010183; classtype:social-engineering; sid:6010183; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsappsemsalvarcontato.com.br/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsappsemsalvarcontato.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010184; classtype:social-engineering; sid:6010184; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (client.612947-crypto.com/home/?v=28.98.75)"; flow:established,to_server; http.uri; content:"/home/?v=28.98.75"; startswith; fast_pattern; http.host; content:"client.612947-crypto.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010185; classtype:social-engineering; sid:6010185; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jlwpr-ie.cc/track)"; flow:established,to_server; http.uri; content:"/track"; startswith; fast_pattern; http.host; content:"dpd.jlwpr-ie.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010186; classtype:social-engineering; sid:6010186; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-slurnik-biz-vroltek-plavrix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-slurnik-biz-vroltek-plavrix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010187; classtype:social-engineering; sid:6010187; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1615999111.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1615999111.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010188; classtype:social-engineering; sid:6010188; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1yhxpzqnpg9uhb2.s3-website-us-east-1.amazonaws.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1yhxpzqnpg9uhb2.s3-website-us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010189; classtype:social-engineering; sid:6010189; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mypost.tgvozk.buzz/au/kzmc)"; flow:established,to_server; http.uri; content:"/au/kzmc"; startswith; fast_pattern; http.host; content:"mypost.tgvozk.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010190; classtype:social-engineering; sid:6010190; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bvnqzrt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.bvnqzrt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010191; classtype:social-engineering; sid:6010191; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (link-dana-sekarang.dana-terbaru.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"link-dana-sekarang.dana-terbaru.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010192; classtype:social-engineering; sid:6010192; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.betrrrr.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.betrrrr.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010193; classtype:social-engineering; sid:6010193; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.galabet-haziran.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.galabet-haziran.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010194; classtype:social-engineering; sid:6010194; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netbnk-sb1aa.com/contents/pages/wpl010101E/i010101CT/clientviews/DI01010240)"; flow:established,to_server; http.uri; content:"/contents/pages/wpl010101E/i010101CT/clientviews/DI01010240"; startswith; fast_pattern; http.host; content:"netbnk-sb1aa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010195; classtype:social-engineering; sid:6010195; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sign.pensia.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sign.pensia.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010196; classtype:social-engineering; sid:6010196; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (15636.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"15636.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010197; classtype:social-engineering; sid:6010197; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vz7qxn.cfd/o/hxu17/1769963912159#selectedbank9)"; flow:established,to_server; http.uri; content:"/o/hxu17/1769963912159#selectedbank9"; startswith; fast_pattern; http.host; content:"vz7qxn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010198; classtype:social-engineering; sid:6010198; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dnallyanx-newfromn.fredped.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dnallyanx-newfromn.fredped.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010199; classtype:social-engineering; sid:6010199; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.trusttwallet.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.trusttwallet.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010200; classtype:social-engineering; sid:6010200; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pncksw44.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pncksw44.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010201; classtype:social-engineering; sid:6010201; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.qzktsj.click/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.qzktsj.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010202; classtype:social-engineering; sid:6010202; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vrqtplxnmz.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.vrqtplxnmz.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010203; classtype:social-engineering; sid:6010203; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (high-journey-042246.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"high-journey-042246.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010204; classtype:social-engineering; sid:6010204; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqtmzql.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqtmzql.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010205; classtype:social-engineering; sid:6010205; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xvnplzrmqt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xvnplzrmqt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010206; classtype:social-engineering; sid:6010206; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (channelhub.online/m0ae5e22epce2746dbpa266e6a2k8cd2460b.html)"; flow:established,to_server; http.uri; content:"/m0ae5e22epce2746dbpa266e6a2k8cd2460b.html"; startswith; fast_pattern; http.host; content:"channelhub.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010207; classtype:social-engineering; sid:6010207; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.tolweb.click/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.tolweb.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010208; classtype:social-engineering; sid:6010208; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nitinbhas001.github.io/HTML-Tutorial)"; flow:established,to_server; http.uri; content:"/HTML-Tutorial"; startswith; fast_pattern; http.host; content:"nitinbhas001.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010209; classtype:social-engineering; sid:6010209; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netbnk-sb1ad.com/contents/pages/wpl010101E/i010101CT/clientviews/DI01010240)"; flow:established,to_server; http.uri; content:"/contents/pages/wpl010101E/i010101CT/clientviews/DI01010240"; startswith; fast_pattern; http.host; content:"netbnk-sb1ad.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010210; classtype:social-engineering; sid:6010210; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.padisahbet2.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.padisahbet2.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010211; classtype:social-engineering; sid:6010211; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.truttwalet.art/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.truttwalet.art"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010212; classtype:social-engineering; sid:6010212; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365best2.com/home)"; flow:established,to_server; http.uri; content:"/home"; startswith; fast_pattern; http.host; content:"365best2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010213; classtype:social-engineering; sid:6010213; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tnqpzvr.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tnqpzvr.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010214; classtype:social-engineering; sid:6010214; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kzwxpln.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kzwxpln.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010215; classtype:social-engineering; sid:6010215; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (identity-google.info/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&dsh=S-1391434002%3A1780312270343217&followup=https%3A%2F%2Faccounts.google.com%2F&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2PatgkI6aIEcIWchuNGJmgKfHIAAu4b2ToZ89mMJbxFiVUjLuMu4ZzgCHEdd8gvn9_ecwGDQA3g)"; flow:established,to_server; http.uri; content:"/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&dsh=S-1391434002%3A1780312270343217&followup=https%3A%2F%2Faccounts.google.com%2F&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2PatgkI6aIEcIWchuNGJmgKfHIAAu4b2ToZ89mMJbxFiVUjLuMu4ZzgCHEdd8gvn9_ecwGDQA3g"; startswith; fast_pattern; http.host; content:"identity-google.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010216; classtype:social-engineering; sid:6010216; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.galabet1-giris.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.galabet1-giris.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010217; classtype:social-engineering; sid:6010217; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.frttib.help/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.frttib.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010218; classtype:social-engineering; sid:6010218; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.lztlxx.cc/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.lztlxx.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010219; classtype:social-engineering; sid:6010219; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (15596.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"15596.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010220; classtype:social-engineering; sid:6010220; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ldrmrdftr.esaic4.workers.dev//)"; flow:established,to_server; http.uri; content:"//"; startswith; fast_pattern; http.host; content:"ldrmrdftr.esaic4.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010221; classtype:social-engineering; sid:6010221; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mztrqplxvn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mztrqplxvn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010222; classtype:social-engineering; sid:6010222; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.hklhfu.cc/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.hklhfu.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010223; classtype:social-engineering; sid:6010223; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hyperequipments.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hyperequipments.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010224; classtype:social-engineering; sid:6010224; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pt-shopee034.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pt-shopee034.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010225; classtype:social-engineering; sid:6010225; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mxqtplrzvn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mxqtplrzvn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010226; classtype:social-engineering; sid:6010226; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mzqrvtplxn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mzqrvtplxn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010227; classtype:social-engineering; sid:6010227; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mzqtrvplxn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mzqtrvplxn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010228; classtype:social-engineering; sid:6010228; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.uzznou.help/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.uzznou.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010229; classtype:social-engineering; sid:6010229; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.adssh.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app.adssh.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010230; classtype:social-engineering; sid:6010230; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (newgamingapi.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"newgamingapi.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010231; classtype:social-engineering; sid:6010231; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (11.gu1gu1.ccwu.cc/retail/geniusbar/)"; flow:established,to_server; http.uri; content:"/retail/geniusbar/"; startswith; fast_pattern; http.host; content:"11.gu1gu1.ccwu.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010232; classtype:social-engineering; sid:6010232; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mznrqtxplv.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mznrqtxplv.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010233; classtype:social-engineering; sid:6010233; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (download-updateledger.com/?acc=UC-wARhaZ6ak1D_rW2ez61wqsx6eZgm1ZQFON08qw2p7Mq9WgrKSDAZ3sCc-TpSslzZyvJX5kxGLz-NNoKmZb9jBDXLXERzFLK2aUbdN9nAimhjhGqpngkr4gU3m4K4U4lDEwjpxroS0lkwO4A_6LhLXcyq4ghdvVSyUdzcD7ZbLlYgRQCPc8FzZ04M2XsvsnBG2NbBuFbtcyI11wsS9TDhX7iJNQ6oZILynzaT9NGPHQWliwplGQMY7ziLIr39atjulB6aC1hjNTNMGcJyjk_0l6qAD3gOqOl8qvrfq4eSayDsmHgVToKWFhzQTZaWyjDrOdZniZjxqPftr7hLuOg==&view=lg)"; flow:established,to_server; http.uri; content:"/?acc=UC-wARhaZ6ak1D_rW2ez61wqsx6eZgm1ZQFON08qw2p7Mq9WgrKSDAZ3sCc-TpSslzZyvJX5kxGLz-NNoKmZb9jBDXLXERzFLK2aUbdN9nAimhjhGqpngkr4gU3m4K4U4lDEwjpxroS0lkwO4A_6LhLXcyq4ghdvVSyUdzcD7ZbLlYgRQCPc8FzZ04M2XsvsnBG2NbBuFbtcyI11wsS9TDhX7iJNQ6oZILynzaT9NGPHQWliwplGQMY7ziLIr39atjulB6aC1hjNTNMGcJyjk_0l6qAD3gOqOl8qvrfq4eSayDsmHgVToKWFhzQTZaWyjDrOdZniZjxqPftr7hLuOg==&view=lg"; startswith; fast_pattern; http.host; content:"download-updateledger.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010234; classtype:social-engineering; sid:6010234; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-gamma.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-gamma.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010235; classtype:social-engineering; sid:6010235; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.qtrplzmxvn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.qtrplzmxvn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010236; classtype:social-engineering; sid:6010236; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.xupdygxtxq.one/uqjmw)"; flow:established,to_server; http.uri; content:"/uqjmw"; startswith; fast_pattern; http.host; content:"usps.xupdygxtxq.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010237; classtype:social-engineering; sid:6010237; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.team-cz.com/p/fhtb-mrgw/nwjrmgwv/)"; flow:established,to_server; http.uri; content:"/p/fhtb-mrgw/nwjrmgwv/"; startswith; fast_pattern; http.host; content:"s.team-cz.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010238; classtype:social-engineering; sid:6010238; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (u20n.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"u20n.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010239; classtype:social-engineering; sid:6010239; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwz.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingwz.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010240; classtype:social-engineering; sid:6010240; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-delta.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-delta.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010241; classtype:social-engineering; sid:6010241; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hcxr-42552.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hcxr-42552.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010242; classtype:social-engineering; sid:6010242; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blockchaincomwalletus.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"blockchaincomwalletus.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010243; classtype:social-engineering; sid:6010243; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (exoreuswalle-ot.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"exoreuswalle-ot.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010244; classtype:social-engineering; sid:6010244; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (n2v3d.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"n2v3d.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010245; classtype:social-engineering; sid:6010245; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xymnsy.xnncal.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xymnsy.xnncal.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010246; classtype:social-engineering; sid:6010246; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (penguinwalkalone-create.github.io/insta)"; flow:established,to_server; http.uri; content:"/insta"; startswith; fast_pattern; http.host; content:"penguinwalkalone-create.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010247; classtype:social-engineering; sid:6010247; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (unicredit-login.one/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"unicredit-login.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010248; classtype:social-engineering; sid:6010248; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f-binance.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f-binance.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010249; classtype:social-engineering; sid:6010249; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (especially.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"especially.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010250; classtype:social-engineering; sid:6010250; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.klwvod.cc/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.klwvod.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010251; classtype:social-engineering; sid:6010251; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qel4l1sz120i8zo.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qel4l1sz120i8zo.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010252; classtype:social-engineering; sid:6010252; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazongroup44.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazongroup44.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010253; classtype:social-engineering; sid:6010253; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sumit-7500.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"sumit-7500.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010254; classtype:social-engineering; sid:6010254; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mypost.sunocz.click/au/kzmc)"; flow:established,to_server; http.uri; content:"/au/kzmc"; startswith; fast_pattern; http.host; content:"mypost.sunocz.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010255; classtype:social-engineering; sid:6010255; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (woord.worksinc.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"woord.worksinc.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010256; classtype:social-engineering; sid:6010256; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dev.nova-host.store/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dev.nova-host.store"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010257; classtype:social-engineering; sid:6010257; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mxtrqplzvn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mxtrqplzvn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010258; classtype:social-engineering; sid:6010258; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (static-hub.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"static-hub.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010259; classtype:social-engineering; sid:6010259; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.gnwrzpq.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.gnwrzpq.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010260; classtype:social-engineering; sid:6010260; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tplqvrxzmn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tplqvrxzmn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010261; classtype:social-engineering; sid:6010261; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (promohadiah44.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"promohadiah44.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010262; classtype:social-engineering; sid:6010262; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zsdr.pages.dev/today/camp/)"; flow:established,to_server; http.uri; content:"/today/camp/"; startswith; fast_pattern; http.host; content:"zsdr.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010263; classtype:social-engineering; sid:6010263; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yuuhfky.com/spoo/sport/web/add.php)"; flow:established,to_server; http.uri; content:"/spoo/sport/web/add.php"; startswith; fast_pattern; http.host; content:"yuuhfky.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010264; classtype:social-engineering; sid:6010264; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (400.iphonekouliu.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"400.iphonekouliu.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010265; classtype:social-engineering; sid:6010265; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (woord.worksinc.app/alert.php)"; flow:established,to_server; http.uri; content:"/alert.php"; startswith; fast_pattern; http.host; content:"woord.worksinc.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010266; classtype:social-engineering; sid:6010266; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mydpd.jntshh.cc/secure-gb)"; flow:established,to_server; http.uri; content:"/secure-gb"; startswith; fast_pattern; http.host; content:"mydpd.jntshh.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010267; classtype:social-engineering; sid:6010267; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.lhztll.click/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.lhztll.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010268; classtype:social-engineering; sid:6010268; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (haytemmoso-del.github.io/instagram)"; flow:established,to_server; http.uri; content:"/instagram"; startswith; fast_pattern; http.host; content:"haytemmoso-del.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010269; classtype:social-engineering; sid:6010269; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galeri-pemenang-shopee43.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"galeri-pemenang-shopee43.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010270; classtype:social-engineering; sid:6010270; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kptxqvr.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kptxqvr.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010271; classtype:social-engineering; sid:6010271; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hadiah-undian-shopee2021.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hadiah-undian-shopee2021.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010272; classtype:social-engineering; sid:6010272; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-delta.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-delta.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010273; classtype:social-engineering; sid:6010273; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oki.jtu.mybluehost.me/wp-includes/assets/swiss/swisscom/ch/index.asp.php?6739354637a4d20ac3b341d9ccd930ad)"; flow:established,to_server; http.uri; content:"/wp-includes/assets/swiss/swisscom/ch/index.asp.php?6739354637a4d20ac3b341d9ccd930ad"; startswith; fast_pattern; http.host; content:"oki.jtu.mybluehost.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010274; classtype:social-engineering; sid:6010274; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-gamma.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-gamma.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010275; classtype:social-engineering; sid:6010275; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mm7765.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mm7765.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010276; classtype:social-engineering; sid:6010276; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gebyarundianshopee55.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gebyarundianshopee55.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010277; classtype:social-engineering; sid:6010277; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-frapvik-biz-vrolnex-drament.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-frapvik-biz-vrolnex-drament.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010278; classtype:social-engineering; sid:6010278; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mm1775.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mm1775.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010279; classtype:social-engineering; sid:6010279; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fsh2.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fsh2.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010280; classtype:social-engineering; sid:6010280; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.zudxrf.buzz/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.zudxrf.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010281; classtype:social-engineering; sid:6010281; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pp-auth.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pp-auth.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010282; classtype:social-engineering; sid:6010282; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enquiry-walock-tcap23nqu.springcapital91.workers.dev/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"enquiry-walock-tcap23nqu.springcapital91.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010283; classtype:social-engineering; sid:6010283; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ufzwqk.wasmer.app/643d8f9eae97b)"; flow:established,to_server; http.uri; content:"/643d8f9eae97b"; startswith; fast_pattern; http.host; content:"ufzwqk.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010284; classtype:social-engineering; sid:6010284; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adarsh405.github.io/netflix-clone-website/)"; flow:established,to_server; http.uri; content:"/netflix-clone-website/"; startswith; fast_pattern; http.host; content:"adarsh405.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010285; classtype:social-engineering; sid:6010285; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hetron.net/verify.php)"; flow:established,to_server; http.uri; content:"/verify.php"; startswith; fast_pattern; http.host; content:"hetron.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010286; classtype:social-engineering; sid:6010286; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netanswer-potalsite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netanswer-potalsite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010287; classtype:social-engineering; sid:6010287; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1999365.com//)"; flow:established,to_server; http.uri; content:"//"; startswith; fast_pattern; http.host; content:"1999365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010288; classtype:social-engineering; sid:6010288; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rechnundoub.com/privatkunden/srsltid/cc.php)"; flow:established,to_server; http.uri; content:"/privatkunden/srsltid/cc.php"; startswith; fast_pattern; http.host; content:"rechnundoub.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010289; classtype:social-engineering; sid:6010289; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (concifyrespotrymain.wasmer.app/pennon-group)"; flow:established,to_server; http.uri; content:"/pennon-group"; startswith; fast_pattern; http.host; content:"concifyrespotrymain.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010290; classtype:social-engineering; sid:6010290; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hadiahshopee-indonesia.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hadiahshopee-indonesia.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010291; classtype:social-engineering; sid:6010291; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oportoflowers.pt/shared-doc/re-0001/index.php?clientid=test@yahoo.com)"; flow:established,to_server; http.uri; content:"/shared-doc/re-0001/index.php?clientid=test@yahoo.com"; startswith; fast_pattern; http.host; content:"oportoflowers.pt"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010292; classtype:social-engineering; sid:6010292; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ult1moaviso365.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ult1moaviso365.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010293; classtype:social-engineering; sid:6010293; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.bnqdrg.buzz/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.bnqdrg.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010294; classtype:social-engineering; sid:6010294; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xlayaannewindozs.mildcou.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xlayaannewindozs.mildcou.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010295; classtype:social-engineering; sid:6010295; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (penguinwalkalone-create.github.io/Instagram)"; flow:established,to_server; http.uri; content:"/Instagram"; startswith; fast_pattern; http.host; content:"penguinwalkalone-create.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010296; classtype:social-engineering; sid:6010296; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xnewdana-lyananfromz.amormarch.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xnewdana-lyananfromz.amormarch.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010297; classtype:social-engineering; sid:6010297; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sunsetcp.com.au/wp-includes/sitemaps/ifezwla/)"; flow:established,to_server; http.uri; content:"/wp-includes/sitemaps/ifezwla/"; startswith; fast_pattern; http.host; content:"www.sunsetcp.com.au"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010298; classtype:social-engineering; sid:6010298; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xinnewfrom-costmerzn.sufisme.web.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xinnewfrom-costmerzn.sufisme.web.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010299; classtype:social-engineering; sid:6010299; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pangarevanthkumar2006-pixel.github.io/netflix-clones)"; flow:established,to_server; http.uri; content:"/netflix-clones"; startswith; fast_pattern; http.host; content:"pangarevanthkumar2006-pixel.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010300; classtype:social-engineering; sid:6010300; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (11.gu1gu1.ccwu.cc/retail/)"; flow:established,to_server; http.uri; content:"/retail/"; startswith; fast_pattern; http.host; content:"11.gu1gu1.ccwu.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010301; classtype:social-engineering; sid:6010301; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zhta2873-lang.github.io/site-iil1ujat)"; flow:established,to_server; http.uri; content:"/site-iil1ujat"; startswith; fast_pattern; http.host; content:"zhta2873-lang.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010302; classtype:social-engineering; sid:6010302; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-drulnex-biz-fronvax-slarnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-drulnex-biz-fronvax-slarnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010303; classtype:social-engineering; sid:6010303; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-plovnix-biz-drurnax-slortek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-plovnix-biz-drurnax-slortek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010304; classtype:social-engineering; sid:6010304; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smartconsulate.com/wp-includes/talibansource.html?eta=belel@c637c1b9dd79b16c6ad663c55d60260e89fd.net)"; flow:established,to_server; http.uri; content:"/wp-includes/talibansource.html?eta=belel@c637c1b9dd79b16c6ad663c55d60260e89fd.net"; startswith; fast_pattern; http.host; content:"smartconsulate.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010305; classtype:social-engineering; sid:6010305; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ue2wgw.sbs/o/hxu17/1769963912159#selectedbank9)"; flow:established,to_server; http.uri; content:"/o/hxu17/1769963912159#selectedbank9"; startswith; fast_pattern; http.host; content:"ue2wgw.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010306; classtype:social-engineering; sid:6010306; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.asjghxv.kxvias.portlandfurnitureonline.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.asjghxv.kxvias.portlandfurnitureonline.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010307; classtype:social-engineering; sid:6010307; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ufzwqk.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ufzwqk.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010308; classtype:social-engineering; sid:6010308; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.wiyyct.cc/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.wiyyct.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010309; classtype:social-engineering; sid:6010309; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (unicredit-login.one/unicredit/)"; flow:established,to_server; http.uri; content:"/unicredit/"; startswith; fast_pattern; http.host; content:"unicredit-login.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010310; classtype:social-engineering; sid:6010310; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galeripemenang77.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galeripemenang77.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010311; classtype:social-engineering; sid:6010311; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telefon8.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"telefon8.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010312; classtype:social-engineering; sid:6010312; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ishakaushik31.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"ishakaushik31.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010313; classtype:social-engineering; sid:6010313; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.cfkwpa.buzz/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.cfkwpa.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010314; classtype:social-engineering; sid:6010314; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (generous-cyan-ec1rj7rf.edgeone.app/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"generous-cyan-ec1rj7rf.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010315; classtype:social-engineering; sid:6010315; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pp-authh.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pp-authh.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010316; classtype:social-engineering; sid:6010316; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopsss.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopsss.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010317; classtype:social-engineering; sid:6010317; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.rbixzo.buzz/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.rbixzo.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010318; classtype:social-engineering; sid:6010318; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ramadan-sale2021.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"ramadan-sale2021.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010319; classtype:social-engineering; sid:6010319; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqtmplxzvn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqtmplxzvn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010320; classtype:social-engineering; sid:6010320; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (11.gu1gu1.ccwu.cc/today/camp/)"; flow:established,to_server; http.uri; content:"/today/camp/"; startswith; fast_pattern; http.host; content:"11.gu1gu1.ccwu.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010321; classtype:social-engineering; sid:6010321; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.zslkyp.cc/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.zslkyp.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010322; classtype:social-engineering; sid:6010322; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netbnk-sb1ac.com/contents/pages/wpl010101E/i010101CT/clientviews/DI01010240)"; flow:established,to_server; http.uri; content:"/contents/pages/wpl010101E/i010101CT/clientviews/DI01010240"; startswith; fast_pattern; http.host; content:"netbnk-sb1ac.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010323; classtype:social-engineering; sid:6010323; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.padisahbet.business/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.padisahbet.business"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010324; classtype:social-engineering; sid:6010324; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (claims2-esl-org.lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"claims2-esl-org.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010325; classtype:social-engineering; sid:6010325; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.xftatd.buzz/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.xftatd.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010326; classtype:social-engineering; sid:6010326; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (client.843029-cb.com/home/?v=42.53.33)"; flow:established,to_server; http.uri; content:"/home/?v=42.53.33"; startswith; fast_pattern; http.host; content:"client.843029-cb.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010327; classtype:social-engineering; sid:6010327; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netbnk-sb1ae.com/contents/pages/wpl010101E/i010101CT/clientviews/DI01010240)"; flow:established,to_server; http.uri; content:"/contents/pages/wpl010101E/i010101CT/clientviews/DI01010240"; startswith; fast_pattern; http.host; content:"netbnk-sb1ae.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010328; classtype:social-engineering; sid:6010328; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (identity-google.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"identity-google.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010329; classtype:social-engineering; sid:6010329; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galerihadiah-shopee789.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galerihadiah-shopee789.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010330; classtype:social-engineering; sid:6010330; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.usa-mettmssak-s0inin.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.usa-mettmssak-s0inin.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010331; classtype:social-engineering; sid:6010331; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yn7uuf.sbs/o/hxu17/1769963912159#selectedbank9)"; flow:established,to_server; http.uri; content:"/o/hxu17/1769963912159#selectedbank9"; startswith; fast_pattern; http.host; content:"yn7uuf.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010332; classtype:social-engineering; sid:6010332; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oyekaleisrael2-dev.github.io/netflix)"; flow:established,to_server; http.uri; content:"/netflix"; startswith; fast_pattern; http.host; content:"oyekaleisrael2-dev.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010333; classtype:social-engineering; sid:6010333; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.myboahelp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.myboahelp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010334; classtype:social-engineering; sid:6010334; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (undianresmishopee11.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"undianresmishopee11.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010335; classtype:social-engineering; sid:6010335; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.wkaeqe.cc/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.wkaeqe.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010336; classtype:social-engineering; sid:6010336; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiifkanpaylaterr.ydd.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiifkanpaylaterr.ydd.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010337; classtype:social-engineering; sid:6010337; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (z9vgtm.cfd/o/hxu17/1769963912159#selectedbank9)"; flow:established,to_server; http.uri; content:"/o/hxu17/1769963912159#selectedbank9"; startswith; fast_pattern; http.host; content:"z9vgtm.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010338; classtype:social-engineering; sid:6010338; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.oegmte.help/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.oegmte.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010339; classtype:social-engineering; sid:6010339; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (capmentor.vn/follow/)"; flow:established,to_server; http.uri; content:"/follow/"; startswith; fast_pattern; http.host; content:"capmentor.vn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010340; classtype:social-engineering; sid:6010340; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mztrxplqvn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mztrxplqvn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010341; classtype:social-engineering; sid:6010341; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.ksuvaq.help/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.ksuvaq.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010342; classtype:social-engineering; sid:6010342; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mztrxqvnpl.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mztrxqvnpl.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010343; classtype:social-engineering; sid:6010343; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (penguinwalkalone-create.github.io/Instagram./)"; flow:established,to_server; http.uri; content:"/Instagram./"; startswith; fast_pattern; http.host; content:"penguinwalkalone-create.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010344; classtype:social-engineering; sid:6010344; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tsess-29e.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tsess-29e.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010345; classtype:social-engineering; sid:6010345; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreih6awhr76k33ihkeywxvtmbtdxyyd2v2efr3i4xhyemg3njimwj7e.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreih6awhr76k33ihkeywxvtmbtdxyyd2v2efr3i4xhyemg3njimwj7e.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010346; classtype:social-engineering; sid:6010346; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (identidad-01--validar098.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"identidad-01--validar098.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010347; classtype:social-engineering; sid:6010347; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (introduction-bridge.wixstudio.com/bridge-en-us)"; flow:established,to_server; http.uri; content:"/bridge-en-us"; startswith; fast_pattern; http.host; content:"introduction-bridge.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010348; classtype:social-engineering; sid:6010348; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kreditbanking-dkb-de.propertytoken.ae/dkb/login.php)"; flow:established,to_server; http.uri; content:"/dkb/login.php"; startswith; fast_pattern; http.host; content:"kreditbanking-dkb-de.propertytoken.ae"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010349; classtype:social-engineering; sid:6010349; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trzur-suited.wixstudio.com/enus)"; flow:established,to_server; http.uri; content:"/enus"; startswith; fast_pattern; http.host; content:"trzur-suited.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010350; classtype:social-engineering; sid:6010350; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.829302.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.829302.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010351; classtype:social-engineering; sid:6010351; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (introduction-bridge.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"introduction-bridge.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010352; classtype:social-engineering; sid:6010352; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www-att-bellsouth-verifier-f82b3a.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www-att-bellsouth-verifier-f82b3a.webflow.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010353; classtype:social-engineering; sid:6010353; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dietzens.de/seiten/zitate/auswahl.php?suche=%22%2F%3E%3Cimg%20src%3D%22https%3A%2F%2Fgoogle.com%2F2I5CrL5ylnDKP.jpg%22%20onerror%3D%22window.location%3DdecodeURIComponent%28atob%28%27Njg3NDc0NzA3MzNhMmYyZjY0NmQ2OTcwNjE3MDc4NzE2NDY4NmMyZTMxMzMzNDM3MzMzMjYzMzAyZDY2MzIzMzM4MmQzNDYyMzkzNDJkNjEzOTM0MzMyZDMxMzUzODMxMzkzMTMzMzc2MTYxMzU2NTJlNjM2NjY0%27%29.replace%28%2F%28..%29%2Fg%2C%20%27%25%241%27%29%29%3B%22%3E)"; flow:established,to_server; http.uri; content:"/seiten/zitate/auswahl.php?suche=%22%2F%3E%3Cimg%20src%3D%22https%3A%2F%2Fgoogle.com%2F2I5CrL5ylnDKP.jpg%22%20onerror%3D%22window.location%3DdecodeURIComponent%28atob%28%27Njg3NDc0NzA3MzNhMmYyZjY0NmQ2OTcwNjE3MDc4NzE2NDY4NmMyZTMxMzMzNDM3MzMzMjYzMzAyZDY2MzIzMzM4MmQzNDYyMzkzNDJkNjEzOTM0MzMyZDMxMzUzODMxMzkzMTMzMzc2MTYxMzU2NTJlNjM2NjY0%27%29.replace%28%2F%28..%29%2Fg%2C%20%27%25%241%27%29%29%3B%22%3E"; startswith; fast_pattern; http.host; content:"dietzens.de"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010354; classtype:social-engineering; sid:6010354; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (io-startd-trzon.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"io-startd-trzon.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010355; classtype:social-engineering; sid:6010355; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bradesco.pjempresascorp.digital/404.php)"; flow:established,to_server; http.uri; content:"/404.php"; startswith; fast_pattern; http.host; content:"bradesco.pjempresascorp.digital"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010356; classtype:social-engineering; sid:6010356; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dreamhost.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.dreamhost.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010357; classtype:social-engineering; sid:6010357; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pagedesktop-us.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"pagedesktop-us.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010358; classtype:social-engineering; sid:6010358; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (startlezer-comcdn.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"startlezer-comcdn.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010359; classtype:social-engineering; sid:6010359; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appsuites-trezur.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"appsuites-trezur.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010360; classtype:social-engineering; sid:6010360; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (client-desktop.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"client-desktop.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010361; classtype:social-engineering; sid:6010361; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (connect-bridgge.wixstudio.com/hub-io)"; flow:established,to_server; http.uri; content:"/hub-io"; startswith; fast_pattern; http.host; content:"connect-bridgge.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010362; classtype:social-engineering; sid:6010362; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kleinanzeigen.wlrsj.com/41921064?mail=W0FOQUZFTUFd&meta=rlWjMKWwLJ50LJqyVwb1YPWhLJ1yVwbvKUIxBQAxKUIxLmN5VRShLJMyoJRvYPWwnTS0K2yxVwbgZGNjZmH4ZQHmZwVmBFjvp2IlqzywMFV6VzgfMJyhLJ56MJyaMJ4vYPW0rKOyVwbvLJ5uMzIgLI9gLJyfVa0%3D)"; flow:established,to_server; http.uri; content:"/41921064?mail=W0FOQUZFTUFd&meta=rlWjMKWwLJ50LJqyVwb1YPWhLJ1yVwbvKUIxBQAxKUIxLmN5VRShLJMyoJRvYPWwnTS0K2yxVwbgZGNjZmH4ZQHmZwVmBFjvp2IlqzywMFV6VzgfMJyhLJ56MJyaMJ4vYPW0rKOyVwbvLJ5uMzIgLI9gLJyfVa0%3D"; startswith; fast_pattern; http.host; content:"kleinanzeigen.wlrsj.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010363; classtype:social-engineering; sid:6010363; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.otbqew.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.otbqew.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010364; classtype:social-engineering; sid:6010364; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.yifsxa.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.yifsxa.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010365; classtype:social-engineering; sid:6010365; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.yejdgc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.yejdgc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010366; classtype:social-engineering; sid:6010366; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dvmfqw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dvmfqw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010367; classtype:social-engineering; sid:6010367; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xkpbfv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xkpbfv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010368; classtype:social-engineering; sid:6010368; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nydbjc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nydbjc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010369; classtype:social-engineering; sid:6010369; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.iylnz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.iylnz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010370; classtype:social-engineering; sid:6010370; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xrghvs.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xrghvs.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010371; classtype:social-engineering; sid:6010371; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (67cc94e5-8a62-4765-92c5-fdf7d02c57c9-00-4pjqe68mukc1.janeway.replit.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"67cc94e5-8a62-4765-92c5-fdf7d02c57c9-00-4pjqe68mukc1.janeway.replit.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010372; classtype:social-engineering; sid:6010372; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kygpiv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kygpiv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010373; classtype:social-engineering; sid:6010373; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.eblgrq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.eblgrq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010374; classtype:social-engineering; sid:6010374; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bdv-enlinea.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bdv-enlinea.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010375; classtype:social-engineering; sid:6010375; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rucpyw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rucpyw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010376; classtype:social-engineering; sid:6010376; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.sjrgzw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.sjrgzw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010377; classtype:social-engineering; sid:6010377; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.yuoqid.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.yuoqid.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010378; classtype:social-engineering; sid:6010378; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hwqam.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hwqam.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010379; classtype:social-engineering; sid:6010379; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gvhnr.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gvhnr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010380; classtype:social-engineering; sid:6010380; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.cvpjwk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.cvpjwk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010381; classtype:social-engineering; sid:6010381; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fcds-47514.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fcds-47514.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010382; classtype:social-engineering; sid:6010382; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ugamtw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ugamtw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010383; classtype:social-engineering; sid:6010383; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.szjfin.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.szjfin.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010384; classtype:social-engineering; sid:6010384; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wgvbth.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wgvbth.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010385; classtype:social-engineering; sid:6010385; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wibaph.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wibaph.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010386; classtype:social-engineering; sid:6010386; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zqrtmo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zqrtmo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010387; classtype:social-engineering; sid:6010387; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ymbjqc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ymbjqc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010388; classtype:social-engineering; sid:6010388; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (15415.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"15415.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010389; classtype:social-engineering; sid:6010389; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.avrzmy.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.avrzmy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010390; classtype:social-engineering; sid:6010390; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.iszkbm.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.iszkbm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010391; classtype:social-engineering; sid:6010391; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rdqguv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rdqguv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010392; classtype:social-engineering; sid:6010392; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (15408.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"15408.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010393; classtype:social-engineering; sid:6010393; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.btapcz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.btapcz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010394; classtype:social-engineering; sid:6010394; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (newdonn.s3.us-east-1.amazonaws.com/dropboxess.html?email=a.b@c/)"; flow:established,to_server; http.uri; content:"/dropboxess.html?email=a.b@c/"; startswith; fast_pattern; http.host; content:"newdonn.s3.us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010395; classtype:social-engineering; sid:6010395; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shrturls.sbs/mexc6/)"; flow:established,to_server; http.uri; content:"/mexc6/"; startswith; fast_pattern; http.host; content:"www.shrturls.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010396; classtype:social-engineering; sid:6010396; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ogmysr.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ogmysr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010397; classtype:social-engineering; sid:6010397; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.uyfxbg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.uyfxbg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010398; classtype:social-engineering; sid:6010398; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kbstxv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kbstxv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010399; classtype:social-engineering; sid:6010399; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bhaveshpandey142007-dev.github.io/netflix-clone)"; flow:established,to_server; http.uri; content:"/netflix-clone"; startswith; fast_pattern; http.host; content:"bhaveshpandey142007-dev.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010400; classtype:social-engineering; sid:6010400; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ndilcz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ndilcz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010401; classtype:social-engineering; sid:6010401; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.csfht.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.csfht.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010402; classtype:social-engineering; sid:6010402; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xayjov.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xayjov.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010403; classtype:social-engineering; sid:6010403; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rufsqj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rufsqj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010404; classtype:social-engineering; sid:6010404; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tlgodf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tlgodf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010405; classtype:social-engineering; sid:6010405; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ykdqlr.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ykdqlr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010406; classtype:social-engineering; sid:6010406; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bdv-enlinea.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bdv-enlinea.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010407; classtype:social-engineering; sid:6010407; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sophiacarvalho307-dotcom.github.io/netflix-/)"; flow:established,to_server; http.uri; content:"/netflix-/"; startswith; fast_pattern; http.host; content:"sophiacarvalho307-dotcom.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010408; classtype:social-engineering; sid:6010408; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j39b.vip/favicon.ico)"; flow:established,to_server; http.uri; content:"/favicon.ico"; startswith; fast_pattern; http.host; content:"j39b.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010409; classtype:social-engineering; sid:6010409; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tdcfwg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tdcfwg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010410; classtype:social-engineering; sid:6010410; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.phvnmz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.phvnmz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010411; classtype:social-engineering; sid:6010411; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vcbhiu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vcbhiu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010412; classtype:social-engineering; sid:6010412; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.yqzoig.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.yqzoig.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010413; classtype:social-engineering; sid:6010413; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.objawi.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.objawi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010414; classtype:social-engineering; sid:6010414; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.sokqtg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.sokqtg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010415; classtype:social-engineering; sid:6010415; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lpqgrd.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lpqgrd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010416; classtype:social-engineering; sid:6010416; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bxucms.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bxucms.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010417; classtype:social-engineering; sid:6010417; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qbatou.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qbatou.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010418; classtype:social-engineering; sid:6010418; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ioqfem.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ioqfem.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010419; classtype:social-engineering; sid:6010419; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fvikw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.fvikw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010420; classtype:social-engineering; sid:6010420; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gkbci29u.dongjiakg.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.gkbci29u.dongjiakg.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010421; classtype:social-engineering; sid:6010421; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metalrisrl.musvc4.net/e/tr?amp\;mupckp=mupAtu4m8OiX0wt&q=5=PcCTR%2526G=4%2526F=KV8%2526G=NX5WM%2526P=kLCKv_JjxS_UT_MTui_WI_JjxS_TYTxM1AnQ.vJp_JjxS_TYNsG8%25269=pMBQfV.70w%2526AB=WCbQ%2526Ov=TSW9bNXCSLX53t6dUN%2526C=BZv8ATLchSxchVMb77xbC6t8e7tb0XMaBVO9CYL648u74ZPZeVNeiXSV58QXfWS8)"; flow:established,to_server; http.uri; content:"/e/tr?amp|3b|mupckp=mupAtu4m8OiX0wt&q=5=PcCTR%2526G=4%2526F=KV8%2526G=NX5WM%2526P=kLCKv_JjxS_UT_MTui_WI_JjxS_TYTxM1AnQ.vJp_JjxS_TYNsG8%25269=pMBQfV.70w%2526AB=WCbQ%2526Ov=TSW9bNXCSLX53t6dUN%2526C=BZv8ATLchSxchVMb77xbC6t8e7tb0XMaBVO9CYL648u74ZPZeVNeiXSV58QXfWS8"; startswith; fast_pattern; http.host; content:"metalrisrl.musvc4.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010422; classtype:social-engineering; sid:6010422; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (validecgobecc.iceiy.com/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"validecgobecc.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010423; classtype:social-engineering; sid:6010423; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vemcwf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vemcwf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010424; classtype:social-engineering; sid:6010424; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (15418.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"15418.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010425; classtype:social-engineering; sid:6010425; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amex-doc-collection.idmission.com/es-mx/soporte/programas-de-tarjeta/journey/begin?name=Paola+Berenice&PCN=20261526900795MXN&amexCardId=platinum_grcc&jobId=019e847d-2848-44fa-ff92-9d7044fd24f9)"; flow:established,to_server; http.uri; content:"/es-mx/soporte/programas-de-tarjeta/journey/begin?name=Paola+Berenice&PCN=20261526900795MXN&amexCardId=platinum_grcc&jobId=019e847d-2848-44fa-ff92-9d7044fd24f9"; startswith; fast_pattern; http.host; content:"amex-doc-collection.idmission.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010426; classtype:social-engineering; sid:6010426; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.yubmvk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.yubmvk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010427; classtype:social-engineering; sid:6010427; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lhenif.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lhenif.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010428; classtype:social-engineering; sid:6010428; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fzlvmx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.fzlvmx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010429; classtype:social-engineering; sid:6010429; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hjduwf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hjduwf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010430; classtype:social-engineering; sid:6010430; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ygzkaw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ygzkaw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010431; classtype:social-engineering; sid:6010431; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xcwhal.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xcwhal.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010432; classtype:social-engineering; sid:6010432; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jzmoa.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jzmoa.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010433; classtype:social-engineering; sid:6010433; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bjirqs.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bjirqs.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010434; classtype:social-engineering; sid:6010434; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15623.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15623.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010435; classtype:social-engineering; sid:6010435; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.uhidsx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.uhidsx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010436; classtype:social-engineering; sid:6010436; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mtklbr.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mtklbr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010437; classtype:social-engineering; sid:6010437; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gaiqbf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gaiqbf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010438; classtype:social-engineering; sid:6010438; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gyftxi.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gyftxi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010439; classtype:social-engineering; sid:6010439; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (danaa-iindonesiaa.ndd.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"danaa-iindonesiaa.ndd.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010440; classtype:social-engineering; sid:6010440; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.feqwrc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.feqwrc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010441; classtype:social-engineering; sid:6010441; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mpyqso.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mpyqso.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010442; classtype:social-engineering; sid:6010442; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mgsclu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mgsclu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010443; classtype:social-engineering; sid:6010443; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uscanadacpas.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uscanadacpas.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010444; classtype:social-engineering; sid:6010444; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.cwnklb.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.cwnklb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010445; classtype:social-engineering; sid:6010445; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ingresarprodubanco-ec.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ingresarprodubanco-ec.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010446; classtype:social-engineering; sid:6010446; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bluemark-free-see-more.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bluemark-free-see-more.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010447; classtype:social-engineering; sid:6010447; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.qantasmoney-financial.ns01.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.qantasmoney-financial.ns01.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010448; classtype:social-engineering; sid:6010448; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (avaliacaodeaumento.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"avaliacaodeaumento.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010449; classtype:social-engineering; sid:6010449; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gtfzvs.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gtfzvs.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010450; classtype:social-engineering; sid:6010450; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jmzbxw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jmzbxw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010451; classtype:social-engineering; sid:6010451; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.meudwo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.meudwo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010452; classtype:social-engineering; sid:6010452; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.euhjv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.euhjv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010453; classtype:social-engineering; sid:6010453; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hbycld.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hbycld.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010454; classtype:social-engineering; sid:6010454; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mbqpay.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mbqpay.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010455; classtype:social-engineering; sid:6010455; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.98459347385433.sbs/oferta/moza-r5-bundle-wszystko-co-na-zdj-jest-na-sprzeda?id=8Ii8KqKsUymhMVPV)"; flow:established,to_server; http.uri; content:"/oferta/moza-r5-bundle-wszystko-co-na-zdj-jest-na-sprzeda?id=8Ii8KqKsUymhMVPV"; startswith; fast_pattern; http.host; content:"allegrolokalnie.98459347385433.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010456; classtype:social-engineering; sid:6010456; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lmjqio.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lmjqio.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010457; classtype:social-engineering; sid:6010457; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xzbvqk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xzbvqk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010458; classtype:social-engineering; sid:6010458; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xlynnid-danaz.mildcou.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xlynnid-danaz.mildcou.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010459; classtype:social-engineering; sid:6010459; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.sxzftv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.sxzftv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010460; classtype:social-engineering; sid:6010460; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lugodh.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lugodh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010461; classtype:social-engineering; sid:6010461; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rmlcws.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rmlcws.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010462; classtype:social-engineering; sid:6010462; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ulkfmt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ulkfmt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010463; classtype:social-engineering; sid:6010463; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (midasplay.claimskinevents.com/?ttclid=E_C_P_CuABXsvcyqSy4KQh0QP2JniiW_45qcEt_w5EHeOnhn2esEI6Xfa0a41R8gQjX5sFDH788YRM49VIht66fGkMOdLjEkyyx3AuOONxu29ISwy6lnfZYSVZQOHuzVtq1GsBzNMYBlpwCyHPglxtWUAFY-6vXoM7nvz2S1MCw5R4ZIjJic7Hk8IqSaLpq5EEkZKrk4WSd5WAEO45REMl7lSBWOJd_7htPldFOWfzlzq7PM9GIU0dxSQqe_ud-fdjg87LasTMtyILdnev_gzEBnF4KzKQRs5rcPAYt0LNah5huTTEGlMSBHYyLjA)"; flow:established,to_server; http.uri; content:"/?ttclid=E_C_P_CuABXsvcyqSy4KQh0QP2JniiW_45qcEt_w5EHeOnhn2esEI6Xfa0a41R8gQjX5sFDH788YRM49VIht66fGkMOdLjEkyyx3AuOONxu29ISwy6lnfZYSVZQOHuzVtq1GsBzNMYBlpwCyHPglxtWUAFY-6vXoM7nvz2S1MCw5R4ZIjJic7Hk8IqSaLpq5EEkZKrk4WSd5WAEO45REMl7lSBWOJd_7htPldFOWfzlzq7PM9GIU0dxSQqe_ud-fdjg87LasTMtyILdnev_gzEBnF4KzKQRs5rcPAYt0LNah5huTTEGlMSBHYyLjA"; startswith; fast_pattern; http.host; content:"midasplay.claimskinevents.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010464; classtype:social-engineering; sid:6010464; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lnmvrg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lnmvrg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010465; classtype:social-engineering; sid:6010465; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pkwnyz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pkwnyz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010466; classtype:social-engineering; sid:6010466; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reactivautlook356.iceiy.com/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"reactivautlook356.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010467; classtype:social-engineering; sid:6010467; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hvpnrc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hvpnrc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010468; classtype:social-engineering; sid:6010468; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fbekgj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.fbekgj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010469; classtype:social-engineering; sid:6010469; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kxefyp.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kxefyp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010470; classtype:social-engineering; sid:6010470; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ygqbhe.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ygqbhe.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010471; classtype:social-engineering; sid:6010471; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.srxipv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.srxipv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010472; classtype:social-engineering; sid:6010472; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kpevcg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kpevcg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010473; classtype:social-engineering; sid:6010473; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopeebig67.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopeebig67.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010474; classtype:social-engineering; sid:6010474; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vwrxch.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vwrxch.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010475; classtype:social-engineering; sid:6010475; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rgxami.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rgxami.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010476; classtype:social-engineering; sid:6010476; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15598.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15598.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010477; classtype:social-engineering; sid:6010477; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mfhdro.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mfhdro.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010478; classtype:social-engineering; sid:6010478; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rmjkbz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rmjkbz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010479; classtype:social-engineering; sid:6010479; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.teams-zvn.com/p/ggbd-cpkq/tgmhrrjm/)"; flow:established,to_server; http.uri; content:"/p/ggbd-cpkq/tgmhrrjm/"; startswith; fast_pattern; http.host; content:"s.teams-zvn.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010480; classtype:social-engineering; sid:6010480; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.yjkmil.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.yjkmil.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010481; classtype:social-engineering; sid:6010481; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kuzqlf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kuzqlf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010482; classtype:social-engineering; sid:6010482; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.oxzfdm.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.oxzfdm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010483; classtype:social-engineering; sid:6010483; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gwjlx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gwjlx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010484; classtype:social-engineering; sid:6010484; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bsuneo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bsuneo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010485; classtype:social-engineering; sid:6010485; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bfhevo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bfhevo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010486; classtype:social-engineering; sid:6010486; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ndygsu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ndygsu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010487; classtype:social-engineering; sid:6010487; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nweshu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nweshu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010488; classtype:social-engineering; sid:6010488; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kymaei.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kymaei.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010489; classtype:social-engineering; sid:6010489; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fwyqrl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.fwyqrl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010490; classtype:social-engineering; sid:6010490; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qantasmoney-support.ns01.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qantasmoney-support.ns01.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010491; classtype:social-engineering; sid:6010491; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qantasmoney-verifications.ns01.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qantasmoney-verifications.ns01.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010492; classtype:social-engineering; sid:6010492; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.qantasmoney-verifications.ns01.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.qantasmoney-verifications.ns01.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010493; classtype:social-engineering; sid:6010493; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.penguinsitter.com/wp-includes/WP_admCH/Wp_gg/)"; flow:established,to_server; http.uri; content:"/wp-includes/WP_admCH/Wp_gg/"; startswith; fast_pattern; http.host; content:"www.penguinsitter.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010494; classtype:social-engineering; sid:6010494; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.anemop.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.anemop.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010495; classtype:social-engineering; sid:6010495; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tmuwpk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tmuwpk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010496; classtype:social-engineering; sid:6010496; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xnvrsw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xnvrsw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010497; classtype:social-engineering; sid:6010497; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (formanmills.com/Facebook/login.html)"; flow:established,to_server; http.uri; content:"/Facebook/login.html"; startswith; fast_pattern; http.host; content:"formanmills.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010498; classtype:social-engineering; sid:6010498; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bluemark-free-see-more.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bluemark-free-see-more.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010499; classtype:social-engineering; sid:6010499; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (danaa-iindonesiaa.vaa.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"danaa-iindonesiaa.vaa.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010500; classtype:social-engineering; sid:6010500; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ximbsh.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ximbsh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010501; classtype:social-engineering; sid:6010501; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.njckma.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.njckma.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010502; classtype:social-engineering; sid:6010502; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.posevg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.posevg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010503; classtype:social-engineering; sid:6010503; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fhgayl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.fhgayl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010504; classtype:social-engineering; sid:6010504; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hzvngq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hzvngq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010505; classtype:social-engineering; sid:6010505; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.obzdav.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.obzdav.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010506; classtype:social-engineering; sid:6010506; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hymzis.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hymzis.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010507; classtype:social-engineering; sid:6010507; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (assuredannuity.com/members/classes/captcha/CerticodePlus/DSP2/)"; flow:established,to_server; http.uri; content:"/members/classes/captcha/CerticodePlus/DSP2/"; startswith; fast_pattern; http.host; content:"assuredannuity.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010508; classtype:social-engineering; sid:6010508; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hfmvzo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hfmvzo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010509; classtype:social-engineering; sid:6010509; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jqyprx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jqyprx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010510; classtype:social-engineering; sid:6010510; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.uvhaqn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.uvhaqn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010511; classtype:social-engineering; sid:6010511; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (outiook-offlceauthyfyveriflive.icu/api/verification/page)"; flow:established,to_server; http.uri; content:"/api/verification/page"; startswith; fast_pattern; http.host; content:"outiook-offlceauthyfyveriflive.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010512; classtype:social-engineering; sid:6010512; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.chufmb.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.chufmb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010513; classtype:social-engineering; sid:6010513; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.glosze.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.glosze.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010514; classtype:social-engineering; sid:6010514; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hkscbo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hkscbo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010515; classtype:social-engineering; sid:6010515; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pxfleq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pxfleq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010516; classtype:social-engineering; sid:6010516; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ahuter.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ahuter.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010517; classtype:social-engineering; sid:6010517; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ejvyuo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ejvyuo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010518; classtype:social-engineering; sid:6010518; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qantasmoney-financial.ns01.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qantasmoney-financial.ns01.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010519; classtype:social-engineering; sid:6010519; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ezdnhg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ezdnhg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010520; classtype:social-engineering; sid:6010520; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nqgvyo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nqgvyo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010521; classtype:social-engineering; sid:6010521; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.armctz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.armctz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010522; classtype:social-engineering; sid:6010522; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bowltg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bowltg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010523; classtype:social-engineering; sid:6010523; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.uqnigo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.uqnigo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010524; classtype:social-engineering; sid:6010524; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pocjwe.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pocjwe.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010525; classtype:social-engineering; sid:6010525; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rolbnf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rolbnf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010526; classtype:social-engineering; sid:6010526; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mkifvy.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mkifvy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010527; classtype:social-engineering; sid:6010527; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ocleak.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ocleak.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010528; classtype:social-engineering; sid:6010528; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.yzxhoq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.yzxhoq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010529; classtype:social-engineering; sid:6010529; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qantasmoney.ns02.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qantasmoney.ns02.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010530; classtype:social-engineering; sid:6010530; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.steammystation.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.steammystation.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010531; classtype:social-engineering; sid:6010531; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xfluir.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xfluir.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010532; classtype:social-engineering; sid:6010532; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.oyxngu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.oyxngu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010533; classtype:social-engineering; sid:6010533; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.a3b9c3s2.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.a3b9c3s2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010534; classtype:social-engineering; sid:6010534; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (frshmeme.s3.us-east-1.amazonaws.com/dropboxess.html)"; flow:established,to_server; http.uri; content:"/dropboxess.html"; startswith; fast_pattern; http.host; content:"frshmeme.s3.us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010535; classtype:social-engineering; sid:6010535; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (solicitudesenlineaprocesodeverifica.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"solicitudesenlineaprocesodeverifica.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010536; classtype:social-engineering; sid:6010536; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (u20c.top/js/8544.1777369843125.875d684f.js)"; flow:established,to_server; http.uri; content:"/js/8544.1777369843125.875d684f.js"; startswith; fast_pattern; http.host; content:"u20c.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010537; classtype:social-engineering; sid:6010537; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.drxkzt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.drxkzt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010538; classtype:social-engineering; sid:6010538; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (395bet1.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"395bet1.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010539; classtype:social-engineering; sid:6010539; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pagqzm.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pagqzm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010540; classtype:social-engineering; sid:6010540; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dhfqjl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dhfqjl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010541; classtype:social-engineering; sid:6010541; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dgyrte.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dgyrte.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010542; classtype:social-engineering; sid:6010542; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jsxyou.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jsxyou.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010543; classtype:social-engineering; sid:6010543; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rykija.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rykija.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010544; classtype:social-engineering; sid:6010544; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.funrjx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.funrjx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010545; classtype:social-engineering; sid:6010545; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (produbanprestarapidoec.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"produbanprestarapidoec.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010546; classtype:social-engineering; sid:6010546; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ahurahotel.com/Adobereader/)"; flow:established,to_server; http.uri; content:"/Adobereader/"; startswith; fast_pattern; http.host; content:"ahurahotel.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010547; classtype:social-engineering; sid:6010547; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dtsxpc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dtsxpc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010548; classtype:social-engineering; sid:6010548; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365bet992.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"365bet992.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010549; classtype:social-engineering; sid:6010549; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mgdjuz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mgdjuz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010550; classtype:social-engineering; sid:6010550; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vejdfs.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vejdfs.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010551; classtype:social-engineering; sid:6010551; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.urshwn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.urshwn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010552; classtype:social-engineering; sid:6010552; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fhbxtj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.fhbxtj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010553; classtype:social-engineering; sid:6010553; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jptnue.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jptnue.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010554; classtype:social-engineering; sid:6010554; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vjyklm.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vjyklm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010555; classtype:social-engineering; sid:6010555; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-fraplor-biz-dravnix-qravtek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-fraplor-biz-dravnix-qravtek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010556; classtype:social-engineering; sid:6010556; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.utfisa.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.utfisa.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010557; classtype:social-engineering; sid:6010557; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vgfy-36757.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vgfy-36757.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010558; classtype:social-engineering; sid:6010558; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.udfrgb.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.udfrgb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010559; classtype:social-engineering; sid:6010559; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.likfpc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.likfpc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010560; classtype:social-engineering; sid:6010560; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jolcwd.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jolcwd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010561; classtype:social-engineering; sid:6010561; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nmhokq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nmhokq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010562; classtype:social-engineering; sid:6010562; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.auspost-verify-delivery.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.auspost-verify-delivery.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010563; classtype:social-engineering; sid:6010563; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ecpqwm.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ecpqwm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010564; classtype:social-engineering; sid:6010564; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ymxupt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ymxupt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010565; classtype:social-engineering; sid:6010565; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dpxhrj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dpxhrj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010566; classtype:social-engineering; sid:6010566; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ptgkbv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ptgkbv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010567; classtype:social-engineering; sid:6010567; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vfkihe.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vfkihe.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010568; classtype:social-engineering; sid:6010568; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ustqey.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ustqey.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010569; classtype:social-engineering; sid:6010569; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bbvanet-cash.duckdns.org/e-bbvanetcash.com/Portal/Empresas/PSE/Credenciales)"; flow:established,to_server; http.uri; content:"/e-bbvanetcash.com/Portal/Empresas/PSE/Credenciales"; startswith; fast_pattern; http.host; content:"bbvanet-cash.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010570; classtype:social-engineering; sid:6010570; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ejgavs.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ejgavs.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010571; classtype:social-engineering; sid:6010571; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nlmhyb.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nlmhyb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010572; classtype:social-engineering; sid:6010572; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zpwenm.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zpwenm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010573; classtype:social-engineering; sid:6010573; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.npvcyx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.npvcyx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010574; classtype:social-engineering; sid:6010574; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fjosv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.fjosv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010575; classtype:social-engineering; sid:6010575; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.oktdfz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.oktdfz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010576; classtype:social-engineering; sid:6010576; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bzrjeo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bzrjeo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010577; classtype:social-engineering; sid:6010577; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.sqhela.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.sqhela.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010578; classtype:social-engineering; sid:6010578; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zmsfne.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zmsfne.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010579; classtype:social-engineering; sid:6010579; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.g15r.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.g15r.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010580; classtype:social-engineering; sid:6010580; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.derksi.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.derksi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010581; classtype:social-engineering; sid:6010581; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zkqlpw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zkqlpw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010582; classtype:social-engineering; sid:6010582; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.chzqwo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.chzqwo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010583; classtype:social-engineering; sid:6010583; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stealthsvcverification.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"stealthsvcverification.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010584; classtype:social-engineering; sid:6010584; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hpwnqk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hpwnqk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010585; classtype:social-engineering; sid:6010585; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.yzqbkg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.yzqbkg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010586; classtype:social-engineering; sid:6010586; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pittaa.mooo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pittaa.mooo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010587; classtype:social-engineering; sid:6010587; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (assuredannuity.com/members/classes/captcha/CerticodePlus/DSP2/login/login.php)"; flow:established,to_server; http.uri; content:"/members/classes/captcha/CerticodePlus/DSP2/login/login.php"; startswith; fast_pattern; http.host; content:"assuredannuity.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010588; classtype:social-engineering; sid:6010588; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vcfwjm.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vcfwjm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010589; classtype:social-engineering; sid:6010589; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.phykbg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.phykbg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010590; classtype:social-engineering; sid:6010590; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (may-statementd-downloadv52026.com/us/)"; flow:established,to_server; http.uri; content:"/us/"; startswith; fast_pattern; http.host; content:"may-statementd-downloadv52026.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010591; classtype:social-engineering; sid:6010591; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rbogqt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rbogqt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010592; classtype:social-engineering; sid:6010592; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (newneddes.s3.us-east-1.amazonaws.com/dropboxess.html?email=a.b@c)"; flow:established,to_server; http.uri; content:"/dropboxess.html?email=a.b@c"; startswith; fast_pattern; http.host; content:"newneddes.s3.us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010593; classtype:social-engineering; sid:6010593; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sasktelresetupdate.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sasktelresetupdate.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010594; classtype:social-engineering; sid:6010594; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (garantiareservatecnicaativodegiro.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"garantiareservatecnicaativodegiro.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010595; classtype:social-engineering; sid:6010595; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dvskh.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dvskh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010596; classtype:social-engineering; sid:6010596; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mxnrca.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mxnrca.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010597; classtype:social-engineering; sid:6010597; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myownm.s3.us-east-1.amazonaws.com/dropboxess.html?email=a.b@c)"; flow:established,to_server; http.uri; content:"/dropboxess.html?email=a.b@c"; startswith; fast_pattern; http.host; content:"myownm.s3.us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010598; classtype:social-engineering; sid:6010598; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.sxpbna.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.sxpbna.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010599; classtype:social-engineering; sid:6010599; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a3b9c4s3.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a3b9c4s3.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010600; classtype:social-engineering; sid:6010600; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.iftdeu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.iftdeu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010601; classtype:social-engineering; sid:6010601; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.iheocw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.iheocw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010602; classtype:social-engineering; sid:6010602; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xhaqfs.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xhaqfs.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010603; classtype:social-engineering; sid:6010603; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.auspost-verify-delivery.com/mypostFind?sslchannel=true&sessionid=DGnghJH3MFCtc7zqTWmXCNlifY4aPsBiaBHb5ie0sHALVCiuKIInuC7a4mHzXSFAcuXZgBVdPUwZ3Q7QHjqTjo5AWrHqvQ4H4e4cR4dgu5qINdLZu42aDup2MWVIWeX20k)"; flow:established,to_server; http.uri; content:"/mypostFind?sslchannel=true&sessionid=DGnghJH3MFCtc7zqTWmXCNlifY4aPsBiaBHb5ie0sHALVCiuKIInuC7a4mHzXSFAcuXZgBVdPUwZ3Q7QHjqTjo5AWrHqvQ4H4e4cR4dgu5qINdLZu42aDup2MWVIWeX20k"; startswith; fast_pattern; http.host; content:"www.auspost-verify-delivery.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010604; classtype:social-engineering; sid:6010604; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.inaukq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.inaukq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010605; classtype:social-engineering; sid:6010605; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tarjetasprodubancsosiality.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tarjetasprodubancsosiality.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010606; classtype:social-engineering; sid:6010606; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gcwlmo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gcwlmo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010607; classtype:social-engineering; sid:6010607; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (15647.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"15647.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010608; classtype:social-engineering; sid:6010608; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.grwdsu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.grwdsu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010609; classtype:social-engineering; sid:6010609; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ibegmp.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ibegmp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010610; classtype:social-engineering; sid:6010610; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.istond.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.istond.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010611; classtype:social-engineering; sid:6010611; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kexrmo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kexrmo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010612; classtype:social-engineering; sid:6010612; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.szuqwf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.szuqwf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010613; classtype:social-engineering; sid:6010613; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xgzwot.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xgzwot.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010614; classtype:social-engineering; sid:6010614; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kjnopi.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kjnopi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010615; classtype:social-engineering; sid:6010615; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.guxqro.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.guxqro.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010616; classtype:social-engineering; sid:6010616; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j39b.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j39b.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010617; classtype:social-engineering; sid:6010617; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vwiugs.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vwiugs.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010618; classtype:social-engineering; sid:6010618; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.oxpfkc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.oxpfkc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010619; classtype:social-engineering; sid:6010619; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.roxygs.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.roxygs.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010620; classtype:social-engineering; sid:6010620; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jzebc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jzebc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010621; classtype:social-engineering; sid:6010621; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kacpnq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kacpnq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010622; classtype:social-engineering; sid:6010622; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vyrtfj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vyrtfj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010623; classtype:social-engineering; sid:6010623; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kxgoni.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kxgoni.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010624; classtype:social-engineering; sid:6010624; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.qantasmoney-support.ns01.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.qantasmoney-support.ns01.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010625; classtype:social-engineering; sid:6010625; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xnsfbq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xnsfbq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010626; classtype:social-engineering; sid:6010626; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.solicitudesenlineaprocesodeverifica.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.solicitudesenlineaprocesodeverifica.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010627; classtype:social-engineering; sid:6010627; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.numdbq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.numdbq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010628; classtype:social-engineering; sid:6010628; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kneuwj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kneuwj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010629; classtype:social-engineering; sid:6010629; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bgkidt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bgkidt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010630; classtype:social-engineering; sid:6010630; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hgecqx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hgecqx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010631; classtype:social-engineering; sid:6010631; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jmctse.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jmctse.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010632; classtype:social-engineering; sid:6010632; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.uxlnry.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.uxlnry.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010633; classtype:social-engineering; sid:6010633; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.smdlvk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.smdlvk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010634; classtype:social-engineering; sid:6010634; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vqfsgi.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vqfsgi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010635; classtype:social-engineering; sid:6010635; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ixyjd.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ixyjd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010636; classtype:social-engineering; sid:6010636; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dtgiu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dtgiu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010637; classtype:social-engineering; sid:6010637; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.yvbaig.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.yvbaig.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010638; classtype:social-engineering; sid:6010638; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (u20c.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"u20c.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010639; classtype:social-engineering; sid:6010639; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tkxzbq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tkxzbq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010640; classtype:social-engineering; sid:6010640; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kmcros.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kmcros.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010641; classtype:social-engineering; sid:6010641; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mdxfcp.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mdxfcp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010642; classtype:social-engineering; sid:6010642; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.yucflq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.yucflq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010643; classtype:social-engineering; sid:6010643; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.isontg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.isontg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010644; classtype:social-engineering; sid:6010644; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (drk-whatsapp.hk.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"drk-whatsapp.hk.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010645; classtype:social-engineering; sid:6010645; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hxkmy.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hxkmy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010646; classtype:social-engineering; sid:6010646; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gojcze.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gojcze.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010647; classtype:social-engineering; sid:6010647; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15626.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15626.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010648; classtype:social-engineering; sid:6010648; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mlcszj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mlcszj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010649; classtype:social-engineering; sid:6010649; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-qolvrax-biz-glarnor-slurnax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-qolvrax-biz-glarnor-slurnax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010650; classtype:social-engineering; sid:6010650; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-glarnex-biz-vrolvax-trapnix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-glarnex-biz-vrolvax-trapnix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010651; classtype:social-engineering; sid:6010651; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hjvillakmms.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hjvillakmms.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010652; classtype:social-engineering; sid:6010652; rev:1; metadata: signature_severity Major, created_et 2026_06_02, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (right-points-940085.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"right-points-940085.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010653; classtype:social-engineering; sid:6010653; rev:1; metadata: signature_severity Major, created_et 2026_06_02, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usdaproposalbid.wixsite.com/my-site-1)"; flow:established,to_server; http.uri; content:"/my-site-1"; startswith; fast_pattern; http.host; content:"usdaproposalbid.wixsite.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010654; classtype:social-engineering; sid:6010654; rev:1; metadata: signature_severity Major, created_et 2026_06_02, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (starts-ldgeercdn.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"starts-ldgeercdn.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010655; classtype:social-engineering; sid:6010655; rev:1; metadata: signature_severity Major, created_et 2026_06_02, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nice-item-273012.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nice-item-273012.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010656; classtype:social-engineering; sid:6010656; rev:1; metadata: signature_severity Major, created_et 2026_06_02, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (104.21.30.72/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"104.21.30.72"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010657; classtype:social-engineering; sid:6010657; rev:1; metadata: signature_severity Major, created_et 2026_06_02, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (protal-live.wixstudio.com/enus)"; flow:established,to_server; http.uri; content:"/enus"; startswith; fast_pattern; http.host; content:"protal-live.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010658; classtype:social-engineering; sid:6010658; rev:1; metadata: signature_severity Major, created_et 2026_06_02, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (officialdesktop-legr.wixstudio.com/usen)"; flow:established,to_server; http.uri; content:"/usen"; startswith; fast_pattern; http.host; content:"officialdesktop-legr.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010659; classtype:social-engineering; sid:6010659; rev:1; metadata: signature_severity Major, created_et 2026_06_02, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (live-streted.wixstudio.com/live-en)"; flow:established,to_server; http.uri; content:"/live-en"; startswith; fast_pattern; http.host; content:"live-streted.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010660; classtype:social-engineering; sid:6010660; rev:1; metadata: signature_severity Major, created_et 2026_06_02, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (midco-mailredirect-solution.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"midco-mailredirect-solution.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010661; classtype:social-engineering; sid:6010661; rev:1; metadata: signature_severity Major, created_et 2026_06_02, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (securedolstateusau.wixsite.com/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"securedolstateusau.wixsite.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010662; classtype:social-engineering; sid:6010662; rev:1; metadata: signature_severity Major, created_et 2026_06_02, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (liveapp-ledzer.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"liveapp-ledzer.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010663; classtype:social-engineering; sid:6010663; rev:1; metadata: signature_severity Major, created_et 2026_06_02, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1inch-eth.ipns.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1inch-eth.ipns.dweb.link"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010664; classtype:social-engineering; sid:6010664; rev:1; metadata: signature_severity Major, created_et 2026_06_02, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (desktop-ledzercdn.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"desktop-ledzercdn.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010665; classtype:social-engineering; sid:6010665; rev:1; metadata: signature_severity Major, created_et 2026_06_02, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jhuauthform.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jhuauthform.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010666; classtype:social-engineering; sid:6010666; rev:1; metadata: signature_severity Major, created_et 2026_06_02, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (breakable-europe-800085.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"breakable-europe-800085.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010667; classtype:social-engineering; sid:6010667; rev:1; metadata: signature_severity Major, created_et 2026_06_02, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwz.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwz.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010668; classtype:social-engineering; sid:6010668; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cxztsnation.com/dsi/)"; flow:established,to_server; http.uri; content:"/dsi/"; startswith; fast_pattern; http.host; content:"cxztsnation.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010669; classtype:social-engineering; sid:6010669; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nowdesktop-live.wixstudio.com/desktop)"; flow:established,to_server; http.uri; content:"/desktop"; startswith; fast_pattern; http.host; content:"nowdesktop-live.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010670; classtype:social-engineering; sid:6010670; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwv.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwv.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010671; classtype:social-engineering; sid:6010671; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingee.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingee.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010672; classtype:social-engineering; sid:6010672; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dk-healthydiet.shop/ZYQ-DK01/)"; flow:established,to_server; http.uri; content:"/ZYQ-DK01/"; startswith; fast_pattern; http.host; content:"dk-healthydiet.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010673; classtype:social-engineering; sid:6010673; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (homepage-suitpps.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"homepage-suitpps.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010674; classtype:social-engineering; sid:6010674; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maker-app.at/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"maker-app.at"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010675; classtype:social-engineering; sid:6010675; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (indoamerica200.github.io/libremx/)"; flow:established,to_server; http.uri; content:"/libremx/"; startswith; fast_pattern; http.host; content:"indoamerica200.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010676; classtype:social-engineering; sid:6010676; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (parkeasaring-aw.buzz/fl)"; flow:established,to_server; http.uri; content:"/fl"; startswith; fast_pattern; http.host; content:"parkeasaring-aw.buzz"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010677; classtype:social-engineering; sid:6010677; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (z55gxbf0bb.execute-api.us-west-2.amazonaws.com/track?curr_track_type=link_click&link_id=gchZNr2&temp_id=IjI2OTM3NyI_3D&email_id=mailget_email_id_replace&s_id=mailget_s_id_replace&server=replace_smtp_server&type=replace_drip_type)"; flow:established,to_server; http.uri; content:"/track?curr_track_type=link_click&link_id=gchZNr2&temp_id=IjI2OTM3NyI_3D&email_id=mailget_email_id_replace&s_id=mailget_s_id_replace&server=replace_smtp_server&type=replace_drip_type"; startswith; fast_pattern; http.host; content:"z55gxbf0bb.execute-api.us-west-2.amazonaws.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010678; classtype:social-engineering; sid:6010678; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (theccguy.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"theccguy.netlify.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010679; classtype:social-engineering; sid:6010679; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingeu.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingeu.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010680; classtype:social-engineering; sid:6010680; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingeo.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingeo.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010681; classtype:social-engineering; sid:6010681; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-server-page--lilyjaneleeks1.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-server-page--lilyjaneleeks1.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010682; classtype:social-engineering; sid:6010682; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwc.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010683; classtype:social-engineering; sid:6010683; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.primespotonline.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.primespotonline.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010684; classtype:social-engineering; sid:6010684; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.web-git-05-08-featwebenhancedepthchartwithflipto-60762c-uniswap.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.web-git-05-08-featwebenhancedepthchartwithflipto-60762c-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010685; classtype:social-engineering; sid:6010685; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (htpmwebsunrisemail.flazio.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"htpmwebsunrisemail.flazio.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010686; classtype:social-engineering; sid:6010686; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (glde.click/?email=haliolab@9fa87bf8f06c7a12cad351f9d8782439742e.org)"; flow:established,to_server; http.uri; content:"/?email=haliolab@9fa87bf8f06c7a12cad351f9d8782439742e.org"; startswith; fast_pattern; http.host; content:"glde.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010687; classtype:social-engineering; sid:6010687; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingeq.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingeq.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010688; classtype:social-engineering; sid:6010688; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (navyfederall.com.pinnacletrustbank.com/makingcents/college-planning/post-graduation-repayment.html)"; flow:established,to_server; http.uri; content:"/makingcents/college-planning/post-graduation-repayment.html"; startswith; fast_pattern; http.host; content:"navyfederall.com.pinnacletrustbank.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010689; classtype:social-engineering; sid:6010689; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verseacademy.io/gulfcourt/frnds/rabi/tangpko/ZmlvbmEuYWJiZXlAZGVmZW5jZWZvcmNlcy5pZQ==)"; flow:established,to_server; http.uri; content:"/gulfcourt/frnds/rabi/tangpko/ZmlvbmEuYWJiZXlAZGVmZW5jZWZvcmNlcy5pZQ=="; startswith; fast_pattern; http.host; content:"verseacademy.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010690; classtype:social-engineering; sid:6010690; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dealbamiguel491-maker.github.io/MIGUEL-DE-ALBA)"; flow:established,to_server; http.uri; content:"/MIGUEL-DE-ALBA"; startswith; fast_pattern; http.host; content:"dealbamiguel491-maker.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010691; classtype:social-engineering; sid:6010691; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.86365x.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.86365x.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010692; classtype:social-engineering; sid:6010692; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (visitwatertownwi.com/sgnv/sg/login?id=WYXzSCTJ4E0VTy65WlLcQoZx1S6mFyWzPNROJg4eVSW1gDvCzzHKFazPO0tRBwjTkKZ53iuqgMB2sulpNg8meYnkShZOwIIqkYd&token=emWPwLuyjsJunRFrSPq8bDg3aLEnDNAlO4NYh7HtGBGcfIvIisVJLyWSqTyvBBMsZAoAQ4HthweEvW4hlie13j1Ej52Z)"; flow:established,to_server; http.uri; content:"/sgnv/sg/login?id=WYXzSCTJ4E0VTy65WlLcQoZx1S6mFyWzPNROJg4eVSW1gDvCzzHKFazPO0tRBwjTkKZ53iuqgMB2sulpNg8meYnkShZOwIIqkYd&token=emWPwLuyjsJunRFrSPq8bDg3aLEnDNAlO4NYh7HtGBGcfIvIisVJLyWSqTyvBBMsZAoAQ4HthweEvW4hlie13j1Ej52Z"; startswith; fast_pattern; http.host; content:"visitwatertownwi.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010693; classtype:social-engineering; sid:6010693; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (samplel-ks6yxvur5-instagramm.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"samplel-ks6yxvur5-instagramm.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010694; classtype:social-engineering; sid:6010694; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (red-block-531fly.clyde-e0f.workers.dev/common/oauth2/v2.0/authorize/)"; flow:established,to_server; http.uri; content:"/common/oauth2/v2.0/authorize/"; startswith; fast_pattern; http.host; content:"red-block-531fly.clyde-e0f.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010695; classtype:social-engineering; sid:6010695; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ahmed-reda-elnajjar.github.io/Negroomove/)"; flow:established,to_server; http.uri; content:"/Negroomove/"; startswith; fast_pattern; http.host; content:"ahmed-reda-elnajjar.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010696; classtype:social-engineering; sid:6010696; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (navyfederall.com.pinnacletrustbank.com/makingcents/privacy-security/cybersecurity.html)"; flow:established,to_server; http.uri; content:"/makingcents/privacy-security/cybersecurity.html"; startswith; fast_pattern; http.host; content:"navyfederall.com.pinnacletrustbank.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010697; classtype:social-engineering; sid:6010697; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eu.itpatches.com/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"eu.itpatches.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010698; classtype:social-engineering; sid:6010698; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingso.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingso.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010699; classtype:social-engineering; sid:6010699; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecards.amazingcoupons.co.uk/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"ecards.amazingcoupons.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010700; classtype:social-engineering; sid:6010700; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (user-cembraaap-zone.b-cdn.net/B92x5T/d9fe07c.html)"; flow:established,to_server; http.uri; content:"/B92x5T/d9fe07c.html"; startswith; fast_pattern; http.host; content:"user-cembraaap-zone.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010701; classtype:social-engineering; sid:6010701; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-vrolqar-biz-glarnix-qravtor.pages.dev/...)"; flow:established,to_server; http.uri; content:"/..."; startswith; fast_pattern; http.host; content:"sp1ct6-vrolqar-biz-glarnix-qravtor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010702; classtype:social-engineering; sid:6010702; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bagi-bagi-hadiah677.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bagi-bagi-hadiah677.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010703; classtype:social-engineering; sid:6010703; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreicf7u63fffew5buejmxwltgkvnsyqbnkbcrbrx2bfvw72j2hqy3gu.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreicf7u63fffew5buejmxwltgkvnsyqbnkbcrbrx2bfvw72j2hqy3gu.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010704; classtype:social-engineering; sid:6010704; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (navyfederall.com.pinnacletrustbank.com/services/security/digital-security.html)"; flow:established,to_server; http.uri; content:"/services/security/digital-security.html"; startswith; fast_pattern; http.host; content:"navyfederall.com.pinnacletrustbank.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010705; classtype:social-engineering; sid:6010705; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortup.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortup.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010706; classtype:social-engineering; sid:6010706; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365wtvip.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.365wtvip.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010707; classtype:social-engineering; sid:6010707; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dark-plum-k7yi7i8396.edgeone.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dark-plum-k7yi7i8396.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010708; classtype:social-engineering; sid:6010708; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.jj1775.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.jj1775.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010709; classtype:social-engineering; sid:6010709; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uber-clone-ur.vercel.app/auth/forgot)"; flow:established,to_server; http.uri; content:"/auth/forgot"; startswith; fast_pattern; http.host; content:"uber-clone-ur.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010710; classtype:social-engineering; sid:6010710; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uber-beta-ten.vercel.app/user/login)"; flow:established,to_server; http.uri; content:"/user/login"; startswith; fast_pattern; http.host; content:"uber-beta-ten.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010711; classtype:social-engineering; sid:6010711; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1615666444.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1615666444.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010712; classtype:social-engineering; sid:6010712; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.67395.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.67395.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010713; classtype:social-engineering; sid:6010713; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (navyfederall.com.pinnacletrustbank.com/investment-services/investments.html)"; flow:established,to_server; http.uri; content:"/investment-services/investments.html"; startswith; fast_pattern; http.host; content:"navyfederall.com.pinnacletrustbank.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010714; classtype:social-engineering; sid:6010714; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.21877js.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.21877js.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010715; classtype:social-engineering; sid:6010715; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-black-iota.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-black-iota.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010716; classtype:social-engineering; sid:6010716; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amangirwal.github.io/netflix_clone/)"; flow:established,to_server; http.uri; content:"/netflix_clone/"; startswith; fast_pattern; http.host; content:"amangirwal.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010717; classtype:social-engineering; sid:6010717; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.eu.itpatches.com/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"mail.eu.itpatches.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010718; classtype:social-engineering; sid:6010718; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-glarnor-biz-frapvik-vrolqar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-glarnor-biz-frapvik-vrolqar.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010719; classtype:social-engineering; sid:6010719; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vaibhavexpo.com/ProstBuilders/RandyEubank.html)"; flow:established,to_server; http.uri; content:"/ProstBuilders/RandyEubank.html"; startswith; fast_pattern; http.host; content:"vaibhavexpo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010720; classtype:social-engineering; sid:6010720; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee.firdous.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopee.firdous.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010721; classtype:social-engineering; sid:6010721; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (x-shrtn.com/s/1d3wmu)"; flow:established,to_server; http.uri; content:"/s/1d3wmu"; startswith; fast_pattern; http.host; content:"x-shrtn.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010722; classtype:social-engineering; sid:6010722; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pp7765.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pp7765.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010723; classtype:social-engineering; sid:6010723; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingst.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingst.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010724; classtype:social-engineering; sid:6010724; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hackerog17.github.io/1k-on-ur-instagram-account)"; flow:established,to_server; http.uri; content:"/1k-on-ur-instagram-account"; startswith; fast_pattern; http.host; content:"hackerog17.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010725; classtype:social-engineering; sid:6010725; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.navyfederall.com.pinnacletrustbank.com/makingcents/savings-budgeting/budgeting-tips.html)"; flow:established,to_server; http.uri; content:"/makingcents/savings-budgeting/budgeting-tips.html"; startswith; fast_pattern; http.host; content:"www.navyfederall.com.pinnacletrustbank.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010726; classtype:social-engineering; sid:6010726; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.57365y.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.57365y.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010727; classtype:social-engineering; sid:6010727; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-clone-blue-iota.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-blue-iota.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010728; classtype:social-engineering; sid:6010728; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.stabblepolicyreview.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.stabblepolicyreview.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010729; classtype:social-engineering; sid:6010729; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi7767.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.info-resmi7767.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010730; classtype:social-engineering; sid:6010730; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bloxy-fyxrbx.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bloxy-fyxrbx.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010731; classtype:social-engineering; sid:6010731; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15373.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15373.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010732; classtype:social-engineering; sid:6010732; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lucroemalta.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"lucroemalta.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010733; classtype:social-engineering; sid:6010733; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingso.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingso.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010734; classtype:social-engineering; sid:6010734; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-frulnik-biz-qravtor-vrolnax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-frulnik-biz-qravtor-vrolnax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010735; classtype:social-engineering; sid:6010735; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gmb.xhalo.co/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gmb.xhalo.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010736; classtype:social-engineering; sid:6010736; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-fravnik-biz-qoltex-slarnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-fravnik-biz-qoltex-slarnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010737; classtype:social-engineering; sid:6010737; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rajatsaini90420.github.io/Amazon-Clone-Website/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone-Website/"; startswith; fast_pattern; http.host; content:"rajatsaini90420.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010738; classtype:social-engineering; sid:6010738; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-glavnex-biz-drurnik-qravtex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-glavnex-biz-drurnik-qravtex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010739; classtype:social-engineering; sid:6010739; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17569.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17569.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010740; classtype:social-engineering; sid:6010740; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.confirm-address-changing.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.confirm-address-changing.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010741; classtype:social-engineering; sid:6010741; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adiborty-code.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"adiborty-code.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010742; classtype:social-engineering; sid:6010742; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-prduction-user-58774889.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-prduction-user-58774889.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010743; classtype:social-engineering; sid:6010743; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (logsys476-pgvy.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"logsys476-pgvy.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010744; classtype:social-engineering; sid:6010744; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (control-credito.vercel.app/hsbc/index.html)"; flow:established,to_server; http.uri; content:"/hsbc/index.html"; startswith; fast_pattern; http.host; content:"control-credito.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010745; classtype:social-engineering; sid:6010745; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwc.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwc.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010746; classtype:social-engineering; sid:6010746; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usuariosmx2026.iceiy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"usuariosmx2026.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010747; classtype:social-engineering; sid:6010747; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.2461870365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.2461870365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010748; classtype:social-engineering; sid:6010748; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (freelanceconnect.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"freelanceconnect.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010749; classtype:social-engineering; sid:6010749; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dsk010101010001010010.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.dsk010101010001010010.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010750; classtype:social-engineering; sid:6010750; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingei.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingei.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010751; classtype:social-engineering; sid:6010751; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portal.e-docssign.net/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"portal.e-docssign.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010752; classtype:social-engineering; sid:6010752; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aalima4477-ux.github.io/ALERT-IG/)"; flow:established,to_server; http.uri; content:"/ALERT-IG/"; startswith; fast_pattern; http.host; content:"aalima4477-ux.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010753; classtype:social-engineering; sid:6010753; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-m277.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-m277.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010754; classtype:social-engineering; sid:6010754; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp.verify.help/?%20p=9647719774647)"; flow:established,to_server; http.uri; content:"/?%20p=9647719774647"; startswith; fast_pattern; http.host; content:"whatsapp.verify.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010755; classtype:social-engineering; sid:6010755; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwx.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwx.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010756; classtype:social-engineering; sid:6010756; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (program-resmi979.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"program-resmi979.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010757; classtype:social-engineering; sid:6010757; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fortview.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fortview.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010758; classtype:social-engineering; sid:6010758; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cez.dvf.mybluehost.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cez.dvf.mybluehost.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010759; classtype:social-engineering; sid:6010759; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whataspp.verify.help/v/?p=9647719774647)"; flow:established,to_server; http.uri; content:"/v/?p=9647719774647"; startswith; fast_pattern; http.host; content:"whataspp.verify.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010760; classtype:social-engineering; sid:6010760; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vaibhavexpo.com/shoeishipmanagmentptelimited/tomitaakihiroopendocaccess.html)"; flow:established,to_server; http.uri; content:"/shoeishipmanagmentptelimited/tomitaakihiroopendocaccess.html"; startswith; fast_pattern; http.host; content:"vaibhavexpo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010761; classtype:social-engineering; sid:6010761; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure.new.hr-rewards.com/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"secure.new.hr-rewards.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010762; classtype:social-engineering; sid:6010762; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.trust-wallet-en.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.trust-wallet-en.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010763; classtype:social-engineering; sid:6010763; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (innogy.e-docssign.net/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"innogy.e-docssign.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010764; classtype:social-engineering; sid:6010764; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingeg.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingeg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010765; classtype:social-engineering; sid:6010765; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (postch-swisspost.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"postch-swisspost.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010766; classtype:social-engineering; sid:6010766; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingee.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingee.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010767; classtype:social-engineering; sid:6010767; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tamdaiphat5.github.io/security)"; flow:established,to_server; http.uri; content:"/security"; startswith; fast_pattern; http.host; content:"tamdaiphat5.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010768; classtype:social-engineering; sid:6010768; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (document.webshar.es/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"document.webshar.es"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010769; classtype:social-engineering; sid:6010769; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (https-544nddedc44342442442423232342-e3a8.tony-f61.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"https-544nddedc44342442442423232342-e3a8.tony-f61.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010770; classtype:social-engineering; sid:6010770; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vardhan8060.github.io/javascript-ecommerce-project/)"; flow:established,to_server; http.uri; content:"/javascript-ecommerce-project/"; startswith; fast_pattern; http.host; content:"vardhan8060.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010771; classtype:social-engineering; sid:6010771; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.9247870365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.9247870365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010772; classtype:social-engineering; sid:6010772; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bocai2027.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bocai2027.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010773; classtype:social-engineering; sid:6010773; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hskh-9860.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hskh-9860.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010774; classtype:social-engineering; sid:6010774; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (https-www--roblox.com/users/1562559105/profile)"; flow:established,to_server; http.uri; content:"/users/1562559105/profile"; startswith; fast_pattern; http.host; content:"https-www--roblox.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010775; classtype:social-engineering; sid:6010775; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vermillion-churros-e00a9a.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vermillion-churros-e00a9a.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010776; classtype:social-engineering; sid:6010776; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (beta-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"beta-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010777; classtype:social-engineering; sid:6010777; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingsu.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingsu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010778; classtype:social-engineering; sid:6010778; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-drulqor-biz-fruntax-plarnix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-drulqor-biz-fruntax-plarnix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010779; classtype:social-engineering; sid:6010779; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.d666f999.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.d666f999.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010780; classtype:social-engineering; sid:6010780; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-clone-lilac-eight.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-lilac-eight.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010781; classtype:social-engineering; sid:6010781; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uber-clone-ur.vercel.app/auth/signup)"; flow:established,to_server; http.uri; content:"/auth/signup"; startswith; fast_pattern; http.host; content:"uber-clone-ur.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010782; classtype:social-engineering; sid:6010782; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ptshopee033.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ptshopee033.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010783; classtype:social-engineering; sid:6010783; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-sigma-hazel.vercel.app/auth)"; flow:established,to_server; http.uri; content:"/auth"; startswith; fast_pattern; http.host; content:"netflix-clone-sigma-hazel.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010784; classtype:social-engineering; sid:6010784; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verseacademy.io/gulfcourt/frnds/rabi/xulyafs/ZXVzcGFyZUBodWF3ZWkuY29t)"; flow:established,to_server; http.uri; content:"/gulfcourt/frnds/rabi/xulyafs/ZXVzcGFyZUBodWF3ZWkuY29t"; startswith; fast_pattern; http.host; content:"verseacademy.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010785; classtype:social-engineering; sid:6010785; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eu.itpatches.com/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"eu.itpatches.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010786; classtype:social-engineering; sid:6010786; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eosvx.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eosvx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010787; classtype:social-engineering; sid:6010787; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (indoonxpayllaterrnew.bestxzor.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"indoonxpayllaterrnew.bestxzor.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010788; classtype:social-engineering; sid:6010788; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi7767.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"info-resmi7767.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010789; classtype:social-engineering; sid:6010789; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sliwxcc.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sliwxcc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010790; classtype:social-engineering; sid:6010790; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.icloud.camerpresse.com/token=idcston/)"; flow:established,to_server; http.uri; content:"/token=idcston/"; startswith; fast_pattern; http.host; content:"www.icloud.camerpresse.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010791; classtype:social-engineering; sid:6010791; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.support-ict.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.support-ict.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010792; classtype:social-engineering; sid:6010792; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.auth983781901982737192.ocslinicals.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.auth983781901982737192.ocslinicals.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010793; classtype:social-engineering; sid:6010793; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (identifiez-vous42.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"identifiez-vous42.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010794; classtype:social-engineering; sid:6010794; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sunrisemailweb.flazio.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sunrisemailweb.flazio.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010795; classtype:social-engineering; sid:6010795; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vmi3340884.contaboserver.net/cr/corres/COR/COR/corr.php)"; flow:established,to_server; http.uri; content:"/cr/corres/COR/COR/corr.php"; startswith; fast_pattern; http.host; content:"vmi3340884.contaboserver.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010796; classtype:social-engineering; sid:6010796; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nzeljf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nzeljf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010797; classtype:social-engineering; sid:6010797; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (escehrgroup.com/?email=d)"; flow:established,to_server; http.uri; content:"/?email=d"; startswith; fast_pattern; http.host; content:"escehrgroup.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010798; classtype:social-engineering; sid:6010798; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ptshopee033.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ptshopee033.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010799; classtype:social-engineering; sid:6010799; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingew.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingew.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010800; classtype:social-engineering; sid:6010800; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.systxt754-sgbi.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.systxt754-sgbi.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010801; classtype:social-engineering; sid:6010801; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-plornex-biz-slortik-frunvor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-plornex-biz-slortik-frunvor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010802; classtype:social-engineering; sid:6010802; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingsi.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingsi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010803; classtype:social-engineering; sid:6010803; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sim-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.sim-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010804; classtype:social-engineering; sid:6010804; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (post-avis-de-passage-relivraison.vercel.app/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"post-avis-de-passage-relivraison.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010805; classtype:social-engineering; sid:6010805; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwm.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwm.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010806; classtype:social-engineering; sid:6010806; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (009987b555552.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"009987b555552.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010807; classtype:social-engineering; sid:6010807; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-tramvor-biz-glarnik-drultex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-tramvor-biz-glarnik-drultex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010808; classtype:social-engineering; sid:6010808; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bellojawad4111.github.io/My-facebook-page/)"; flow:established,to_server; http.uri; content:"/My-facebook-page/"; startswith; fast_pattern; http.host; content:"bellojawad4111.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010809; classtype:social-engineering; sid:6010809; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bagi-bagi-hadiah677.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bagi-bagi-hadiah677.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010810; classtype:social-engineering; sid:6010810; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (navyfederall.com.pinnacletrustbank.com/investment-services/investments/digital-investor.html)"; flow:established,to_server; http.uri; content:"/investment-services/investments/digital-investor.html"; startswith; fast_pattern; http.host; content:"navyfederall.com.pinnacletrustbank.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010811; classtype:social-engineering; sid:6010811; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (visitwatertownwi.com/sgnv/sg/login/fr/login.php)"; flow:established,to_server; http.uri; content:"/sgnv/sg/login/fr/login.php"; startswith; fast_pattern; http.host; content:"visitwatertownwi.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010812; classtype:social-engineering; sid:6010812; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreib2ofz55l4gjzluimk6wkhcxlj2avfmbmkjlsp442cnzirap3ckjy.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreib2ofz55l4gjzluimk6wkhcxlj2avfmbmkjlsp442cnzirap3ckjy.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010813; classtype:social-engineering; sid:6010813; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tinyurl.com/InterDelivery)"; flow:established,to_server; http.uri; content:"/InterDelivery"; startswith; fast_pattern; http.host; content:"tinyurl.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010814; classtype:social-engineering; sid:6010814; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.123trx.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.123trx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010815; classtype:social-engineering; sid:6010815; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-stack.pages.dev/appeals/submit-appeal-form/return)"; flow:established,to_server; http.uri; content:"/appeals/submit-appeal-form/return"; startswith; fast_pattern; http.host; content:"meta-stack.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010816; classtype:social-engineering; sid:6010816; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-tramvor-biz-dranqor-vralnix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-tramvor-biz-dranqor-vralnix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010817; classtype:social-engineering; sid:6010817; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.2349365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.2349365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010818; classtype:social-engineering; sid:6010818; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (navyfederall.com.pinnacletrustbank.com/loans-cards/credit-cards/cardholder-resources/balance-transfers.html)"; flow:established,to_server; http.uri; content:"/loans-cards/credit-cards/cardholder-resources/balance-transfers.html"; startswith; fast_pattern; http.host; content:"navyfederall.com.pinnacletrustbank.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010819; classtype:social-engineering; sid:6010819; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.navyfederall.com.pinnacletrustbank.com/makingcents/college-planning.html)"; flow:established,to_server; http.uri; content:"/makingcents/college-planning.html"; startswith; fast_pattern; http.host; content:"www.navyfederall.com.pinnacletrustbank.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010820; classtype:social-engineering; sid:6010820; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (axincoin.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"axincoin.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010821; classtype:social-engineering; sid:6010821; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telefoon.flazio.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"telefoon.flazio.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010822; classtype:social-engineering; sid:6010822; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1615555333.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1615555333.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010823; classtype:social-engineering; sid:6010823; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (feiji-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"feiji-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010824; classtype:social-engineering; sid:6010824; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazonwebclone-alpha.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazonwebclone-alpha.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010825; classtype:social-engineering; sid:6010825; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bwpyex.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bwpyex.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010826; classtype:social-engineering; sid:6010826; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-support-bridge.pages.dev/appeals/submit-appeal-form/return)"; flow:established,to_server; http.uri; content:"/appeals/submit-appeal-form/return"; startswith; fast_pattern; http.host; content:"meta-support-bridge.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010827; classtype:social-engineering; sid:6010827; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (postch-swisspost.com/pages/ban.php)"; flow:established,to_server; http.uri; content:"/pages/ban.php"; startswith; fast_pattern; http.host; content:"postch-swisspost.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010828; classtype:social-engineering; sid:6010828; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.fraud-protect.com/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"login.fraud-protect.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010829; classtype:social-engineering; sid:6010829; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwf.docyourchange.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wwf.docyourchange.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010830; classtype:social-engineering; sid:6010830; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-aegis-u4o.pages.dev/appeals/submit-appeal-form/return)"; flow:established,to_server; http.uri; content:"/appeals/submit-appeal-form/return"; startswith; fast_pattern; http.host; content:"meta-aegis-u4o.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010831; classtype:social-engineering; sid:6010831; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.navyfederall.com.pinnacletrustbank.com/checking-savings/savings/education-savings.html)"; flow:established,to_server; http.uri; content:"/checking-savings/savings/education-savings.html"; startswith; fast_pattern; http.host; content:"www.navyfederall.com.pinnacletrustbank.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010832; classtype:social-engineering; sid:6010832; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (navyfederall.com.pinnacletrustbank.com/loans-cards/equity/fixed-rate.html)"; flow:established,to_server; http.uri; content:"/loans-cards/equity/fixed-rate.html"; startswith; fast_pattern; http.host; content:"navyfederall.com.pinnacletrustbank.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010833; classtype:social-engineering; sid:6010833; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (document.webshar.es/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa/)"; flow:established,to_server; http.uri; content:"/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa/"; startswith; fast_pattern; http.host; content:"document.webshar.es"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010834; classtype:social-engineering; sid:6010834; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (idapple-br.com/tTkcz/)"; flow:established,to_server; http.uri; content:"/tTkcz/"; startswith; fast_pattern; http.host; content:"idapple-br.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010835; classtype:social-engineering; sid:6010835; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-vrolqar-biz-glarnix-qravtor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-vrolqar-biz-glarnix-qravtor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010836; classtype:social-engineering; sid:6010836; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qinzhou-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qinzhou-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010837; classtype:social-engineering; sid:6010837; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nehagupta-coder.github.io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"nehagupta-coder.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010838; classtype:social-engineering; sid:6010838; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365756zxd.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"365756zxd.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010839; classtype:social-engineering; sid:6010839; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nationwidelicensingsystem.docmechdel.sbs/d0cs/d0cs/windows/utility.php/)"; flow:established,to_server; http.uri; content:"/d0cs/d0cs/windows/utility.php/"; startswith; fast_pattern; http.host; content:"nationwidelicensingsystem.docmechdel.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010840; classtype:social-engineering; sid:6010840; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-xolnex-biz-vraltor-drunik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-xolnex-biz-vraltor-drunik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010841; classtype:social-engineering; sid:6010841; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kingswet431-spec.github.io/for-real-use/)"; flow:established,to_server; http.uri; content:"/for-real-use/"; startswith; fast_pattern; http.host; content:"kingswet431-spec.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010842; classtype:social-engineering; sid:6010842; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info.remote-otp.com/homepage/corporate-offer?rid=QGtPzS6)"; flow:established,to_server; http.uri; content:"/homepage/corporate-offer?rid=QGtPzS6"; startswith; fast_pattern; http.host; content:"info.remote-otp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010843; classtype:social-engineering; sid:6010843; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sreenu9133.github.io/insta-login-page-ui)"; flow:established,to_server; http.uri; content:"/insta-login-page-ui"; startswith; fast_pattern; http.host; content:"sreenu9133.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010844; classtype:social-engineering; sid:6010844; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (navyfederall.com.pinnacletrustbank.com/loans-cards/auto-loans/leisure-vehicle-loans.html)"; flow:established,to_server; http.uri; content:"/loans-cards/auto-loans/leisure-vehicle-loans.html"; startswith; fast_pattern; http.host; content:"navyfederall.com.pinnacletrustbank.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010845; classtype:social-engineering; sid:6010845; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.authorised-support.com/microsoft365/mfa/PA7DrZmy7BgokPONGDiZO9H9kV8qJ8Ly5VEA=2Aw==3XlpQQVxAXFVHbF5VUmxfXFRaXQ==/7XkYq0JOunZn8Twk5JBWTMExm1brXaV5)"; flow:established,to_server; http.uri; content:"/microsoft365/mfa/PA7DrZmy7BgokPONGDiZO9H9kV8qJ8Ly5VEA=2Aw==3XlpQQVxAXFVHbF5VUmxfXFRaXQ==/7XkYq0JOunZn8Twk5JBWTMExm1brXaV5"; startswith; fast_pattern; http.host; content:"login.authorised-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010846; classtype:social-engineering; sid:6010846; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingeu.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingeu.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010847; classtype:social-engineering; sid:6010847; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tiktoke.fit/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tiktoke.fit"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010848; classtype:social-engineering; sid:6010848; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwx.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwx.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010849; classtype:social-engineering; sid:6010849; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.eu.itpatches.com/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"mail.eu.itpatches.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010850; classtype:social-engineering; sid:6010850; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-sigma-hazel.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-sigma-hazel.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010851; classtype:social-engineering; sid:6010851; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (escehrgroup.com/4533998ab9a0b9fc)"; flow:established,to_server; http.uri; content:"/4533998ab9a0b9fc"; startswith; fast_pattern; http.host; content:"escehrgroup.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010852; classtype:social-engineering; sid:6010852; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-git-brnunes-web-auction-allow-sepolia-uniswap.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-git-brnunes-web-auction-allow-sepolia-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010853; classtype:social-engineering; sid:6010853; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingst.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingst.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010854; classtype:social-engineering; sid:6010854; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecards.amazingcoupons.co.uk/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"ecards.amazingcoupons.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010855; classtype:social-engineering; sid:6010855; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.navyfederall.com.pinnacletrustbank.com/investment-services/investments609c.html?intcmp=nfo%7Cnav%7C%7Cnfis%7Cinvst%7Cmenu%7C02242024%7C%7Cinvestments%7C)"; flow:established,to_server; http.uri; content:"/investment-services/investments609c.html?intcmp=nfo%7Cnav%7C%7Cnfis%7Cinvst%7Cmenu%7C02242024%7C%7Cinvestments%7C"; startswith; fast_pattern; http.host; content:"www.navyfederall.com.pinnacletrustbank.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010856; classtype:social-engineering; sid:6010856; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17537.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17537.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010857; classtype:social-engineering; sid:6010857; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.214365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.214365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010858; classtype:social-engineering; sid:6010858; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aav-zra-biz-kpo-miv-sp7ct2.pages.dev/form_submit_appeal/)"; flow:established,to_server; http.uri; content:"/form_submit_appeal/"; startswith; fast_pattern; http.host; content:"aav-zra-biz-kpo-miv-sp7ct2.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010859; classtype:social-engineering; sid:6010859; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (basic-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"basic-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010860; classtype:social-engineering; sid:6010860; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.fraud-protect.com/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"login.fraud-protect.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010861; classtype:social-engineering; sid:6010861; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.navyfederall.com.pinnacletrustbank.com/loans-cards/auto-loans/boat-loans.html)"; flow:established,to_server; http.uri; content:"/loans-cards/auto-loans/boat-loans.html"; startswith; fast_pattern; http.host; content:"www.navyfederall.com.pinnacletrustbank.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010862; classtype:social-engineering; sid:6010862; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sirivarshini04.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"sirivarshini04.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010863; classtype:social-engineering; sid:6010863; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6318365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6318365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010864; classtype:social-engineering; sid:6010864; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zaidbek.github.io/unstagram/index.html)"; flow:established,to_server; http.uri; content:"/unstagram/index.html"; startswith; fast_pattern; http.host; content:"zaidbek.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010865; classtype:social-engineering; sid:6010865; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.navyfederall.com.pinnacletrustbank.com/checking-savings/savings/emergency-fund.html)"; flow:established,to_server; http.uri; content:"/checking-savings/savings/emergency-fund.html"; startswith; fast_pattern; http.host; content:"www.navyfederall.com.pinnacletrustbank.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010866; classtype:social-engineering; sid:6010866; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.trip-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.trip-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010867; classtype:social-engineering; sid:6010867; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-traqnik-biz-glurnor-plavtex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-traqnik-biz-glurnor-plavtex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010868; classtype:social-engineering; sid:6010868; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.amazon-clone-coral-nine.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazon-clone-coral-nine.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010869; classtype:social-engineering; sid:6010869; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1615www.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1615www.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010870; classtype:social-engineering; sid:6010870; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (parcelhouse.4-222-235-4.cpanel.site/eu/)"; flow:established,to_server; http.uri; content:"/eu/"; startswith; fast_pattern; http.host; content:"parcelhouse.4-222-235-4.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010871; classtype:social-engineering; sid:6010871; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wearetogetda.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wearetogetda.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010872; classtype:social-engineering; sid:6010872; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paruchuruvyshnavi.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"paruchuruvyshnavi.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010873; classtype:social-engineering; sid:6010873; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.spotify-clone-project-ashy.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.spotify-clone-project-ashy.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010874; classtype:social-engineering; sid:6010874; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (good.coinbase-inv.vip/?adid=1230706)"; flow:established,to_server; http.uri; content:"/?adid=1230706"; startswith; fast_pattern; http.host; content:"good.coinbase-inv.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010875; classtype:social-engineering; sid:6010875; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sources.sviluppo.host/Login/S2FB10FG5N4FG4N154DR1G52RE1H45RT1HJ0000000E241R4H1ER1H00000/)"; flow:established,to_server; http.uri; content:"/Login/S2FB10FG5N4FG4N154DR1G52RE1H45RT1HJ0000000E241R4H1ER1H00000/"; startswith; fast_pattern; http.host; content:"sources.sviluppo.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010876; classtype:social-engineering; sid:6010876; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portal.e-docssign.net/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"portal.e-docssign.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010877; classtype:social-engineering; sid:6010877; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kanji138.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kanji138.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010878; classtype:social-engineering; sid:6010878; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.navyfederall.com.pinnacletrustbank.com/investment-services.html)"; flow:established,to_server; http.uri; content:"/investment-services.html"; startswith; fast_pattern; http.host; content:"www.navyfederall.com.pinnacletrustbank.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010879; classtype:social-engineering; sid:6010879; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee-pusat1212.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.shopee-pusat1212.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010880; classtype:social-engineering; sid:6010880; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (navyfederall.com.pinnacletrustbank.com/checking-savings/savings/savings-basics.html)"; flow:established,to_server; http.uri; content:"/checking-savings/savings/savings-basics.html"; startswith; fast_pattern; http.host; content:"navyfederall.com.pinnacletrustbank.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010881; classtype:social-engineering; sid:6010881; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (theqntp.com/authy/?=1TEgjGuEyd3bgmsAmjCTL8B0pW3OteXuTDtuV0qttUtwC3WvJWPJrOe2hajAgX6SrWbCe44ab7IehPtTkdAQbZIG9maiTQlx54LRYegwutGVXB6HexscVJ3oOHMFHN1BmSS5FT26UEFYmObZPVLbE7G4v3slPwTJ3ZvypZrYEbkYb8MmLWOxhiUNywJYUGIumyOaWKO3)"; flow:established,to_server; http.uri; content:"/authy/?=1TEgjGuEyd3bgmsAmjCTL8B0pW3OteXuTDtuV0qttUtwC3WvJWPJrOe2hajAgX6SrWbCe44ab7IehPtTkdAQbZIG9maiTQlx54LRYegwutGVXB6HexscVJ3oOHMFHN1BmSS5FT26UEFYmObZPVLbE7G4v3slPwTJ3ZvypZrYEbkYb8MmLWOxhiUNywJYUGIumyOaWKO3"; startswith; fast_pattern; http.host; content:"theqntp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010882; classtype:social-engineering; sid:6010882; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-vraltik-biz-glortex-dramnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-vraltik-biz-glortex-dramnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010883; classtype:social-engineering; sid:6010883; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-6xk.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-6xk.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010884; classtype:social-engineering; sid:6010884; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-m277.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-m277.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010885; classtype:social-engineering; sid:6010885; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (theccguy.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"theccguy.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010886; classtype:social-engineering; sid:6010886; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17553.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17553.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010887; classtype:social-engineering; sid:6010887; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee-pusat1212.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopee-pusat1212.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010888; classtype:social-engineering; sid:6010888; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17559.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17559.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010889; classtype:social-engineering; sid:6010889; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (user-cembraaap-hostname.b-cdn.net/B92x5T/d9fe07c.html?t=75fKocgGIpVxuo0l65wSjf8_Wexjryv9ww)"; flow:established,to_server; http.uri; content:"/B92x5T/d9fe07c.html?t=75fKocgGIpVxuo0l65wSjf8_Wexjryv9ww"; startswith; fast_pattern; http.host; content:"user-cembraaap-hostname.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010890; classtype:social-engineering; sid:6010890; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1xlite-94803.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1xlite-94803.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010891; classtype:social-engineering; sid:6010891; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-clone-umber-kappa.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-umber-kappa.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010892; classtype:social-engineering; sid:6010892; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (double-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"double-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010893; classtype:social-engineering; sid:6010893; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ww87365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ww87365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010894; classtype:social-engineering; sid:6010894; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icy-resonance-7dea.pete-803.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"icy-resonance-7dea.pete-803.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010895; classtype:social-engineering; sid:6010895; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (majorartproductions.com/doc/)"; flow:established,to_server; http.uri; content:"/doc/"; startswith; fast_pattern; http.host; content:"majorartproductions.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010896; classtype:social-engineering; sid:6010896; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15393.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15393.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010897; classtype:social-engineering; sid:6010897; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15823.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15823.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010898; classtype:social-engineering; sid:6010898; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ymca.hostel.town/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ymca.hostel.town"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010899; classtype:social-engineering; sid:6010899; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-fralnix-biz-glortek-plurnax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-fralnix-biz-glortek-plurnax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010900; classtype:social-engineering; sid:6010900; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cez.dvf.mybluehost.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cez.dvf.mybluehost.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010901; classtype:social-engineering; sid:6010901; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-qurnex-biz-plarnik-glotex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-qurnex-biz-plarnik-glotex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010902; classtype:social-engineering; sid:6010902; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-pink-kappa.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-pink-kappa.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010903; classtype:social-engineering; sid:6010903; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (albertjataya.org/BG/)"; flow:established,to_server; http.uri; content:"/BG/"; startswith; fast_pattern; http.host; content:"albertjataya.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010904; classtype:social-engineering; sid:6010904; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-zernivax.pages.dev/appeals/submit-appeal-form/return)"; flow:established,to_server; http.uri; content:"/appeals/submit-appeal-form/return"; startswith; fast_pattern; http.host; content:"meta-zernivax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010905; classtype:social-engineering; sid:6010905; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (user-cembraaap-location.b-cdn.net/B92x5T/d9fe07c.html?amp\;b=DHGYU3&t=VJpN7-OYUw_LE9CD4TJ7lIQV1Go2lHPQ8OSy)"; flow:established,to_server; http.uri; content:"/B92x5T/d9fe07c.html?amp|3b|b=DHGYU3&t=VJpN7-OYUw_LE9CD4TJ7lIQV1Go2lHPQ8OSy"; startswith; fast_pattern; http.host; content:"user-cembraaap-location.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010906; classtype:social-engineering; sid:6010906; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15395.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15395.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010907; classtype:social-engineering; sid:6010907; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (identifiez-vous42.godaddysites.com/identifiez-vous)"; flow:established,to_server; http.uri; content:"/identifiez-vous"; startswith; fast_pattern; http.host; content:"identifiez-vous42.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010908; classtype:social-engineering; sid:6010908; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (navyfederall.com.pinnacletrustbank.com/services/business/membership.html)"; flow:established,to_server; http.uri; content:"/services/business/membership.html"; startswith; fast_pattern; http.host; content:"navyfederall.com.pinnacletrustbank.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010909; classtype:social-engineering; sid:6010909; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (innogy.e-docssign.net/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"innogy.e-docssign.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010910; classtype:social-engineering; sid:6010910; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ymca.hostel.town/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ymca.hostel.town"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010911; classtype:social-engineering; sid:6010911; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-nextjs-sooty.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-nextjs-sooty.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010912; classtype:social-engineering; sid:6010912; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.e-odemeler.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.e-odemeler.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010913; classtype:social-engineering; sid:6010913; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure.new.hr-rewards.com/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"secure.new.hr-rewards.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010914; classtype:social-engineering; sid:6010914; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-page-trezor.wixstudio.com/us-bridge)"; flow:established,to_server; http.uri; content:"/us-bridge"; startswith; fast_pattern; http.host; content:"app-page-trezor.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010915; classtype:social-engineering; sid:6010915; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (userede.sac-venda.com/index.php?token=BaPVfgHTw1xM8vMIfEhe)"; flow:established,to_server; http.uri; content:"/index.php?token=BaPVfgHTw1xM8vMIfEhe"; startswith; fast_pattern; http.host; content:"userede.sac-venda.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010916; classtype:social-engineering; sid:6010916; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.pl-214154.cfd/oferta/rower-wodny-pelikan-22/68838)"; flow:established,to_server; http.uri; content:"/oferta/rower-wodny-pelikan-22/68838"; startswith; fast_pattern; http.host; content:"allegrolokalnie.pl-214154.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010917; classtype:social-engineering; sid:6010917; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-authentication.secure-datalink.org/landing/form/6268997c-22d3-4670-a7b1-d486420fb4ac)"; flow:established,to_server; http.uri; content:"/landing/form/6268997c-22d3-4670-a7b1-d486420fb4ac"; startswith; fast_pattern; http.host; content:"facebook-authentication.secure-datalink.org"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010918; classtype:social-engineering; sid:6010918; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prime-video-facture.com/suivi)"; flow:established,to_server; http.uri; content:"/suivi"; startswith; fast_pattern; http.host; content:"prime-video-facture.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010919; classtype:social-engineering; sid:6010919; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myviewikjmts.mntbell.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"myviewikjmts.mntbell.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010920; classtype:social-engineering; sid:6010920; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.cxrmptv.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.cxrmptv.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010921; classtype:social-engineering; sid:6010921; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xdmcta.top/pay/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.xdmcta.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010922; classtype:social-engineering; sid:6010922; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (l-iniciarseuatendimentohoje.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"l-iniciarseuatendimentohoje.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010923; classtype:social-engineering; sid:6010923; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-dranqor-biz-vralnik-gluntex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-dranqor-biz-vralnik-gluntex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010924; classtype:social-engineering; sid:6010924; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coversmine.weebly.com/blog/wwe-2k-battlegrounds-caw)"; flow:established,to_server; http.uri; content:"/blog/wwe-2k-battlegrounds-caw"; startswith; fast_pattern; http.host; content:"coversmine.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010925; classtype:social-engineering; sid:6010925; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rokpbm.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.rokpbm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010926; classtype:social-engineering; sid:6010926; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (useforhuzaifa-wq.github.io/Amazon-web-2/)"; flow:established,to_server; http.uri; content:"/Amazon-web-2/"; startswith; fast_pattern; http.host; content:"useforhuzaifa-wq.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010927; classtype:social-engineering; sid:6010927; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-fraltor-biz-vrolqor-qarnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-fraltor-biz-vrolqor-qarnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010928; classtype:social-engineering; sid:6010928; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-glavtex-biz-fruntor-vranik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-glavtex-biz-fruntor-vranik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010929; classtype:social-engineering; sid:6010929; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.whsnxl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.whsnxl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010930; classtype:social-engineering; sid:6010930; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingey.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingey.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010931; classtype:social-engineering; sid:6010931; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.rwenzoritechub.com/doublec/po/rabi/xnkPvzG/amFzb24uYmVhdW1vbnRAbXl0b25mb29kZ3JvdXAuY29t)"; flow:established,to_server; http.uri; content:"/doublec/po/rabi/xnkPvzG/amFzb24uYmVhdW1vbnRAbXl0b25mb29kZ3JvdXAuY29t"; startswith; fast_pattern; http.host; content:"www.rwenzoritechub.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010932; classtype:social-engineering; sid:6010932; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (above-directly-entity-revolution.trycloudflare.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"above-directly-entity-revolution.trycloudflare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010933; classtype:social-engineering; sid:6010933; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oakandgarden.eu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"oakandgarden.eu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010934; classtype:social-engineering; sid:6010934; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (k69g.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"k69g.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010935; classtype:social-engineering; sid:6010935; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (syszgd.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"syszgd.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010936; classtype:social-engineering; sid:6010936; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oily-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"oily-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010937; classtype:social-engineering; sid:6010937; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-tranqax-biz-plurnor-qravtek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-tranqax-biz-plurnor-qravtek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010938; classtype:social-engineering; sid:6010938; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.scqyjo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.scqyjo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010939; classtype:social-engineering; sid:6010939; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jcshyt.top/pay/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.jcshyt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010940; classtype:social-engineering; sid:6010940; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.roblox.com.kz/users/1179291790/profile)"; flow:established,to_server; http.uri; content:"/users/1179291790/profile"; startswith; fast_pattern; http.host; content:"www.roblox.com.kz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010941; classtype:social-engineering; sid:6010941; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17402.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17402.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010942; classtype:social-engineering; sid:6010942; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dsk010101010001010010.vercel.app/Ma010chelpAbh1041/index.html?ph0nq=null)"; flow:established,to_server; http.uri; content:"/Ma010chelpAbh1041/index.html?ph0nq=null"; startswith; fast_pattern; http.host; content:"dsk010101010001010010.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010943; classtype:social-engineering; sid:6010943; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hjsu8m.naifei.bet/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hjsu8m.naifei.bet"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010944; classtype:social-engineering; sid:6010944; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-clone-delta-hazel.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-delta-hazel.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010945; classtype:social-engineering; sid:6010945; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-page-builder--lucasas22.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-page-builder--lucasas22.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010946; classtype:social-engineering; sid:6010946; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (makeredto.org/wp-content/themes/help/hard_88390993993/ups/indexbill.php?info=Global&)"; flow:established,to_server; http.uri; content:"/wp-content/themes/help/hard_88390993993/ups/indexbill.php?info=Global&"; startswith; fast_pattern; http.host; content:"makeredto.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010947; classtype:social-engineering; sid:6010947; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (emamazumder.github.io/Amazon-Clone-Website)"; flow:established,to_server; http.uri; content:"/Amazon-Clone-Website"; startswith; fast_pattern; http.host; content:"emamazumder.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010948; classtype:social-engineering; sid:6010948; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mgyisw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mgyisw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010949; classtype:social-engineering; sid:6010949; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-qravlor-biz-slurnik-framvor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-qravlor-biz-slurnik-framvor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010950; classtype:social-engineering; sid:6010950; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bigelsinindirimkodu.amazingcoupons.co.uk/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"bigelsinindirimkodu.amazingcoupons.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010951; classtype:social-engineering; sid:6010951; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-tramtek-biz-vraqnix-slarnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-tramtek-biz-vraqnix-slarnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010952; classtype:social-engineering; sid:6010952; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f-feiraosrs2026.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f-feiraosrs2026.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010953; classtype:social-engineering; sid:6010953; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-nolvarin.pages.dev/appeals/submit-appeal-form/return)"; flow:established,to_server; http.uri; content:"/appeals/submit-appeal-form/return"; startswith; fast_pattern; http.host; content:"meta-nolvarin.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010954; classtype:social-engineering; sid:6010954; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zjcaks.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zjcaks.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010955; classtype:social-engineering; sid:6010955; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appleinc-id.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"appleinc-id.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010956; classtype:social-engineering; sid:6010956; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (makeredto.org/wp-content/themes/help/hard_88390993993/ups/index.php)"; flow:established,to_server; http.uri; content:"/wp-content/themes/help/hard_88390993993/ups/index.php"; startswith; fast_pattern; http.host; content:"makeredto.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010957; classtype:social-engineering; sid:6010957; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pixelora.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pixelora.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010958; classtype:social-engineering; sid:6010958; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-qarnax-biz-slurnik-plaqtor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-qarnax-biz-slurnik-plaqtor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010959; classtype:social-engineering; sid:6010959; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-vraxtor-biz-fralqor-dravnix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-vraxtor-biz-fralqor-dravnix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010960; classtype:social-engineering; sid:6010960; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (growthoptimizerx.com/oop/home.php)"; flow:established,to_server; http.uri; content:"/oop/home.php"; startswith; fast_pattern; http.host; content:"growthoptimizerx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010961; classtype:social-engineering; sid:6010961; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.clone-netflix-alpha-two.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.clone-netflix-alpha-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010962; classtype:social-engineering; sid:6010962; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagramlogin-accounts-logintocontinue.github.io/login-verification)"; flow:established,to_server; http.uri; content:"/login-verification"; startswith; fast_pattern; http.host; content:"instagramlogin-accounts-logintocontinue.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010963; classtype:social-engineering; sid:6010963; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.qr.codes/UDpCqT/)"; flow:established,to_server; http.uri; content:"/UDpCqT/"; startswith; fast_pattern; http.host; content:"www.qr.codes"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010964; classtype:social-engineering; sid:6010964; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4rbh-zqg8-clq3.accounts-dynamech-ca-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4rbh-zqg8-clq3.accounts-dynamech-ca-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010965; classtype:social-engineering; sid:6010965; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortan.lol/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortan.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010966; classtype:social-engineering; sid:6010966; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17428.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17428.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010967; classtype:social-engineering; sid:6010967; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maquiequiposmyosas.com/wp-includes/xoffice/SharePoint-LLHDBMPORTUGAL.html)"; flow:established,to_server; http.uri; content:"/wp-includes/xoffice/SharePoint-LLHDBMPORTUGAL.html"; startswith; fast_pattern; http.host; content:"maquiequiposmyosas.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010968; classtype:social-engineering; sid:6010968; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.therqz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.therqz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010969; classtype:social-engineering; sid:6010969; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.sdxwuo.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.sdxwuo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010970; classtype:social-engineering; sid:6010970; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-zarnex-biz-fralvik-qortem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-zarnex-biz-fralvik-qortem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010971; classtype:social-engineering; sid:6010971; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zjdc-22038.wasmer.app/dist/)"; flow:established,to_server; http.uri; content:"/dist/"; startswith; fast_pattern; http.host; content:"zjdc-22038.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010972; classtype:social-engineering; sid:6010972; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zulpiyev.github.io/js29)"; flow:established,to_server; http.uri; content:"/js29"; startswith; fast_pattern; http.host; content:"zulpiyev.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010973; classtype:social-engineering; sid:6010973; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.neplxt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.neplxt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010974; classtype:social-engineering; sid:6010974; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store.communityappitem.shop/workshop/AK47-EternalDecay/)"; flow:established,to_server; http.uri; content:"/workshop/AK47-EternalDecay/"; startswith; fast_pattern; http.host; content:"store.communityappitem.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010975; classtype:social-engineering; sid:6010975; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ldgkooejkd.azulab24.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ldgkooejkd.azulab24.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010976; classtype:social-engineering; sid:6010976; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-clone-mu-hazel.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-mu-hazel.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010977; classtype:social-engineering; sid:6010977; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingsii.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingsii.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010978; classtype:social-engineering; sid:6010978; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apple-map.live/xXS)"; flow:established,to_server; http.uri; content:"/xXS"; startswith; fast_pattern; http.host; content:"apple-map.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010979; classtype:social-engineering; sid:6010979; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bloxfit.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bloxfit.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010980; classtype:social-engineering; sid:6010980; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.e-odeme.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.e-odeme.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010981; classtype:social-engineering; sid:6010981; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rashithakoppurouthu.github.io/amazonclone/)"; flow:established,to_server; http.uri; content:"/amazonclone/"; startswith; fast_pattern; http.host; content:"rashithakoppurouthu.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010982; classtype:social-engineering; sid:6010982; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adiaditi-priya17.github.io/Netflix_Clone/)"; flow:established,to_server; http.uri; content:"/Netflix_Clone/"; startswith; fast_pattern; http.host; content:"adiaditi-priya17.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010983; classtype:social-engineering; sid:6010983; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-glavqor-biz-slortik-frantex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-glavqor-biz-slortik-frantex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010984; classtype:social-engineering; sid:6010984; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zh-coinbase.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zh-coinbase.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010985; classtype:social-engineering; sid:6010985; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vrontek-biz-slarnix-framor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vrontek-biz-slarnix-framor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010986; classtype:social-engineering; sid:6010986; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pfoten-nahrung.de/factura/)"; flow:established,to_server; http.uri; content:"/factura/"; startswith; fast_pattern; http.host; content:"pfoten-nahrung.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010987; classtype:social-engineering; sid:6010987; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17384.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17384.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010988; classtype:social-engineering; sid:6010988; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (startling-marzipan-94f36b.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"startling-marzipan-94f36b.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010989; classtype:social-engineering; sid:6010989; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vdlihq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vdlihq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010990; classtype:social-engineering; sid:6010990; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zjdc-22038.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zjdc-22038.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010991; classtype:social-engineering; sid:6010991; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (esl-fraud-claims.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"esl-fraud-claims.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010992; classtype:social-engineering; sid:6010992; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17551.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17551.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010993; classtype:social-engineering; sid:6010993; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xdmcta.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xdmcta.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010994; classtype:social-engineering; sid:6010994; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (peeyushgupta967.github.io/amazonClonewebpage-with-help-of-html-and-css-)"; flow:established,to_server; http.uri; content:"/amazonClonewebpage-with-help-of-html-and-css-"; startswith; fast_pattern; http.host; content:"peeyushgupta967.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010995; classtype:social-engineering; sid:6010995; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1958833.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1958833.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010996; classtype:social-engineering; sid:6010996; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cuentainactiva2026.github.io/email)"; flow:established,to_server; http.uri; content:"/email"; startswith; fast_pattern; http.host; content:"cuentainactiva2026.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010997; classtype:social-engineering; sid:6010997; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.365365e.app/eng/home/index)"; flow:established,to_server; http.uri; content:"/eng/home/index"; startswith; fast_pattern; http.host; content:"m.365365e.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010998; classtype:social-engineering; sid:6010998; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (esl-fraud-claims.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"esl-fraud-claims.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010999; classtype:social-engineering; sid:6010999; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-lake.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-lake.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011000; classtype:social-engineering; sid:6011000; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (obrapia.com/Adobe/en_Installer)"; flow:established,to_server; http.uri; content:"/Adobe/en_Installer"; startswith; fast_pattern; http.host; content:"obrapia.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011001; classtype:social-engineering; sid:6011001; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nul-01a.github.io/invest-fix)"; flow:established,to_server; http.uri; content:"/invest-fix"; startswith; fast_pattern; http.host; content:"nul-01a.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011002; classtype:social-engineering; sid:6011002; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paypay-bank-loginusercenter-fyp.github.io/sudo/)"; flow:established,to_server; http.uri; content:"/sudo/"; startswith; fast_pattern; http.host; content:"paypay-bank-loginusercenter-fyp.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011003; classtype:social-engineering; sid:6011003; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.behsxu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.behsxu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011004; classtype:social-engineering; sid:6011004; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17394.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17394.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011005; classtype:social-engineering; sid:6011005; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bet365cn101.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bet365cn101.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011006; classtype:social-engineering; sid:6011006; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.twplqxr.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.twplqxr.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011007; classtype:social-engineering; sid:6011007; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-dravtex-biz-plaqvor-glurnax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-dravtex-biz-plaqvor-glurnax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011008; classtype:social-engineering; sid:6011008; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jnelfk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jnelfk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011009; classtype:social-engineering; sid:6011009; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (makeredto.org/wp-content/themes/help/hard_88390993993/ups/indexbill.php/)"; flow:established,to_server; http.uri; content:"/wp-content/themes/help/hard_88390993993/ups/indexbill.php/"; startswith; fast_pattern; http.host; content:"makeredto.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011010; classtype:social-engineering; sid:6011010; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bet6663.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bet6663.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011011; classtype:social-engineering; sid:6011011; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (antivirus.sg/cny/en.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1)"; flow:established,to_server; http.uri; content:"/cny/en.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1"; startswith; fast_pattern; http.host; content:"antivirus.sg"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011012; classtype:social-engineering; sid:6011012; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cloud.sviluppo.host/Login/DF0BGD21N1Y41KJ4TYU1R41G4ERTH16R4JK10000000ZE5FGZ1Y4E400000/)"; flow:established,to_server; http.uri; content:"/Login/DF0BGD21N1Y41KJ4TYU1R41G4ERTH16R4JK10000000ZE5FGZ1Y4E400000/"; startswith; fast_pattern; http.host; content:"cloud.sviluppo.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011013; classtype:social-engineering; sid:6011013; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bg2-n11.global.ssl.fastly.net/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"bg2-n11.global.ssl.fastly.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011014; classtype:social-engineering; sid:6011014; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (home-webmail-login-mvefi1z5snnoqy2ekh.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"home-webmail-login-mvefi1z5snnoqy2ekh.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011015; classtype:social-engineering; sid:6011015; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.gnwrzkp.icu/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.gnwrzkp.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011016; classtype:social-engineering; sid:6011016; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ckraip.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ckraip.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011017; classtype:social-engineering; sid:6011017; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adityakumar712.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"adityakumar712.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011018; classtype:social-engineering; sid:6011018; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meppla.com/bassettassociates)"; flow:established,to_server; http.uri; content:"/bassettassociates"; startswith; fast_pattern; http.host; content:"meppla.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011019; classtype:social-engineering; sid:6011019; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-dranqax-biz-slortik-vralnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-dranqax-biz-slortik-vralnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011020; classtype:social-engineering; sid:6011020; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreigxlel6k7fm2g4gwpthofpcnb5yr3syium2wrfxvw3gge6rvhmixe.ipfs.w3s.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreigxlel6k7fm2g4gwpthofpcnb5yr3syium2wrfxvw3gge6rvhmixe.ipfs.w3s.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011021; classtype:social-engineering; sid:6011021; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.shobmp.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.shobmp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011022; classtype:social-engineering; sid:6011022; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-docsign.s3.us-east-2.amazonaws.com/adobereader/index.html)"; flow:established,to_server; http.uri; content:"/adobereader/index.html"; startswith; fast_pattern; http.host; content:"secure-docsign.s3.us-east-2.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011023; classtype:social-engineering; sid:6011023; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.movique.cyou/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.movique.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011024; classtype:social-engineering; sid:6011024; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pfjsug.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pfjsug.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011025; classtype:social-engineering; sid:6011025; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hortenciateles.github.io/facebook-copia/)"; flow:established,to_server; http.uri; content:"/facebook-copia/"; startswith; fast_pattern; http.host; content:"hortenciateles.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011026; classtype:social-engineering; sid:6011026; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dgdwxl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dgdwxl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011027; classtype:social-engineering; sid:6011027; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dnaapsat-payllterxidz.bestxzor.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dnaapsat-payllterxidz.bestxzor.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011028; classtype:social-engineering; sid:6011028; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.jsylcz.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.jsylcz.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011029; classtype:social-engineering; sid:6011029; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (antivirus.sg/cny/)"; flow:established,to_server; http.uri; content:"/cny/"; startswith; fast_pattern; http.host; content:"antivirus.sg"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011030; classtype:social-engineering; sid:6011030; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bigelsinindirimkodu.amazingcoupons.co.uk/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"bigelsinindirimkodu.amazingcoupons.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011031; classtype:social-engineering; sid:6011031; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1615uuu.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1615uuu.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011032; classtype:social-engineering; sid:6011032; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-vralnik-biz-qoltex-plurnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-vralnik-biz-qoltex-plurnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011033; classtype:social-engineering; sid:6011033; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (layannz-newpnjaman.bestxzor.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"layannz-newpnjaman.bestxzor.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011034; classtype:social-engineering; sid:6011034; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-slortor-biz-framnik-glarnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-slortor-biz-framnik-glarnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011035; classtype:social-engineering; sid:6011035; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-dravtek-biz-vraqlor-slurnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-dravtek-biz-vraqlor-slurnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011036; classtype:social-engineering; sid:6011036; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gg1775.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.gg1775.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011037; classtype:social-engineering; sid:6011037; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fluidpolicyreview.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fluidpolicyreview.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011038; classtype:social-engineering; sid:6011038; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiav45q7ijzvs3vtzq6z62byalu3epl42avfqi4icebqjl2mc55fdy.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiav45q7ijzvs3vtzq6z62byalu3epl42avfqi4icebqjl2mc55fdy.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011039; classtype:social-engineering; sid:6011039; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support.digitalprocurements.co.uk/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"support.digitalprocurements.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011040; classtype:social-engineering; sid:6011040; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-glamtex-biz-dravlor-fruntik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-glamtex-biz-dravlor-fruntik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011041; classtype:social-engineering; sid:6011041; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook.communitypages.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook.communitypages.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011042; classtype:social-engineering; sid:6011042; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (httpps-www-roblox.com/users/1562559105/profile)"; flow:established,to_server; http.uri; content:"/users/1562559105/profile"; startswith; fast_pattern; http.host; content:"httpps-www-roblox.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011043; classtype:social-engineering; sid:6011043; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bet36500004.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bet36500004.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011044; classtype:social-engineering; sid:6011044; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-slurnor-biz-plaqtex-glavnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-slurnor-biz-plaqtex-glavnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011045; classtype:social-engineering; sid:6011045; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-glurnik-biz-plortor-fraltex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-glurnik-biz-plortor-fraltex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011046; classtype:social-engineering; sid:6011046; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.eomuay.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.eomuay.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011047; classtype:social-engineering; sid:6011047; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pgkhwq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pgkhwq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011048; classtype:social-engineering; sid:6011048; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-tronvik-biz-qalnex-frutor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-tronvik-biz-qalnex-frutor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011049; classtype:social-engineering; sid:6011049; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (post.uberweisung.org/278048391/de)"; flow:established,to_server; http.uri; content:"/278048391/de"; startswith; fast_pattern; http.host; content:"post.uberweisung.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011050; classtype:social-engineering; sid:6011050; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.color.hop.ru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.color.hop.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011051; classtype:social-engineering; sid:6011051; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-vrolqor-biz-plarnex-slortik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-vrolqor-biz-plarnex-slortik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011052; classtype:social-engineering; sid:6011052; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingsi.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingsi.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011053; classtype:social-engineering; sid:6011053; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.makharza.ps/lehnpainting/)"; flow:established,to_server; http.uri; content:"/lehnpainting/"; startswith; fast_pattern; http.host; content:"www.makharza.ps"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011054; classtype:social-engineering; sid:6011054; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fraud-claims-esl.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fraud-claims-esl.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011055; classtype:social-engineering; sid:6011055; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-porthub.pages.dev/appeals/submit-appeal-form/return)"; flow:established,to_server; http.uri; content:"/appeals/submit-appeal-form/return"; startswith; fast_pattern; http.host; content:"meta-porthub.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011056; classtype:social-engineering; sid:6011056; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-plaqtex-biz-dravlor-sluntik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-plaqtex-biz-dravlor-sluntik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011057; classtype:social-engineering; sid:6011057; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (swift-event-488641.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"swift-event-488641.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011058; classtype:social-engineering; sid:6011058; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vcwoba.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vcwoba.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011059; classtype:social-engineering; sid:6011059; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nmjbgt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nmjbgt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011060; classtype:social-engineering; sid:6011060; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (user-cembraaap-bitrefill.b-cdn.net/B92x5T/d9fe07c.html)"; flow:established,to_server; http.uri; content:"/B92x5T/d9fe07c.html"; startswith; fast_pattern; http.host; content:"user-cembraaap-bitrefill.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011061; classtype:social-engineering; sid:6011061; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-support-network.pages.dev/appeals/submit-appeal-form/return)"; flow:established,to_server; http.uri; content:"/appeals/submit-appeal-form/return"; startswith; fast_pattern; http.host; content:"meta-support-network.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011062; classtype:social-engineering; sid:6011062; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (beta.ldebc.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"beta.ldebc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011063; classtype:social-engineering; sid:6011063; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gmtrjx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gmtrjx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011064; classtype:social-engineering; sid:6011064; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-clone-sigma-hazel.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-sigma-hazel.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011065; classtype:social-engineering; sid:6011065; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-plamnik-biz-glortex-dravtor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-plamnik-biz-glortex-dravtor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011066; classtype:social-engineering; sid:6011066; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cuentainactiva2026.github.io/mail)"; flow:established,to_server; http.uri; content:"/mail"; startswith; fast_pattern; http.host; content:"cuentainactiva2026.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011067; classtype:social-engineering; sid:6011067; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (glittery-pegasus-dbc406.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"glittery-pegasus-dbc406.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011068; classtype:social-engineering; sid:6011068; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (homenovoacessb.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"homenovoacessb.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011069; classtype:social-engineering; sid:6011069; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wemhki.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wemhki.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011070; classtype:social-engineering; sid:6011070; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (esl-fraud-claims.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"esl-fraud-claims.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011071; classtype:social-engineering; sid:6011071; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vsd6m8rtpo.cloudfrontsa.cyou/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vsd6m8rtpo.cloudfrontsa.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011072; classtype:social-engineering; sid:6011072; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bgcb-3wfu-2x0k.rdials-compasslabservices-com-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bgcb-3wfu-2x0k.rdials-compasslabservices-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011073; classtype:social-engineering; sid:6011073; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (center-reassurance-adminpage.pages.dev/help/contact/637539019806253)"; flow:established,to_server; http.uri; content:"/help/contact/637539019806253"; startswith; fast_pattern; http.host; content:"center-reassurance-adminpage.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011074; classtype:social-engineering; sid:6011074; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clone-netflix-alpha-two.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"clone-netflix-alpha-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011075; classtype:social-engineering; sid:6011075; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-for-brynvero-8jq.pages.dev/login/)"; flow:established,to_server; http.uri; content:"/login/"; startswith; fast_pattern; http.host; content:"business-for-brynvero-8jq.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011076; classtype:social-engineering; sid:6011076; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-slarnik-biz-vroltor-framtex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-slarnik-biz-vroltor-framtex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011077; classtype:social-engineering; sid:6011077; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (email.securebankinggroup.eu/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"email.securebankinggroup.eu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011078; classtype:social-engineering; sid:6011078; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-plortor-biz-glurnex-vralnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-plortor-biz-glurnex-vralnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011079; classtype:social-engineering; sid:6011079; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (helps-live-apps-login.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"helps-live-apps-login.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011080; classtype:social-engineering; sid:6011080; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3d17-050k-1vwa.brentt-gfwdsupply-com-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3d17-050k-1vwa.brentt-gfwdsupply-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011081; classtype:social-engineering; sid:6011081; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www-currently-sign-in-fec9a1.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www-currently-sign-in-fec9a1.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011082; classtype:social-engineering; sid:6011082; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.100189.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.100189.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011083; classtype:social-engineering; sid:6011083; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support-knab.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"support-knab.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011084; classtype:social-engineering; sid:6011084; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-lake.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-lake.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011085; classtype:social-engineering; sid:6011085; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1775ooooo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1775ooooo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011086; classtype:social-engineering; sid:6011086; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingssi.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingssi.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011087; classtype:social-engineering; sid:6011087; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eu.webservices.asia/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"eu.webservices.asia"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011088; classtype:social-engineering; sid:6011088; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gufdcz.top/pay/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.gufdcz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011089; classtype:social-engineering; sid:6011089; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (commodities-approve-danny-freebsd.trycloudflare.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"commodities-approve-danny-freebsd.trycloudflare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011090; classtype:social-engineering; sid:6011090; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-negotiation.pages.dev/appeals/submit-appeal-form/return)"; flow:established,to_server; http.uri; content:"/appeals/submit-appeal-form/return"; startswith; fast_pattern; http.host; content:"meta-negotiation.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011091; classtype:social-engineering; sid:6011091; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mobil2e.de/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mobil2e.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011092; classtype:social-engineering; sid:6011092; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tsogbu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tsogbu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011093; classtype:social-engineering; sid:6011093; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (q.funyfpt.org/dbcpo/class/)"; flow:established,to_server; http.uri; content:"/dbcpo/class/"; startswith; fast_pattern; http.host; content:"q.funyfpt.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011094; classtype:social-engineering; sid:6011094; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (landing.isscrconnect.info/41-1511-280526/)"; flow:established,to_server; http.uri; content:"/41-1511-280526/"; startswith; fast_pattern; http.host; content:"landing.isscrconnect.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011095; classtype:social-engineering; sid:6011095; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-mavnidor.pages.dev/appeals/submit-appeal-form/return)"; flow:established,to_server; http.uri; content:"/appeals/submit-appeal-form/return"; startswith; fast_pattern; http.host; content:"meta-mavnidor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011096; classtype:social-engineering; sid:6011096; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail-admin-portal-7c9a45.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webmail-admin-portal-7c9a45.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011097; classtype:social-engineering; sid:6011097; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.omhuwk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.omhuwk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011098; classtype:social-engineering; sid:6011098; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-dralvor-biz-glavnik-qoltex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-dralvor-biz-glavnik-qoltex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011099; classtype:social-engineering; sid:6011099; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17752211.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17752211.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011100; classtype:social-engineering; sid:6011100; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.identifiez-vous42.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.identifiez-vous42.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011101; classtype:social-engineering; sid:6011101; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pleuih.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pleuih.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011102; classtype:social-engineering; sid:6011102; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17401.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17401.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011103; classtype:social-engineering; sid:6011103; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-fraltek-biz-glarnor-vraqnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-fraltek-biz-glarnor-vraqnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011104; classtype:social-engineering; sid:6011104; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kzwlnxp.icu/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kzwlnxp.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011105; classtype:social-engineering; sid:6011105; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-froltek-biz-slanvor-drunex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-froltek-biz-slanvor-drunex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011106; classtype:social-engineering; sid:6011106; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wbpgct.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wbpgct.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011107; classtype:social-engineering; sid:6011107; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support.digitalprocurements.co.uk/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"support.digitalprocurements.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011108; classtype:social-engineering; sid:6011108; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (considerate-raven-173194.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"considerate-raven-173194.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011109; classtype:social-engineering; sid:6011109; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (upnobolso.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"upnobolso.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011110; classtype:social-engineering; sid:6011110; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (boompecker.de/Kundenservice-cyon1/index.php)"; flow:established,to_server; http.uri; content:"/Kundenservice-cyon1/index.php"; startswith; fast_pattern; http.host; content:"boompecker.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011111; classtype:social-engineering; sid:6011111; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-qravnix-biz-vroltek-plornax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-qravnix-biz-vroltek-plornax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011112; classtype:social-engineering; sid:6011112; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (growthoptimizerx.com/maxos/)"; flow:established,to_server; http.uri; content:"/maxos/"; startswith; fast_pattern; http.host; content:"growthoptimizerx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011113; classtype:social-engineering; sid:6011113; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hilfezentrum-benutzer-info.serveousercontent.com/DE/process/user.html)"; flow:established,to_server; http.uri; content:"/DE/process/user.html"; startswith; fast_pattern; http.host; content:"hilfezentrum-benutzer-info.serveousercontent.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011114; classtype:social-engineering; sid:6011114; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.defisherial.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.defisherial.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011115; classtype:social-engineering; sid:6011115; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blissful-diversity-365097.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"blissful-diversity-365097.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011116; classtype:social-engineering; sid:6011116; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-drolvik-biz-qarnor-slutex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-drolvik-biz-qarnor-slutex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011117; classtype:social-engineering; sid:6011117; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (codaglobal.speciallshop.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"codaglobal.speciallshop.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011118; classtype:social-engineering; sid:6011118; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (itsuppports.com/?r=29f30695-002d-440b-984a-a10eebd02ce2&rg=eu)"; flow:established,to_server; http.uri; content:"/?r=29f30695-002d-440b-984a-a10eebd02ce2&rg=eu"; startswith; fast_pattern; http.host; content:"itsuppports.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011119; classtype:social-engineering; sid:6011119; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-plortik-biz-glanex-vrutex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-plortik-biz-glanex-vrutex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011120; classtype:social-engineering; sid:6011120; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pdf30-p-fi13.5676hygh5ghg.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pdf30-p-fi13.5676hygh5ghg.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011121; classtype:social-engineering; sid:6011121; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (altaperformance.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"altaperformance.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011122; classtype:social-engineering; sid:6011122; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebookweb.github.io/.com-application-help.center-/)"; flow:established,to_server; http.uri; content:"/.com-application-help.center-/"; startswith; fast_pattern; http.host; content:"facebookweb.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011123; classtype:social-engineering; sid:6011123; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bet98d.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bet98d.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011124; classtype:social-engineering; sid:6011124; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (broader-support-675540.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"broader-support-675540.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011125; classtype:social-engineering; sid:6011125; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.choice-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.choice-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011126; classtype:social-engineering; sid:6011126; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iframe2.grahamfamilymedicine.com/switchto/?&SJPXYpF43sBWlFH4jQ&VIl+LlMcqJlEScde$k8zQtSv%25259JlhJf4WB%2525cSM+7kRor(&aee36w%25253(zuSBPSRP9%2525HyvkXdP7uend%255E&eml=ZXhhbXBsZUBleGFtcGxlLmNvbQ==?r=B)"; flow:established,to_server; http.uri; content:"/switchto/?&SJPXYpF43sBWlFH4jQ&VIl+LlMcqJlEScde$k8zQtSv%25259JlhJf4WB%2525cSM+7kRor(&aee36w%25253(zuSBPSRP9%2525HyvkXdP7uend%255E&eml=ZXhhbXBsZUBleGFtcGxlLmNvbQ==?r=B"; startswith; fast_pattern; http.host; content:"iframe2.grahamfamilymedicine.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011127; classtype:social-engineering; sid:6011127; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebookweb.github.io/.com-application-help.center-)"; flow:established,to_server; http.uri; content:"/.com-application-help.center-"; startswith; fast_pattern; http.host; content:"facebookweb.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011128; classtype:social-engineering; sid:6011128; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eu.webservices.asia/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"eu.webservices.asia"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011129; classtype:social-engineering; sid:6011129; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (personal-app-130616.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"personal-app-130616.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011130; classtype:social-engineering; sid:6011130; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support-ndax-io-docs.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"support-ndax-io-docs.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011131; classtype:social-engineering; sid:6011131; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gmfbve.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gmfbve.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011132; classtype:social-engineering; sid:6011132; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netzwerk.click/ygjytf5rf58gthtgg)"; flow:established,to_server; http.uri; content:"/ygjytf5rf58gthtgg"; startswith; fast_pattern; http.host; content:"netzwerk.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011133; classtype:social-engineering; sid:6011133; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (magma.casasdomani.net/?email=ZXhhbXBsZUBleGFtcGxlLmNvbQ==)"; flow:established,to_server; http.uri; content:"/?email=ZXhhbXBsZUBleGFtcGxlLmNvbQ=="; startswith; fast_pattern; http.host; content:"magma.casasdomani.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011134; classtype:social-engineering; sid:6011134; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (magalu-copa2026.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"magalu-copa2026.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011135; classtype:social-engineering; sid:6011135; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (notificationaccessaleert.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"notificationaccessaleert.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011136; classtype:social-engineering; sid:6011136; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-tranvik-biz-dravqor-vroltex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-tranvik-biz-dravqor-vroltex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011137; classtype:social-engineering; sid:6011137; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-framnik-biz-plaqtor-glortex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-framnik-biz-plaqtor-glortex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011138; classtype:social-engineering; sid:6011138; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15591.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15591.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011139; classtype:social-engineering; sid:6011139; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.csbmvk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.csbmvk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011140; classtype:social-engineering; sid:6011140; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apple-map.live/igk)"; flow:established,to_server; http.uri; content:"/igk"; startswith; fast_pattern; http.host; content:"apple-map.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011141; classtype:social-engineering; sid:6011141; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dosso.s3.us-central-1.ionoscloud.com/id-pdf.html?e=example@example.com)"; flow:established,to_server; http.uri; content:"/id-pdf.html?e=example@example.com"; startswith; fast_pattern; http.host; content:"dosso.s3.us-central-1.ionoscloud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011142; classtype:social-engineering; sid:6011142; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-carlivon.pages.dev/appeals/submit-appeal-form/return)"; flow:established,to_server; http.uri; content:"/appeals/submit-appeal-form/return"; startswith; fast_pattern; http.host; content:"meta-carlivon.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011143; classtype:social-engineering; sid:6011143; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bwcdkz.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.bwcdkz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011144; classtype:social-engineering; sid:6011144; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (id8319832apple.sviluppo.host/8209398182/)"; flow:established,to_server; http.uri; content:"/8209398182/"; startswith; fast_pattern; http.host; content:"id8319832apple.sviluppo.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011145; classtype:social-engineering; sid:6011145; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (google-maps.live/fQj)"; flow:established,to_server; http.uri; content:"/fQj"; startswith; fast_pattern; http.host; content:"google-maps.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011146; classtype:social-engineering; sid:6011146; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pszcna.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pszcna.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011147; classtype:social-engineering; sid:6011147; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (email.securebankinggroup.eu/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"email.securebankinggroup.eu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011148; classtype:social-engineering; sid:6011148; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gaussc.mx/aeenvironmentalconsulting/aeenviroopendocaccess.html)"; flow:established,to_server; http.uri; content:"/aeenvironmentalconsulting/aeenviroopendocaccess.html"; startswith; fast_pattern; http.host; content:"www.gaussc.mx"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011149; classtype:social-engineering; sid:6011149; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (justi-tech.com/XuqMkA4)"; flow:established,to_server; http.uri; content:"/XuqMkA4"; startswith; fast_pattern; http.host; content:"justi-tech.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011150; classtype:social-engineering; sid:6011150; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clientdesktop-live.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"clientdesktop-live.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011151; classtype:social-engineering; sid:6011151; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bernard.ext5723518.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bernard.ext5723518.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011152; classtype:social-engineering; sid:6011152; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (filou.ext5723518.pro/captcha.php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"filou.ext5723518.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011153; classtype:social-engineering; sid:6011153; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trup-pam.dynv6.net/gf/Re343240173/Step2.php?token=NTQuMTk2LjE5MS4yMDgyMDI2Okp1bjpGcmk=)"; flow:established,to_server; http.uri; content:"/gf/Re343240173/Step2.php?token=NTQuMTk2LjE5MS4yMDgyMDI2Okp1bjpGcmk="; startswith; fast_pattern; http.host; content:"trup-pam.dynv6.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011154; classtype:social-engineering; sid:6011154; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aboula.hub5724557.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aboula.hub5724557.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011155; classtype:social-engineering; sid:6011155; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-c56bca134f274de6b02d532435dd1540.r2.dev/ohmm.html)"; flow:established,to_server; http.uri; content:"/ohmm.html"; startswith; fast_pattern; http.host; content:"pub-c56bca134f274de6b02d532435dd1540.r2.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011156; classtype:social-engineering; sid:6011156; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aboula.hub5724557.pro/captcha.php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"aboula.hub5724557.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011157; classtype:social-engineering; sid:6011157; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (desktops-client.wixstudio.com/desktop)"; flow:established,to_server; http.uri; content:"/desktop"; startswith; fast_pattern; http.host; content:"desktops-client.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011158; classtype:social-engineering; sid:6011158; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (marcel.hub5724557.pro/captcha.php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"marcel.hub5724557.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011159; classtype:social-engineering; sid:6011159; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (one-moment-542706.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"one-moment-542706.webflow.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011160; classtype:social-engineering; sid:6011160; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hub5724557.pro/captcha.php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"www.hub5724557.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011161; classtype:social-engineering; sid:6011161; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pickup.e-docssign.net/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"pickup.e-docssign.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011162; classtype:social-engineering; sid:6011162; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-site-editor--mnt1094.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-site-editor--mnt1094.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011163; classtype:social-engineering; sid:6011163; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.teams-ml.com/p/fjbd-cbch/azutskvw/)"; flow:established,to_server; http.uri; content:"/p/fjbd-cbch/azutskvw/"; startswith; fast_pattern; http.host; content:"s.teams-ml.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011164; classtype:social-engineering; sid:6011164; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (storage.yandexcloud.net/seren/jo/bi2/shr.html)"; flow:established,to_server; http.uri; content:"/seren/jo/bi2/shr.html"; startswith; fast_pattern; http.host; content:"storage.yandexcloud.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011165; classtype:social-engineering; sid:6011165; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (exclusive-spins.moba-gamers.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"exclusive-spins.moba-gamers.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011166; classtype:social-engineering; sid:6011166; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-slorvik-biz-fratem-vrolnax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-slorvik-biz-fratem-vrolnax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011167; classtype:social-engineering; sid:6011167; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-glanvik-biz-qurnex-vroltor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-glanvik-biz-qurnex-vroltor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011168; classtype:social-engineering; sid:6011168; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-slortex-biz-fralnik-vramtor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-slortex-biz-fralnik-vramtor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011169; classtype:social-engineering; sid:6011169; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (steamcommumnmlty.com/tradeoffer/new/partner=631639158token=p9rogeUI71621)"; flow:established,to_server; http.uri; content:"/tradeoffer/new/partner=631639158token=p9rogeUI71621"; startswith; fast_pattern; http.host; content:"steamcommumnmlty.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011170; classtype:social-engineering; sid:6011170; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (naifei.bet/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"naifei.bet"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011171; classtype:social-engineering; sid:6011171; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17390.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17390.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011172; classtype:social-engineering; sid:6011172; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nitish-04.github.io/Alfido-Tech-Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Alfido-Tech-Netflix-Clone/"; startswith; fast_pattern; http.host; content:"nitish-04.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011173; classtype:social-engineering; sid:6011173; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ms-tech.offices-support.com/i/a7c9fe738e7024d889b4fc6dad4e959ee)"; flow:established,to_server; http.uri; content:"/i/a7c9fe738e7024d889b4fc6dad4e959ee"; startswith; fast_pattern; http.host; content:"ms-tech.offices-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011174; classtype:social-engineering; sid:6011174; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.teams-ml.com/p/fjbd-cbch/hqkgxffv/)"; flow:established,to_server; http.uri; content:"/p/fjbd-cbch/hqkgxffv/"; startswith; fast_pattern; http.host; content:"s.teams-ml.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011175; classtype:social-engineering; sid:6011175; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vinuka17.github.io/https-www.instagram.com-reel-CxYZAbc12342-)"; flow:established,to_server; http.uri; content:"/https-www.instagram.com-reel-CxYZAbc12342-"; startswith; fast_pattern; http.host; content:"vinuka17.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011176; classtype:social-engineering; sid:6011176; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (veaxz.fwh.is/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"veaxz.fwh.is"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011177; classtype:social-engineering; sid:6011177; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tecnologiaderecuperacionavanzada.fwh.is/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tecnologiaderecuperacionavanzada.fwh.is"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011178; classtype:social-engineering; sid:6011178; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mik-space.github.io/doument-attacthed/Purchase%20Order)"; flow:established,to_server; http.uri; content:"/doument-attacthed/Purchase%20Order"; startswith; fast_pattern; http.host; content:"mik-space.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011179; classtype:social-engineering; sid:6011179; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (api-data-1234-s3-region-amazonaws-user.bettiescakes.com/owar1/mx12324302/#1187507008Family=veror1@49a209f0331e839c4f55e989294b543605c9.com)"; flow:established,to_server; http.uri; content:"/owar1/mx12324302/#1187507008Family=veror1@49a209f0331e839c4f55e989294b543605c9.com"; startswith; fast_pattern; http.host; content:"api-data-1234-s3-region-amazonaws-user.bettiescakes.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011180; classtype:social-engineering; sid:6011180; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alwajalwa.github.io/video-player)"; flow:established,to_server; http.uri; content:"/video-player"; startswith; fast_pattern; http.host; content:"alwajalwa.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011181; classtype:social-engineering; sid:6011181; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inenco.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"inenco.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011182; classtype:social-engineering; sid:6011182; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apple-maplocation.com/nVt)"; flow:established,to_server; http.uri; content:"/nVt"; startswith; fast_pattern; http.host; content:"apple-maplocation.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011183; classtype:social-engineering; sid:6011183; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imagemasters.greetings.pictures/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"imagemasters.greetings.pictures"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011184; classtype:social-engineering; sid:6011184; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pop.goood-mail.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pop.goood-mail.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011185; classtype:social-engineering; sid:6011185; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-tramtex-biz-slortik-fralnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-tramtex-biz-slortik-fralnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011186; classtype:social-engineering; sid:6011186; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure.associateratings.com/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"secure.associateratings.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011187; classtype:social-engineering; sid:6011187; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.program-resmi979.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.program-resmi979.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011188; classtype:social-engineering; sid:6011188; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-glarnik-biz-frunor-plavtex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-glarnik-biz-frunor-plavtex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011189; classtype:social-engineering; sid:6011189; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.nn1665.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.nn1665.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011190; classtype:social-engineering; sid:6011190; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (psa.corporatereward.net/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"psa.corporatereward.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011191; classtype:social-engineering; sid:6011191; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (msf.073202.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"msf.073202.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011192; classtype:social-engineering; sid:6011192; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rweysi.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rweysi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011193; classtype:social-engineering; sid:6011193; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ip1238199153.itupdatealert.com/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"ip1238199153.itupdatealert.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011194; classtype:social-engineering; sid:6011194; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-slurnor-biz-vratem-glunix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-slurnor-biz-vratem-glunix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011195; classtype:social-engineering; sid:6011195; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-glatem-biz-vrolnix-plurnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-glatem-biz-vrolnix-plurnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011196; classtype:social-engineering; sid:6011196; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ssl.073202.com/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"ssl.073202.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011197; classtype:social-engineering; sid:6011197; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.q7765.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.q7765.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011198; classtype:social-engineering; sid:6011198; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gweissrs.github.io/Netflix_telalogin)"; flow:established,to_server; http.uri; content:"/Netflix_telalogin"; startswith; fast_pattern; http.host; content:"gweissrs.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011199; classtype:social-engineering; sid:6011199; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ocslinicals.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ocslinicals.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011200; classtype:social-engineering; sid:6011200; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support.new.hr-rewards.com/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"support.new.hr-rewards.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011201; classtype:social-engineering; sid:6011201; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingsl.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingsl.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011202; classtype:social-engineering; sid:6011202; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (unicredit.market-trust-eu.sbs/client/235413)"; flow:established,to_server; http.uri; content:"/client/235413"; startswith; fast_pattern; http.host; content:"unicredit.market-trust-eu.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011203; classtype:social-engineering; sid:6011203; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloudbuscar.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"icloudbuscar.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011204; classtype:social-engineering; sid:6011204; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure.associateratings.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"secure.associateratings.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011205; classtype:social-engineering; sid:6011205; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-dranvox-biz-plurnek-slatir.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-dranvox-biz-plurnek-slatir.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011206; classtype:social-engineering; sid:6011206; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tnqzrpt.icu/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tnqzrpt.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011207; classtype:social-engineering; sid:6011207; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coachingdevie.info/PL-1466-160526/?e=xxx&s3=Tadeusz&s4)"; flow:established,to_server; http.uri; content:"/PL-1466-160526/?e=xxx&s3=Tadeusz&s4"; startswith; fast_pattern; http.host; content:"coachingdevie.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011208; classtype:social-engineering; sid:6011208; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imap.goood-mail.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"imap.goood-mail.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011209; classtype:social-engineering; sid:6011209; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zazxwzoz.usw-1.sealos.app/vc/xv/login.php)"; flow:established,to_server; http.uri; content:"/vc/xv/login.php"; startswith; fast_pattern; http.host; content:"zazxwzoz.usw-1.sealos.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011210; classtype:social-engineering; sid:6011210; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (microsoft.com.cobblestonesw.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"microsoft.com.cobblestonesw.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011211; classtype:social-engineering; sid:6011211; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-vroltex-biz-plurnik-dravqor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-vroltex-biz-plurnik-dravqor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011212; classtype:social-engineering; sid:6011212; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.hvtmxqr.xin/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.hvtmxqr.xin"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011213; classtype:social-engineering; sid:6011213; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqtxvlm.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqtxvlm.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011214; classtype:social-engineering; sid:6011214; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gnlgroup.net/santander/index.html)"; flow:established,to_server; http.uri; content:"/santander/index.html"; startswith; fast_pattern; http.host; content:"gnlgroup.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011215; classtype:social-engineering; sid:6011215; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-plurnor-biz-fruntax-slortik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-plurnor-biz-fruntax-slortik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011216; classtype:social-engineering; sid:6011216; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-slanvik-biz-fraltor-qurnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-slanvik-biz-fraltor-qurnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011217; classtype:social-engineering; sid:6011217; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.geswid.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.geswid.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011218; classtype:social-engineering; sid:6011218; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ambystic.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ambystic.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011219; classtype:social-engineering; sid:6011219; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqtxvmp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqtxvmp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011220; classtype:social-engineering; sid:6011220; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xindonesiacstmerns.fredped.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xindonesiacstmerns.fredped.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011221; classtype:social-engineering; sid:6011221; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-vrolqor-biz-plaqnik-glurnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-vrolqor-biz-plaqnik-glurnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011222; classtype:social-engineering; sid:6011222; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (supportmail2026.github.io/Activacion/)"; flow:established,to_server; http.uri; content:"/Activacion/"; startswith; fast_pattern; http.host; content:"supportmail2026.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011223; classtype:social-engineering; sid:6011223; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-qoltex-biz-framvor-dravnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-qoltex-biz-framvor-dravnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011224; classtype:social-engineering; sid:6011224; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vinuka17.github.io/https-www.instagram.com-reel-CxYZAbc12342-/)"; flow:established,to_server; http.uri; content:"/https-www.instagram.com-reel-CxYZAbc12342-/"; startswith; fast_pattern; http.host; content:"vinuka17.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011225; classtype:social-engineering; sid:6011225; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prathameshschavan.github.io/Project_Airbnb.com/HTML/product.html)"; flow:established,to_server; http.uri; content:"/Project_Airbnb.com/HTML/product.html"; startswith; fast_pattern; http.host; content:"prathameshschavan.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011226; classtype:social-engineering; sid:6011226; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (binance-1-2-11-uniswap.vercel.app/positions)"; flow:established,to_server; http.uri; content:"/positions"; startswith; fast_pattern; http.host; content:"binance-1-2-11-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011227; classtype:social-engineering; sid:6011227; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-glornex-biz-vratik-plurnax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-glornex-biz-vratik-plurnax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011228; classtype:social-engineering; sid:6011228; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rasebitseirie-maker.github.io/Netflix-Project)"; flow:established,to_server; http.uri; content:"/Netflix-Project"; startswith; fast_pattern; http.host; content:"rasebitseirie-maker.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011229; classtype:social-engineering; sid:6011229; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (upxholdlogun.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"upxholdlogun.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011230; classtype:social-engineering; sid:6011230; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-glortex-biz-slurnor-plamnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-glortex-biz-slurnor-plamnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011231; classtype:social-engineering; sid:6011231; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-glurnor-biz-platem-dravnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-glurnor-biz-platem-dravnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011232; classtype:social-engineering; sid:6011232; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (intokem.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"intokem.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011233; classtype:social-engineering; sid:6011233; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support.new.hr-rewards.com/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"support.new.hr-rewards.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011234; classtype:social-engineering; sid:6011234; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deeps0408.github.io/instagram-clone)"; flow:established,to_server; http.uri; content:"/instagram-clone"; startswith; fast_pattern; http.host; content:"deeps0408.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011235; classtype:social-engineering; sid:6011235; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.saxhbo.top/pay/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.saxhbo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011236; classtype:social-engineering; sid:6011236; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-vromqor-biz-plavnik-draltex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-vromqor-biz-plavnik-draltex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011237; classtype:social-engineering; sid:6011237; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-dravrix-biz-fralnor-pluntex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-dravrix-biz-fralnor-pluntex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011238; classtype:social-engineering; sid:6011238; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (upxholdlogun.gitbook.io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"upxholdlogun.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011239; classtype:social-engineering; sid:6011239; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wordpress-212173-0.cloudclusters.net/chf/swisspass-sbb/ch/payment.php)"; flow:established,to_server; http.uri; content:"/chf/swisspass-sbb/ch/payment.php"; startswith; fast_pattern; http.host; content:"wordpress-212173-0.cloudclusters.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011240; classtype:social-engineering; sid:6011240; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faq-exodus.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"faq-exodus.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011241; classtype:social-engineering; sid:6011241; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (right-otter-800818.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"right-otter-800818.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011242; classtype:social-engineering; sid:6011242; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (did.li/aHAmC)"; flow:established,to_server; http.uri; content:"/aHAmC"; startswith; fast_pattern; http.host; content:"did.li"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011243; classtype:social-engineering; sid:6011243; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (profile.set-huilier.fr/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"profile.set-huilier.fr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011244; classtype:social-engineering; sid:6011244; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ducalelara.spahotel.guru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ducalelara.spahotel.guru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011245; classtype:social-engineering; sid:6011245; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anflaty.github.io/Instagram.login/)"; flow:established,to_server; http.uri; content:"/Instagram.login/"; startswith; fast_pattern; http.host; content:"anflaty.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011246; classtype:social-engineering; sid:6011246; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ip1238199153.itupdatealert.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"ip1238199153.itupdatealert.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011247; classtype:social-engineering; sid:6011247; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.eatskorea.com/chsps/)"; flow:established,to_server; http.uri; content:"/chsps/"; startswith; fast_pattern; http.host; content:"www.eatskorea.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011248; classtype:social-engineering; sid:6011248; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ms-tech.offices-support.com/i/a909fd613dec84a90b92e05b90197ebd6)"; flow:established,to_server; http.uri; content:"/i/a909fd613dec84a90b92e05b90197ebd6"; startswith; fast_pattern; http.host; content:"ms-tech.offices-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011249; classtype:social-engineering; sid:6011249; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pickup.e-docssign.net/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"pickup.e-docssign.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011250; classtype:social-engineering; sid:6011250; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wordpress-212255-0.cloudclusters.net/nopnl/ch/)"; flow:established,to_server; http.uri; content:"/nopnl/ch/"; startswith; fast_pattern; http.host; content:"wordpress-212255-0.cloudclusters.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011251; classtype:social-engineering; sid:6011251; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (purobakery.com/wp-access.php)"; flow:established,to_server; http.uri; content:"/wp-access.php"; startswith; fast_pattern; http.host; content:"purobakery.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011252; classtype:social-engineering; sid:6011252; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (msf.073202.com/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"msf.073202.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011253; classtype:social-engineering; sid:6011253; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kznlptx.vip/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kznlptx.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011254; classtype:social-engineering; sid:6011254; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (steamcommumnmlty.com/tradeoffer/new/partner=62146368token=p9rogeUI62571)"; flow:established,to_server; http.uri; content:"/tradeoffer/new/partner=62146368token=p9rogeUI62571"; startswith; fast_pattern; http.host; content:"steamcommumnmlty.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011255; classtype:social-engineering; sid:6011255; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (97ee5.catex.at/cnbcard/?b=YTo0OntzOjU6ImxhYmVsIjtzOjI6InB6IjtzOjM6InVzciI7aToxNjE2O3M6NDoibm9wZCI7czoxNToicnNzMi5yZWFkbGVzLmF0IjtzOjE6Im8iO2k6MjEzNTt9)"; flow:established,to_server; http.uri; content:"/cnbcard/?b=YTo0OntzOjU6ImxhYmVsIjtzOjI6InB6IjtzOjM6InVzciI7aToxNjE2O3M6NDoibm9wZCI7czoxNToicnNzMi5yZWFkbGVzLmF0IjtzOjE6Im8iO2k6MjEzNTt9"; startswith; fast_pattern; http.host; content:"97ee5.catex.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011256; classtype:social-engineering; sid:6011256; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.itupdatealert.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"login.itupdatealert.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011257; classtype:social-engineering; sid:6011257; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f240y.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f240y.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011258; classtype:social-engineering; sid:6011258; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ms-tech.offices-support.com/index/5fd3dd23376a4a30b948ffafff0a9c33/a909fd613dec84a90b92e05b90197ebd6)"; flow:established,to_server; http.uri; content:"/index/5fd3dd23376a4a30b948ffafff0a9c33/a909fd613dec84a90b92e05b90197ebd6"; startswith; fast_pattern; http.host; content:"ms-tech.offices-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011259; classtype:social-engineering; sid:6011259; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-glavtor-biz-tranvik-qolnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-glavtor-biz-tranvik-qolnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011260; classtype:social-engineering; sid:6011260; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ms-tech.offices-support.com/page/9bbfe4f157044c9f9ab903102a316cf4/a7c9fe738e7024d889b4fc6dad4e959ee)"; flow:established,to_server; http.uri; content:"/page/9bbfe4f157044c9f9ab903102a316cf4/a7c9fe738e7024d889b4fc6dad4e959ee"; startswith; fast_pattern; http.host; content:"ms-tech.offices-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011261; classtype:social-engineering; sid:6011261; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vcsz-18573.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vcsz-18573.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011262; classtype:social-engineering; sid:6011262; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (click.abitursprueche.de/ga/click/2-17328413-22-9261-18098-9967-509ff80723-af6f49103c)"; flow:established,to_server; http.uri; content:"/ga/click/2-17328413-22-9261-18098-9967-509ff80723-af6f49103c"; startswith; fast_pattern; http.host; content:"click.abitursprueche.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011263; classtype:social-engineering; sid:6011263; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-plurnex-biz-dranqor-glavnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-plurnex-biz-dranqor-glavnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011264; classtype:social-engineering; sid:6011264; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-glurnax-biz-qolvik-plarnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-glurnax-biz-qolvik-plarnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011265; classtype:social-engineering; sid:6011265; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-zeta-two.vercel.app/signIn.html/)"; flow:established,to_server; http.uri; content:"/signIn.html/"; startswith; fast_pattern; http.host; content:"netflix-clone-zeta-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011266; classtype:social-engineering; sid:6011266; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bvxtmrq.xin/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.bvxtmrq.xin"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011267; classtype:social-engineering; sid:6011267; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.amazonwebclone-alpha.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazonwebclone-alpha.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011268; classtype:social-engineering; sid:6011268; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (linkedin.comunicazioni-sicure.it/actionrequired?rid=RwQSixi)"; flow:established,to_server; http.uri; content:"/actionrequired?rid=RwQSixi"; startswith; fast_pattern; http.host; content:"linkedin.comunicazioni-sicure.it"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011269; classtype:social-engineering; sid:6011269; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yahwebonlinetime.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yahwebonlinetime.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011270; classtype:social-engineering; sid:6011270; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bahissiteleri46.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bahissiteleri46.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011271; classtype:social-engineering; sid:6011271; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-fruntex-biz-vraxnik-plaqtor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-fruntex-biz-vraxnik-plaqtor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011272; classtype:social-engineering; sid:6011272; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (y29g.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"y29g.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011273; classtype:social-engineering; sid:6011273; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vrolvik-biz-qortem-glurnax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vrolvik-biz-qortem-glurnax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011274; classtype:social-engineering; sid:6011274; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yjasur039-cyber.github.io/instagram-main)"; flow:established,to_server; http.uri; content:"/instagram-main"; startswith; fast_pattern; http.host; content:"yjasur039-cyber.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011275; classtype:social-engineering; sid:6011275; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jessedigitalrfpdocs-dpgcy2fje2tm.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jessedigitalrfpdocs-dpgcy2fje2tm.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011276; classtype:social-engineering; sid:6011276; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jprlzwn.vip/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jprlzwn.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011277; classtype:social-engineering; sid:6011277; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gmx-passwort.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.gmx-passwort.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011278; classtype:social-engineering; sid:6011278; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kunal4137.github.io/Netflix_Clone/)"; flow:established,to_server; http.uri; content:"/Netflix_Clone/"; startswith; fast_pattern; http.host; content:"kunal4137.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011279; classtype:social-engineering; sid:6011279; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (popandc.be/wp-admin/js/cgi-ent/index--000.html)"; flow:established,to_server; http.uri; content:"/wp-admin/js/cgi-ent/index--000.html"; startswith; fast_pattern; http.host; content:"popandc.be"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011280; classtype:social-engineering; sid:6011280; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imagemasters.greetings.pictures/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"imagemasters.greetings.pictures"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011281; classtype:social-engineering; sid:6011281; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.itupdatealert.com/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"login.itupdatealert.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011282; classtype:social-engineering; sid:6011282; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingeu.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingeu.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011283; classtype:social-engineering; sid:6011283; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-qravnor-biz-plaqtex-slavnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-qravnor-biz-plaqtex-slavnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011284; classtype:social-engineering; sid:6011284; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ssl.073202.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"ssl.073202.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011285; classtype:social-engineering; sid:6011285; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xinewsdna-formindo.revolusioner.web.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xinewsdna-formindo.revolusioner.web.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011286; classtype:social-engineering; sid:6011286; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (special-wincash2026.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"special-wincash2026.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011287; classtype:social-engineering; sid:6011287; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eng-xodus-wellat.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eng-xodus-wellat.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011288; classtype:social-engineering; sid:6011288; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloudbuscar.id/expire/?5)"; flow:established,to_server; http.uri; content:"/expire/?5"; startswith; fast_pattern; http.host; content:"icloudbuscar.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011289; classtype:social-engineering; sid:6011289; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (luna0-0.github.io/netflix-ui-clone)"; flow:established,to_server; http.uri; content:"/netflix-ui-clone"; startswith; fast_pattern; http.host; content:"luna0-0.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011290; classtype:social-engineering; sid:6011290; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-frurnik-biz-platem-dravnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-frurnik-biz-platem-dravnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011291; classtype:social-engineering; sid:6011291; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (psa.corporatereward.net/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"psa.corporatereward.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011292; classtype:social-engineering; sid:6011292; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gls.axfvkd.cfd/SL)"; flow:established,to_server; http.uri; content:"/SL"; startswith; fast_pattern; http.host; content:"gls.axfvkd.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011293; classtype:social-engineering; sid:6011293; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lucky-exceptions-109626.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lucky-exceptions-109626.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011294; classtype:social-engineering; sid:6011294; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dskenvistacurelv.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dskenvistacurelv.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011295; classtype:social-engineering; sid:6011295; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-k25l.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-k25l.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011296; classtype:social-engineering; sid:6011296; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chorme-exodos-us.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"chorme-exodos-us.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011297; classtype:social-engineering; sid:6011297; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inspirational-pizza-522938.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"inspirational-pizza-522938.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011298; classtype:social-engineering; sid:6011298; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (knowingly-consistency-235981.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"knowingly-consistency-235981.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011299; classtype:social-engineering; sid:6011299; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (static-lettuce-467775.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"static-lettuce-467775.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011300; classtype:social-engineering; sid:6011300; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secured-suggestions-202987.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secured-suggestions-202987.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011301; classtype:social-engineering; sid:6011301; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dsksupportenvistacu.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dsksupportenvistacu.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011302; classtype:social-engineering; sid:6011302; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (88843534949.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"88843534949.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011303; classtype:social-engineering; sid:6011303; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (htttpsscsefcu.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"htttpsscsefcu.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011304; classtype:social-engineering; sid:6011304; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (affable-subtasks-609343.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"affable-subtasks-609343.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011305; classtype:social-engineering; sid:6011305; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (updatepass000555.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"updatepass000555.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011306; classtype:social-engineering; sid:6011306; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hh1565.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hh1565.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011307; classtype:social-engineering; sid:6011307; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dragon95.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dragon95.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011308; classtype:social-engineering; sid:6011308; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ahjykr.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.ahjykr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011309; classtype:social-engineering; sid:6011309; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-dranor-biz-fravik-slatem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-dranor-biz-fravik-slatem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011310; classtype:social-engineering; sid:6011310; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fraud-claims-esl.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fraud-claims-esl.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011311; classtype:social-engineering; sid:6011311; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee5849.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.shopee5849.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011312; classtype:social-engineering; sid:6011312; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (advhokc.cn/icloudss)"; flow:established,to_server; http.uri; content:"/icloudss"; startswith; fast_pattern; http.host; content:"advhokc.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011313; classtype:social-engineering; sid:6011313; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bitcompliancereview.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bitcompliancereview.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011314; classtype:social-engineering; sid:6011314; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktifkaans-payllterdnax.dipsea.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktifkaans-payllterdnax.dipsea.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011315; classtype:social-engineering; sid:6011315; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (home-renrensports.com/id-update)"; flow:established,to_server; http.uri; content:"/id-update"; startswith; fast_pattern; http.host; content:"home-renrensports.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011316; classtype:social-engineering; sid:6011316; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ekmithu.github.io/Netflix-Clone)"; flow:established,to_server; http.uri; content:"/Netflix-Clone"; startswith; fast_pattern; http.host; content:"ekmithu.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011317; classtype:social-engineering; sid:6011317; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-vrolnor-biz-slortik-framtex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-vrolnor-biz-slortik-framtex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011318; classtype:social-engineering; sid:6011318; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abril.ink/7ui36/)"; flow:established,to_server; http.uri; content:"/7ui36/"; startswith; fast_pattern; http.host; content:"abril.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011319; classtype:social-engineering; sid:6011319; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.galabetorjinal.co/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.galabetorjinal.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011320; classtype:social-engineering; sid:6011320; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-drontek-biz-slurnik-fralnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-drontek-biz-slurnik-fralnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011321; classtype:social-engineering; sid:6011321; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-quenza-biz-fralko-timve.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-quenza-biz-fralko-timve.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011322; classtype:social-engineering; sid:6011322; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (muzammil4464.github.io/amazon-redesign-by-muzammil)"; flow:established,to_server; http.uri; content:"/amazon-redesign-by-muzammil"; startswith; fast_pattern; http.host; content:"muzammil4464.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011323; classtype:social-engineering; sid:6011323; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rf-pending-medicare-hotdoc.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rf-pending-medicare-hotdoc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011324; classtype:social-engineering; sid:6011324; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fre.to/Dana-lndonesiaa)"; flow:established,to_server; http.uri; content:"/Dana-lndonesiaa"; startswith; fast_pattern; http.host; content:"fre.to"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011325; classtype:social-engineering; sid:6011325; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail.au.bezpieczneudostepnianieplikow.pl/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"webmail.au.bezpieczneudostepnianieplikow.pl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011326; classtype:social-engineering; sid:6011326; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ptshopee990.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.ptshopee990.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011327; classtype:social-engineering; sid:6011327; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-drament-biz-qravlor-plarnix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-drament-biz-qravlor-plarnix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011328; classtype:social-engineering; sid:6011328; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (global-sohusports.com/id-update)"; flow:established,to_server; http.uri; content:"/id-update"; startswith; fast_pattern; http.host; content:"global-sohusports.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011329; classtype:social-engineering; sid:6011329; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pmkyic.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pmkyic.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011330; classtype:social-engineering; sid:6011330; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail.photosnsfw.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"webmail.photosnsfw.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011331; classtype:social-engineering; sid:6011331; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail.au.newsalerts.com.sg/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"webmail.au.newsalerts.com.sg"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011332; classtype:social-engineering; sid:6011332; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.nissan66.ru/bitrix/open/made.in.china/membercenter.made-in-china.com/index.html)"; flow:established,to_server; http.uri; content:"/bitrix/open/made.in.china/membercenter.made-in-china.com/index.html"; startswith; fast_pattern; http.host; content:"www.nissan66.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011333; classtype:social-engineering; sid:6011333; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mostafijuranu-maker.github.io/Google-log-in/)"; flow:established,to_server; http.uri; content:"/Google-log-in/"; startswith; fast_pattern; http.host; content:"mostafijuranu-maker.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011334; classtype:social-engineering; sid:6011334; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ssl.secureinvestingonline.com/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"ssl.secureinvestingonline.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011335; classtype:social-engineering; sid:6011335; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-travik-biz-fraltem-slurnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-travik-biz-fraltem-slurnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011336; classtype:social-engineering; sid:6011336; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-vralvor-biz-dravqor-plurnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-vralvor-biz-dravqor-plurnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011337; classtype:social-engineering; sid:6011337; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (knowingly-consistency-235981.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"knowingly-consistency-235981.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011338; classtype:social-engineering; sid:6011338; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee5849.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopee5849.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011339; classtype:social-engineering; sid:6011339; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (saadshaikh27.github.io/Second-Repo)"; flow:established,to_server; http.uri; content:"/Second-Repo"; startswith; fast_pattern; http.host; content:"saadshaikh27.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011340; classtype:social-engineering; sid:6011340; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (owa.itineraryupdate.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"owa.itineraryupdate.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011341; classtype:social-engineering; sid:6011341; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.au.expressparcel.com.sg/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"mail.au.expressparcel.com.sg"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011342; classtype:social-engineering; sid:6011342; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-traltem-biz-fralnor-qurnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-traltem-biz-fralnor-qurnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011343; classtype:social-engineering; sid:6011343; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (binanceltd.ltd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"binanceltd.ltd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011344; classtype:social-engineering; sid:6011344; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (greetings.pictures/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"greetings.pictures"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011345; classtype:social-engineering; sid:6011345; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (y218a.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"y218a.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011346; classtype:social-engineering; sid:6011346; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dospablosca.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.dospablosca.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011347; classtype:social-engineering; sid:6011347; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-plovnix-biz-vroltek-drament.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-plovnix-biz-vroltek-drament.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011348; classtype:social-engineering; sid:6011348; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (owa.itineraryupdate.com/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"owa.itineraryupdate.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011349; classtype:social-engineering; sid:6011349; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aibsolar.yourretrofit.ie/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aibsolar.yourretrofit.ie"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011350; classtype:social-engineering; sid:6011350; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (owa.itineraryupdate.com/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"owa.itineraryupdate.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011351; classtype:social-engineering; sid:6011351; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ahv3ctpms4e.tokenvalidate.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"ahv3ctpms4e.tokenvalidate.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011352; classtype:social-engineering; sid:6011352; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail.photosnsfw.com/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"webmail.photosnsfw.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011353; classtype:social-engineering; sid:6011353; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17391.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17391.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011354; classtype:social-engineering; sid:6011354; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (links.votrentreprise.com/v/c43/VsmX93GoYDANtcAei5YdTa/09bd53a5/)"; flow:established,to_server; http.uri; content:"/v/c43/VsmX93GoYDANtcAei5YdTa/09bd53a5/"; startswith; fast_pattern; http.host; content:"links.votrentreprise.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011355; classtype:social-engineering; sid:6011355; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (server-index-page--eefostar.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"server-index-page--eefostar.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011356; classtype:social-engineering; sid:6011356; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (n1.5jb7.com/go/77736723)"; flow:established,to_server; http.uri; content:"/go/77736723"; startswith; fast_pattern; http.host; content:"n1.5jb7.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011357; classtype:social-engineering; sid:6011357; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (happ-c7entertainment.com/id-update)"; flow:established,to_server; http.uri; content:"/id-update"; startswith; fast_pattern; http.host; content:"happ-c7entertainment.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011358; classtype:social-engineering; sid:6011358; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.gal/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.gal"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011359; classtype:social-engineering; sid:6011359; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (opportunityboost2026.free.nf/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"opportunityboost2026.free.nf"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011360; classtype:social-engineering; sid:6011360; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (santanderenlinea.github.io/prestamo.com/)"; flow:established,to_server; http.uri; content:"/prestamo.com/"; startswith; fast_pattern; http.host; content:"santanderenlinea.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011361; classtype:social-engineering; sid:6011361; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sprightly-empanada-83358c.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sprightly-empanada-83358c.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011362; classtype:social-engineering; sid:6011362; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-landing-page-ui.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-landing-page-ui.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011363; classtype:social-engineering; sid:6011363; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (local-kaiyunplay.com/id-update)"; flow:established,to_server; http.uri; content:"/id-update"; startswith; fast_pattern; http.host; content:"local-kaiyunplay.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011364; classtype:social-engineering; sid:6011364; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brittanytheengineer369.github.io/javascript-amazon-project/tracking.html?orderId=123)"; flow:established,to_server; http.uri; content:"/javascript-amazon-project/tracking.html?orderId=123"; startswith; fast_pattern; http.host; content:"brittanytheengineer369.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011365; classtype:social-engineering; sid:6011365; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (on.yjrvw.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"on.yjrvw.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011366; classtype:social-engineering; sid:6011366; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dbhlmp.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dbhlmp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011367; classtype:social-engineering; sid:6011367; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vralnik-biz-qornex-drutek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vralnik-biz-qornex-drutek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011368; classtype:social-engineering; sid:6011368; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17311.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17311.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011369; classtype:social-engineering; sid:6011369; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (greetings.pictures/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"greetings.pictures"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011370; classtype:social-engineering; sid:6011370; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dbhlmp.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.dbhlmp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011371; classtype:social-engineering; sid:6011371; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-travik-biz-dolsen-qarmu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-travik-biz-dolsen-qarmu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011372; classtype:social-engineering; sid:6011372; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coinsqure-eng.zapier.app/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"coinsqure-eng.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011373; classtype:social-engineering; sid:6011373; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17335.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17335.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011374; classtype:social-engineering; sid:6011374; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gemini-balance.755176.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gemini-balance.755176.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011375; classtype:social-engineering; sid:6011375; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ahjykr.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ahjykr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011376; classtype:social-engineering; sid:6011376; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (salecreekmarina.com/kofthqin/)"; flow:established,to_server; http.uri; content:"/kofthqin/"; startswith; fast_pattern; http.host; content:"salecreekmarina.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011377; classtype:social-engineering; sid:6011377; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zxscfv.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.zxscfv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011378; classtype:social-engineering; sid:6011378; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (y218g.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"y218g.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011379; classtype:social-engineering; sid:6011379; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.galabetmobil.co/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.galabetmobil.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011380; classtype:social-engineering; sid:6011380; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail.au.newsalerts.com.sg/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"webmail.au.newsalerts.com.sg"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011381; classtype:social-engineering; sid:6011381; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-qurnax-biz-vrolnik-glortex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-qurnax-biz-vrolnik-glortex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011382; classtype:social-engineering; sid:6011382; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.galabetresmigrisi.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.galabetresmigrisi.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011383; classtype:social-engineering; sid:6011383; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (azure-celery-615100.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"azure-celery-615100.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011384; classtype:social-engineering; sid:6011384; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.sharefiles.email/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"login.sharefiles.email"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011385; classtype:social-engineering; sid:6011385; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (djksjvjds.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"djksjvjds.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011386; classtype:social-engineering; sid:6011386; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zhapp-douqiuzhibo.com/id-update)"; flow:established,to_server; http.uri; content:"/id-update"; startswith; fast_pattern; http.host; content:"zhapp-douqiuzhibo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011387; classtype:social-engineering; sid:6011387; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support.malwarequarantine.com/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"support.malwarequarantine.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011388; classtype:social-engineering; sid:6011388; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (au.enterpriserewards.com.sg/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"au.enterpriserewards.com.sg"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011389; classtype:social-engineering; sid:6011389; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.socialnetworkingcentral.com/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"login.socialnetworkingcentral.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011390; classtype:social-engineering; sid:6011390; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.umyeos.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.umyeos.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011391; classtype:social-engineering; sid:6011391; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dana.websiite-resmi.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dana.websiite-resmi.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011392; classtype:social-engineering; sid:6011392; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bbvaenlinea.github.io/santander.com)"; flow:established,to_server; http.uri; content:"/santander.com"; startswith; fast_pattern; http.host; content:"bbvaenlinea.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011393; classtype:social-engineering; sid:6011393; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (koiiccuiglogig.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"koiiccuiglogig.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011394; classtype:social-engineering; sid:6011394; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-fratox-biz-glarnik-plurnov.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-fratox-biz-glarnik-plurnov.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011395; classtype:social-engineering; sid:6011395; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (au.expressparcel.com.sg/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"au.expressparcel.com.sg"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011396; classtype:social-engineering; sid:6011396; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tlrfbj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tlrfbj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011397; classtype:social-engineering; sid:6011397; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-dravvor-biz-fraltex-glurnix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-dravvor-biz-fraltex-glurnix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011398; classtype:social-engineering; sid:6011398; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.itineraryupdate.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"mail.itineraryupdate.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011399; classtype:social-engineering; sid:6011399; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (default._bimi.073202.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"default._bimi.073202.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011400; classtype:social-engineering; sid:6011400; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (humanrisefoundation.org/t@xform/form/login.htm)"; flow:established,to_server; http.uri; content:"/t@xform/form/login.htm"; startswith; fast_pattern; http.host; content:"humanrisefoundation.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011401; classtype:social-engineering; sid:6011401; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17366.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17366.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011402; classtype:social-engineering; sid:6011402; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-frutem-biz-glanrix-slortex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-frutem-biz-glanrix-slortex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011403; classtype:social-engineering; sid:6011403; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maps-cloud.com/aU3VJ0FM/)"; flow:established,to_server; http.uri; content:"/aU3VJ0FM/"; startswith; fast_pattern; http.host; content:"maps-cloud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011404; classtype:social-engineering; sid:6011404; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bobsrvsc.com/docusign/Mac/utility.php)"; flow:established,to_server; http.uri; content:"/docusign/Mac/utility.php"; startswith; fast_pattern; http.host; content:"bobsrvsc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011405; classtype:social-engineering; sid:6011405; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (greeninvestmentgroup.073202.com/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"greeninvestmentgroup.073202.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011406; classtype:social-engineering; sid:6011406; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee3336.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopee3336.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011407; classtype:social-engineering; sid:6011407; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee3336.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.shopee3336.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011408; classtype:social-engineering; sid:6011408; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (registerdomain.asia/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"registerdomain.asia"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011409; classtype:social-engineering; sid:6011409; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-frurnex-biz-slatem-qarnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-frurnex-biz-slatem-qarnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011410; classtype:social-engineering; sid:6011410; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appchsbb.partnersbbswisspassch.com/protechsupconectappch/login.php)"; flow:established,to_server; http.uri; content:"/protechsupconectappch/login.php"; startswith; fast_pattern; http.host; content:"appchsbb.partnersbbswisspassch.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011411; classtype:social-engineering; sid:6011411; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (localsites.hrbonuses.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"localsites.hrbonuses.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011412; classtype:social-engineering; sid:6011412; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (livesocially.co/ftx/page.html)"; flow:established,to_server; http.uri; content:"/ftx/page.html"; startswith; fast_pattern; http.host; content:"livesocially.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011413; classtype:social-engineering; sid:6011413; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-glortor-biz-slurnik-fralnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-glortor-biz-slurnik-fralnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011414; classtype:social-engineering; sid:6011414; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vrantex-biz-slornik-glunor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vrantex-biz-slornik-glunor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011415; classtype:social-engineering; sid:6011415; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (delivery-globaldhlauth.github.io/samedaydelivery/)"; flow:established,to_server; http.uri; content:"/samedaydelivery/"; startswith; fast_pattern; http.host; content:"delivery-globaldhlauth.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011416; classtype:social-engineering; sid:6011416; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.asdsfr.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.asdsfr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011417; classtype:social-engineering; sid:6011417; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tksell.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tksell.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011418; classtype:social-engineering; sid:6011418; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17382.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17382.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011419; classtype:social-engineering; sid:6011419; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.galabet-songirisler.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.galabet-songirisler.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011420; classtype:social-engineering; sid:6011420; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi254.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"info-resmi254.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011421; classtype:social-engineering; sid:6011421; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dbscapitaldcep.com/dist)"; flow:established,to_server; http.uri; content:"/dist"; startswith; fast_pattern; http.host; content:"www.dbscapitaldcep.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011422; classtype:social-engineering; sid:6011422; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (emailaccesspolicytermination.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"emailaccesspolicytermination.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011423; classtype:social-engineering; sid:6011423; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.postros.shop/update)"; flow:established,to_server; http.uri; content:"/update"; startswith; fast_pattern; http.host; content:"usps.postros.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011424; classtype:social-engineering; sid:6011424; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hth-mobile.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hth-mobile.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011425; classtype:social-engineering; sid:6011425; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ahv3ctpms4e.tokenvalidate.com/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"ahv3ctpms4e.tokenvalidate.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011426; classtype:social-engineering; sid:6011426; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uuu.binanceltd.ltd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uuu.binanceltd.ltd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011427; classtype:social-engineering; sid:6011427; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.umyeos.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.umyeos.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011428; classtype:social-engineering; sid:6011428; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.itineraryupdate.com/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"mail.itineraryupdate.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011429; classtype:social-engineering; sid:6011429; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-slantek-biz-vortix-qralnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-slantek-biz-vortix-qralnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011430; classtype:social-engineering; sid:6011430; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gebyar-shopee20.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.gebyar-shopee20.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011431; classtype:social-engineering; sid:6011431; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (professional-blackberry-043549.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"professional-blackberry-043549.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011432; classtype:social-engineering; sid:6011432; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (naifei.win/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"naifei.win"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011433; classtype:social-engineering; sid:6011433; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uzmanbahis.one/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uzmanbahis.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011434; classtype:social-engineering; sid:6011434; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rijmhck.cn/icloudss/)"; flow:established,to_server; http.uri; content:"/icloudss/"; startswith; fast_pattern; http.host; content:"rijmhck.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011435; classtype:social-engineering; sid:6011435; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17336.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17336.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011436; classtype:social-engineering; sid:6011436; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (strumentimusicaliporri.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"strumentimusicaliporri.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011437; classtype:social-engineering; sid:6011437; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (runicvapors.info/41-1511-280526/?u=83C1515&e=Co.uldry%2540yahoo.fr&s3=Corinne&s4=Uldry&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/41-1511-280526/?u=83C1515&e=Co.uldry%2540yahoo.fr&s3=Corinne&s4=Uldry&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"runicvapors.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011438; classtype:social-engineering; sid:6011438; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (postch-reprogrammation.help/pages/ban.php)"; flow:established,to_server; http.uri; content:"/pages/ban.php"; startswith; fast_pattern; http.host; content:"postch-reprogrammation.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011439; classtype:social-engineering; sid:6011439; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (postch-reprogrammation.help/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"postch-reprogrammation.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011440; classtype:social-engineering; sid:6011440; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-tenqor-biz-vralik-mosdu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-tenqor-biz-vralik-mosdu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011441; classtype:social-engineering; sid:6011441; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (black-math-cbc3.dakriacreuielwtxea.workers.dev/meta.help)"; flow:established,to_server; http.uri; content:"/meta.help"; startswith; fast_pattern; http.host; content:"black-math-cbc3.dakriacreuielwtxea.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011442; classtype:social-engineering; sid:6011442; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vrolqix-biz-plarnex-glutor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vrolqix-biz-plarnex-glutor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011443; classtype:social-engineering; sid:6011443; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (make-lynx-807794.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"make-lynx-807794.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011444; classtype:social-engineering; sid:6011444; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (postailedger.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"postailedger.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011445; classtype:social-engineering; sid:6011445; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uzmanbahis2.one/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uzmanbahis2.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011446; classtype:social-engineering; sid:6011446; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (voicemailnotificationportal-5769909.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"voicemailnotificationportal-5769909.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011447; classtype:social-engineering; sid:6011447; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (registerdomain.asia/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"registerdomain.asia"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011448; classtype:social-engineering; sid:6011448; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (localsites.hrbonuses.com/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"localsites.hrbonuses.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011449; classtype:social-engineering; sid:6011449; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.opportunityboost2026.free.nf/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.opportunityboost2026.free.nf"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011450; classtype:social-engineering; sid:6011450; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nrabzh.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nrabzh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011451; classtype:social-engineering; sid:6011451; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cnci--seguridad019.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cnci--seguridad019.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011452; classtype:social-engineering; sid:6011452; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kleinanzeigen-deutsch.srvc-de836589.info/getpaymentm/201631787/m9/)"; flow:established,to_server; http.uri; content:"/getpaymentm/201631787/m9/"; startswith; fast_pattern; http.host; content:"kleinanzeigen-deutsch.srvc-de836589.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011453; classtype:social-engineering; sid:6011453; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (landing.azeiteeoliva.info/41-1511-280526/?u=161C1515&e=p.ernst%2540bluewin.ch&s3=Peter&s4=Ernst&s5=&s6=8404&s7=&s8=)"; flow:established,to_server; http.uri; content:"/41-1511-280526/?u=161C1515&e=p.ernst%2540bluewin.ch&s3=Peter&s4=Ernst&s5=&s6=8404&s7=&s8="; startswith; fast_pattern; http.host; content:"landing.azeiteeoliva.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011454; classtype:social-engineering; sid:6011454; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.officemodels.gr/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.officemodels.gr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011455; classtype:social-engineering; sid:6011455; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.greetings.pictures/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"mail.greetings.pictures"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011456; classtype:social-engineering; sid:6011456; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vraltem-biz-plurnik-glarnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vraltem-biz-plurnik-glarnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011457; classtype:social-engineering; sid:6011457; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-trurnex-biz-vralnik-glotor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-trurnex-biz-vralnik-glotor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011458; classtype:social-engineering; sid:6011458; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-yaltek-biz-drumfa-korli.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-yaltek-biz-drumfa-korli.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011459; classtype:social-engineering; sid:6011459; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inspirational-pizza-522938.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"inspirational-pizza-522938.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011460; classtype:social-engineering; sid:6011460; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rbxliy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rbxliy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011461; classtype:social-engineering; sid:6011461; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ciqopd.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ciqopd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011462; classtype:social-engineering; sid:6011462; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.affthaimgf.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.affthaimgf.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011463; classtype:social-engineering; sid:6011463; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.sharefiles.email/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"login.sharefiles.email"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011464; classtype:social-engineering; sid:6011464; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (psc-whatsapps.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"psc-whatsapps.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011465; classtype:social-engineering; sid:6011465; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (h5-zh-lols15.com/erhnxewq/)"; flow:established,to_server; http.uri; content:"/erhnxewq/"; startswith; fast_pattern; http.host; content:"h5-zh-lols15.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011466; classtype:social-engineering; sid:6011466; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zweyld.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.zweyld.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011467; classtype:social-engineering; sid:6011467; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ssl.creditunion-banking.org/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"ssl.creditunion-banking.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011468; classtype:social-engineering; sid:6011468; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.affthaimgf.net/user/login)"; flow:established,to_server; http.uri; content:"/user/login"; startswith; fast_pattern; http.host; content:"www.affthaimgf.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011469; classtype:social-engineering; sid:6011469; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-lirvak-biz-prosen-duxra.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-lirvak-biz-prosen-duxra.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011470; classtype:social-engineering; sid:6011470; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (omkar-dhamdhere.github.io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"omkar-dhamdhere.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011471; classtype:social-engineering; sid:6011471; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeejkt737.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopeejkt737.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011472; classtype:social-engineering; sid:6011472; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (greeninvestmentgroup.073202.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"greeninvestmentgroup.073202.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011473; classtype:social-engineering; sid:6011473; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (au.enterpriserewards.com.sg/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"au.enterpriserewards.com.sg"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011474; classtype:social-engineering; sid:6011474; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (n1.5jb7.com/index.html#/pages/register/register?inviter=77736723&domain=n1.5jb7.com&landing=n1.5jb7.com)"; flow:established,to_server; http.uri; content:"/index.html#/pages/register/register?inviter=77736723&domain=n1.5jb7.com&landing=n1.5jb7.com"; startswith; fast_pattern; http.host; content:"n1.5jb7.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011475; classtype:social-engineering; sid:6011475; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vycbaqa.cn/icloudss)"; flow:established,to_server; http.uri; content:"/icloudss"; startswith; fast_pattern; http.host; content:"vycbaqa.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011476; classtype:social-engineering; sid:6011476; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-qurnor-biz-vraltex-glanik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-qurnor-biz-vraltex-glanik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011477; classtype:social-engineering; sid:6011477; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.on.yjrvw.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.on.yjrvw.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011478; classtype:social-engineering; sid:6011478; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.au.expressparcel.com.sg/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"mail.au.expressparcel.com.sg"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011479; classtype:social-engineering; sid:6011479; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.officemodels.have-fun.gr/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.officemodels.have-fun.gr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011480; classtype:social-engineering; sid:6011480; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.spwindustrial.com/gigabyte-radeon-rx-6400-d6-low-profile-4g-hdmi-dp-video-card-gddr6-350w/)"; flow:established,to_server; http.uri; content:"/gigabyte-radeon-rx-6400-d6-low-profile-4g-hdmi-dp-video-card-gddr6-350w/"; startswith; fast_pattern; http.host; content:"www.spwindustrial.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011481; classtype:social-engineering; sid:6011481; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.socialnetworkingcentral.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"login.socialnetworkingcentral.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011482; classtype:social-engineering; sid:6011482; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.b000555.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.b000555.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011483; classtype:social-engineering; sid:6011483; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-beryl-three.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-beryl-three.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011484; classtype:social-engineering; sid:6011484; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ptshopee990.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"ptshopee990.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011485; classtype:social-engineering; sid:6011485; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ssl.creditunion-banking.org/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"ssl.creditunion-banking.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011486; classtype:social-engineering; sid:6011486; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (daily-lynx-193002.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"daily-lynx-193002.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011487; classtype:social-engineering; sid:6011487; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (theflurry.info/41-1511-280526/?u=161C1515&e=fasel.arno%2540bluewin.ch&s3=Ursula&s4=Widmer&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/41-1511-280526/?u=161C1515&e=fasel.arno%2540bluewin.ch&s3=Ursula&s4=Widmer&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"theflurry.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011488; classtype:social-engineering; sid:6011488; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeejkt734.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopeejkt734.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011489; classtype:social-engineering; sid:6011489; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wedfew1.pages.dev/amz-books/discover?node=1)"; flow:established,to_server; http.uri; content:"/amz-books/discover?node=1"; startswith; fast_pattern; http.host; content:"wedfew1.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011490; classtype:social-engineering; sid:6011490; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (itupdatealert.com/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"itupdatealert.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011491; classtype:social-engineering; sid:6011491; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support.malwarequarantine.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"support.malwarequarantine.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011492; classtype:social-engineering; sid:6011492; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.greetings.pictures/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"mail.greetings.pictures"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011493; classtype:social-engineering; sid:6011493; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nab.439980.cc/au/rewards/)"; flow:established,to_server; http.uri; content:"/au/rewards/"; startswith; fast_pattern; http.host; content:"nab.439980.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011494; classtype:social-engineering; sid:6011494; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9268365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9268365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011495; classtype:social-engineering; sid:6011495; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coinsqure-eng.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coinsqure-eng.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011496; classtype:social-engineering; sid:6011496; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-brenuk-biz-faltem-qurvo.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-brenuk-biz-faltem-qurvo.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011497; classtype:social-engineering; sid:6011497; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nrabzh.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.nrabzh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011498; classtype:social-engineering; sid:6011498; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-cam.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-cam.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011499; classtype:social-engineering; sid:6011499; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopeejkt734.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.shopeejkt734.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011500; classtype:social-engineering; sid:6011500; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (scriptmalware-alt.github.io/Dana_Special)"; flow:established,to_server; http.uri; content:"/Dana_Special"; startswith; fast_pattern; http.host; content:"scriptmalware-alt.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011501; classtype:social-engineering; sid:6011501; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galabet3179.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galabet3179.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011502; classtype:social-engineering; sid:6011502; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-glutek-biz-qarnor-slavnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-glutek-biz-qarnor-slavnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011503; classtype:social-engineering; sid:6011503; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.galabet-resmi1.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.galabet-resmi1.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011504; classtype:social-engineering; sid:6011504; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-plurnik-biz-fravtor-glunex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-plurnik-biz-fravtor-glunex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011505; classtype:social-engineering; sid:6011505; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-gorven-biz-zamtri-felqo.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-gorven-biz-zamtri-felqo.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011506; classtype:social-engineering; sid:6011506; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.galabetgiris.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.galabetgiris.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011507; classtype:social-engineering; sid:6011507; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (datacompliancereview.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"datacompliancereview.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011508; classtype:social-engineering; sid:6011508; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (visual-polygon-325468.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"visual-polygon-325468.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011509; classtype:social-engineering; sid:6011509; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docs.creditunion-financial.com/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"docs.creditunion-financial.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011510; classtype:social-engineering; sid:6011510; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docs.creditunion-financial.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"docs.creditunion-financial.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011511; classtype:social-engineering; sid:6011511; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (default._bimi.073202.com/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"default._bimi.073202.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011512; classtype:social-engineering; sid:6011512; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bdooc.cc/ph)"; flow:established,to_server; http.uri; content:"/ph"; startswith; fast_pattern; http.host; content:"bdooc.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011513; classtype:social-engineering; sid:6011513; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-glavrix-biz-qarnex-vroltor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-glavrix-biz-qarnex-vroltor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011514; classtype:social-engineering; sid:6011514; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (updateantivir.us/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"updateantivir.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011515; classtype:social-engineering; sid:6011515; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hadiahshopee286.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hadiahshopee286.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011516; classtype:social-engineering; sid:6011516; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail.au.bezpieczneudostepnianieplikow.pl/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"webmail.au.bezpieczneudostepnianieplikow.pl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011517; classtype:social-engineering; sid:6011517; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cozy-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cozy-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011518; classtype:social-engineering; sid:6011518; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zweyld.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zweyld.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011519; classtype:social-engineering; sid:6011519; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.giris-padisahbet-sabit.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.giris-padisahbet-sabit.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011520; classtype:social-engineering; sid:6011520; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (au.expressparcel.com.sg/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"au.expressparcel.com.sg"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011521; classtype:social-engineering; sid:6011521; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maderistasouto.es/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"maderistasouto.es"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011522; classtype:social-engineering; sid:6011522; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-platem-biz-glurnor-vroltex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-platem-biz-glurnor-vroltex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011523; classtype:social-engineering; sid:6011523; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.irenechiang.com/interests)"; flow:established,to_server; http.uri; content:"/interests"; startswith; fast_pattern; http.host; content:"www.irenechiang.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011524; classtype:social-engineering; sid:6011524; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wordpress-212295-0.cloudclusters.net/sbbclient/Y2TxZW3/Y2XtYw3/)"; flow:established,to_server; http.uri; content:"/sbbclient/Y2TxZW3/Y2XtYw3/"; startswith; fast_pattern; http.host; content:"wordpress-212295-0.cloudclusters.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011525; classtype:social-engineering; sid:6011525; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7t83kwq8goz9zkbc.23.32.qjgarden.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7t83kwq8goz9zkbc.23.32.qjgarden.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011526; classtype:social-engineering; sid:6011526; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xamanreviewpolicy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xamanreviewpolicy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011527; classtype:social-engineering; sid:6011527; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17338.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17338.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011528; classtype:social-engineering; sid:6011528; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zh-paly-okooo.com/kofthqin/)"; flow:established,to_server; http.uri; content:"/kofthqin/"; startswith; fast_pattern; http.host; content:"zh-paly-okooo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011529; classtype:social-engineering; sid:6011529; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (updateantivir.us/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"updateantivir.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011530; classtype:social-engineering; sid:6011530; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.phwamj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.phwamj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011531; classtype:social-engineering; sid:6011531; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ssl.secureinvestingonline.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"ssl.secureinvestingonline.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011532; classtype:social-engineering; sid:6011532; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trainingcenter.pkugombong.com/Update/login.htm)"; flow:established,to_server; http.uri; content:"/Update/login.htm"; startswith; fast_pattern; http.host; content:"trainingcenter.pkugombong.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011533; classtype:social-engineering; sid:6011533; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pzszpng.cn/icloudss)"; flow:established,to_server; http.uri; content:"/icloudss"; startswith; fast_pattern; http.host; content:"pzszpng.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011534; classtype:social-engineering; sid:6011534; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (services-publics.grupozasacr.com/infospage.php)"; flow:established,to_server; http.uri; content:"/infospage.php"; startswith; fast_pattern; http.host; content:"services-publics.grupozasacr.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011535; classtype:social-engineering; sid:6011535; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ptshopee3677.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.ptshopee3677.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011536; classtype:social-engineering; sid:6011536; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gebyar-shope-2022.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gebyar-shope-2022.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011537; classtype:social-engineering; sid:6011537; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (owa.donationsnonprofit.com/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"owa.donationsnonprofit.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011538; classtype:social-engineering; sid:6011538; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-qortem-biz-fralnix-vrolax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-qortem-biz-fralnix-vrolax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011539; classtype:social-engineering; sid:6011539; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-druntex-biz-fralnix-plamvor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-druntex-biz-fralnix-plamvor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011540; classtype:social-engineering; sid:6011540; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.teamwj.com/p/lza-qjt/eqwjnihf/)"; flow:established,to_server; http.uri; content:"/p/lza-qjt/eqwjnihf/"; startswith; fast_pattern; http.host; content:"s.teamwj.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011541; classtype:social-engineering; sid:6011541; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.intzow.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.intzow.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011542; classtype:social-engineering; sid:6011542; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (techponds.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"techponds.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011543; classtype:social-engineering; sid:6011543; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coopmerlosl.com.ar/alexiscoulston/centerbase.html)"; flow:established,to_server; http.uri; content:"/alexiscoulston/centerbase.html"; startswith; fast_pattern; http.host; content:"coopmerlosl.com.ar"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011544; classtype:social-engineering; sid:6011544; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.resmi-adresim-meritbet.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.resmi-adresim-meritbet.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011545; classtype:social-engineering; sid:6011545; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inxex-id.dgtlx.biz.id/xxdana/int.html)"; flow:established,to_server; http.uri; content:"/xxdana/int.html"; startswith; fast_pattern; http.host; content:"inxex-id.dgtlx.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011546; classtype:social-engineering; sid:6011546; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (services-publics.grupozasacr.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"services-publics.grupozasacr.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011547; classtype:social-engineering; sid:6011547; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-drunvor-biz-qoltex-glarnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-drunvor-biz-qoltex-glarnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011548; classtype:social-engineering; sid:6011548; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hsbc-batalkan.transaksi.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hsbc-batalkan.transaksi.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011549; classtype:social-engineering; sid:6011549; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.14152.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.14152.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011550; classtype:social-engineering; sid:6011550; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-slortik-biz-qravnex-glamvor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-slortik-biz-qravnex-glamvor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011551; classtype:social-engineering; sid:6011551; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-qarnul-biz-vraxem-plortik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-qarnul-biz-vraxem-plortik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011552; classtype:social-engineering; sid:6011552; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kleinanzeigen-deutsch.de-supservc.info/getpaymentm/247851809/m)"; flow:established,to_server; http.uri; content:"/getpaymentm/247851809/m"; startswith; fast_pattern; http.host; content:"kleinanzeigen-deutsch.de-supservc.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011553; classtype:social-engineering; sid:6011553; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-fralnex-biz-glurnor-platik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-fralnex-biz-glurnor-platik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011554; classtype:social-engineering; sid:6011554; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-plarnov-biz-glunex-vratem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-plarnov-biz-glunex-vratem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011555; classtype:social-engineering; sid:6011555; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.360967365756.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.360967365756.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011556; classtype:social-engineering; sid:6011556; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-glurnax-biz-vroltek-pranix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-glurnax-biz-vroltek-pranix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011557; classtype:social-engineering; sid:6011557; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kleinanzeigen-deutsch.de-supservc.info/getpaymentm/224006605/m)"; flow:established,to_server; http.uri; content:"/getpaymentm/224006605/m"; startswith; fast_pattern; http.host; content:"kleinanzeigen-deutsch.de-supservc.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011558; classtype:social-engineering; sid:6011558; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-glarnik-biz-slurnor-qurnax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-glarnik-biz-slurnor-qurnax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011559; classtype:social-engineering; sid:6011559; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (able-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"able-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011560; classtype:social-engineering; sid:6011560; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fb-clone-new.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fb-clone-new.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011561; classtype:social-engineering; sid:6011561; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-drurnor-biz-framnik-plaqtex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-drurnor-biz-framnik-plaqtex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011562; classtype:social-engineering; sid:6011562; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-tronex-biz-vrolvik-plarnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-tronex-biz-vrolvik-plarnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011563; classtype:social-engineering; sid:6011563; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tanmoypanda2007-prog.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"tanmoypanda2007-prog.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011564; classtype:social-engineering; sid:6011564; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hivox.pk/wp-content/plugins/log/index/app/index.html)"; flow:established,to_server; http.uri; content:"/wp-content/plugins/log/index/app/index.html"; startswith; fast_pattern; http.host; content:"hivox.pk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011565; classtype:social-engineering; sid:6011565; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-glarnor-biz-framtex-slurnax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-glarnor-biz-framtex-slurnax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011566; classtype:social-engineering; sid:6011566; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-glortik-biz-slarnex-dravvor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-glortik-biz-slarnex-dravvor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011567; classtype:social-engineering; sid:6011567; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-slurnik-biz-fralvor-plarnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-slurnik-biz-fralvor-plarnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011568; classtype:social-engineering; sid:6011568; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cc512031.tw1.ru/info000departemen/)"; flow:established,to_server; http.uri; content:"/info000departemen/"; startswith; fast_pattern; http.host; content:"cc512031.tw1.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011569; classtype:social-engineering; sid:6011569; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-vraxtek-biz-qravnix-glarnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-vraxtek-biz-qravnix-glarnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011570; classtype:social-engineering; sid:6011570; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-vrolvor-biz-fralnik-glarnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-vrolvor-biz-fralnik-glarnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011571; classtype:social-engineering; sid:6011571; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-glarnor-biz-qurnex-vroltex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-glarnor-biz-qurnex-vroltex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011572; classtype:social-engineering; sid:6011572; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bigcvoucher.corporatereward.net/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"bigcvoucher.corporatereward.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011573; classtype:social-engineering; sid:6011573; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-glurnor-biz-fraltek-plaqnix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-glurnor-biz-fraltek-plaqnix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011574; classtype:social-engineering; sid:6011574; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecstacy231104.github.io/NETFLIX-UI-CLONE)"; flow:established,to_server; http.uri; content:"/NETFLIX-UI-CLONE"; startswith; fast_pattern; http.host; content:"ecstacy231104.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011575; classtype:social-engineering; sid:6011575; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xmlf-ag9n-th11.mgeorgatos-netw1-com-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xmlf-ag9n-th11.mgeorgatos-netw1-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011576; classtype:social-engineering; sid:6011576; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (orginal-resmi-meritbet.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"orginal-resmi-meritbet.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011577; classtype:social-engineering; sid:6011577; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail.premisp.net/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"webmail.premisp.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011578; classtype:social-engineering; sid:6011578; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spongebob30k.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"spongebob30k.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011579; classtype:social-engineering; sid:6011579; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365bet199.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.365bet199.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011580; classtype:social-engineering; sid:6011580; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-naxver-biz-turqen-dosmi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-naxver-biz-turqen-dosmi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011581; classtype:social-engineering; sid:6011581; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bigcvoucher.corporatereward.net/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"bigcvoucher.corporatereward.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011582; classtype:social-engineering; sid:6011582; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (h224-v0en-q6qs.scott-treasuredropz-com-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"h224-v0en-q6qs.scott-treasuredropz-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011583; classtype:social-engineering; sid:6011583; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hizli-erisim-meritbet.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hizli-erisim-meritbet.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011584; classtype:social-engineering; sid:6011584; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.pmeimg8.com/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"mail.pmeimg8.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011585; classtype:social-engineering; sid:6011585; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-slarnor-biz-qolnix-tramtek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-slarnor-biz-qolnix-tramtek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011586; classtype:social-engineering; sid:6011586; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (finance1.expensenotifications.com/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"finance1.expensenotifications.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011587; classtype:social-engineering; sid:6011587; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p28z.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p28z.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011588; classtype:social-engineering; sid:6011588; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cool-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cool-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011589; classtype:social-engineering; sid:6011589; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee-tbk489.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopee-tbk489.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011590; classtype:social-engineering; sid:6011590; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.e-serviceparts.info/landingpage/a92eca60-2cb8-444d-9623-dfa436879834/cygk1vk6hdnc_hdqkp4oz9wy-rwmw2t-8xdcs_5k-m)"; flow:established,to_server; http.uri; content:"/landingpage/a92eca60-2cb8-444d-9623-dfa436879834/cygk1vk6hdnc_hdqkp4oz9wy-rwmw2t-8xdcs_5k-m"; startswith; fast_pattern; http.host; content:"www.e-serviceparts.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011591; classtype:social-engineering; sid:6011591; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail.367450.com/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"webmail.367450.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011592; classtype:social-engineering; sid:6011592; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-qolnex-biz-glortik-vramtex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-qolnex-biz-glortik-vramtex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011593; classtype:social-engineering; sid:6011593; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abhishek-codelab.github.io/Amazon-Homepage-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Homepage-Clone/"; startswith; fast_pattern; http.host; content:"abhishek-codelab.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011594; classtype:social-engineering; sid:6011594; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kleinanzeigen-deutsch.de-supservc.info/getpaymentm/203945882/m)"; flow:established,to_server; http.uri; content:"/getpaymentm/203945882/m"; startswith; fast_pattern; http.host; content:"kleinanzeigen-deutsch.de-supservc.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011595; classtype:social-engineering; sid:6011595; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-platik-biz-qurnex-glarnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-platik-biz-qurnex-glarnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011596; classtype:social-engineering; sid:6011596; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail.367450.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"webmail.367450.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011597; classtype:social-engineering; sid:6011597; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail.allaccesspass.xyz/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"webmail.allaccesspass.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011598; classtype:social-engineering; sid:6011598; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17205.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17205.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011599; classtype:social-engineering; sid:6011599; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-drantem-biz-glurnik-fralnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-drantem-biz-glurnik-fralnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011600; classtype:social-engineering; sid:6011600; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.hizli-erisim-meritbet.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.hizli-erisim-meritbet.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011601; classtype:social-engineering; sid:6011601; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-qoltem-biz-plurnex-fravik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-qoltem-biz-plurnex-fravik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011602; classtype:social-engineering; sid:6011602; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-tralvik-biz-frunex-qormax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-tralvik-biz-frunex-qormax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011603; classtype:social-engineering; sid:6011603; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-drunvax-biz-slortek-qravlor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-drunvax-biz-slortek-qravlor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011604; classtype:social-engineering; sid:6011604; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lejj-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lejj-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011605; classtype:social-engineering; sid:6011605; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee-tbk489.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopee-tbk489.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011606; classtype:social-engineering; sid:6011606; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t70f.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"t70f.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011607; classtype:social-engineering; sid:6011607; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-dravor-biz-qurnik-fralnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-dravor-biz-qurnik-fralnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011608; classtype:social-engineering; sid:6011608; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bet6612.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bet6612.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011609; classtype:social-engineering; sid:6011609; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezzore-suiite-en.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezzore-suiite-en.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011610; classtype:social-engineering; sid:6011610; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-glurnik-biz-qortem-vrolax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-glurnik-biz-qortem-vrolax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011611; classtype:social-engineering; sid:6011611; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (serviziome1ntar.justns.ru/de/)"; flow:established,to_server; http.uri; content:"/de/"; startswith; fast_pattern; http.host; content:"serviziome1ntar.justns.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011612; classtype:social-engineering; sid:6011612; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-qravtor-biz-plaqnik-glurnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-qravtor-biz-plaqnik-glurnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011613; classtype:social-engineering; sid:6011613; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail.allaccesspass.xyz/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"webmail.allaccesspass.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011614; classtype:social-engineering; sid:6011614; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nexeora.top/PL-1466-160526/?u=162C1466&e=slawomir.zalewski0%40)"; flow:established,to_server; http.uri; content:"/PL-1466-160526/?u=162C1466&e=slawomir.zalewski0%40"; startswith; fast_pattern; http.host; content:"nexeora.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011615; classtype:social-engineering; sid:6011615; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-plaqvor-biz-glarnik-fraltex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-plaqvor-biz-glarnik-fraltex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011616; classtype:social-engineering; sid:6011616; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wilsongroup.in/Docusign/Mac/utility.php)"; flow:established,to_server; http.uri; content:"/Docusign/Mac/utility.php"; startswith; fast_pattern; http.host; content:"wilsongroup.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011617; classtype:social-engineering; sid:6011617; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (879myproductcidsbbpass.wasmer.app/login.php)"; flow:established,to_server; http.uri; content:"/login.php"; startswith; fast_pattern; http.host; content:"879myproductcidsbbpass.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011618; classtype:social-engineering; sid:6011618; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-plaqnix-biz-dranvor-vroltek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-plaqnix-biz-dranvor-vroltek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011619; classtype:social-engineering; sid:6011619; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-qurnex-biz-fralnor-platem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-qurnex-biz-fralnor-platem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011620; classtype:social-engineering; sid:6011620; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (join-eligible-ede8.oppome7272.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"join-eligible-ede8.oppome7272.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011621; classtype:social-engineering; sid:6011621; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dynamic-panda-bb5b17.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dynamic-panda-bb5b17.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011622; classtype:social-engineering; sid:6011622; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-fruntor-biz-slarnik-dravnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-fruntor-biz-slarnik-dravnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011623; classtype:social-engineering; sid:6011623; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (logs.netaccess-management.net/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"logs.netaccess-management.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011624; classtype:social-engineering; sid:6011624; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.skillplatformworking.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.skillplatformworking.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011625; classtype:social-engineering; sid:6011625; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-qravvik-biz-vroltor-plaqnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-qravvik-biz-vroltor-plaqnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011626; classtype:social-engineering; sid:6011626; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (x21v.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"x21v.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011627; classtype:social-engineering; sid:6011627; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (finance-binance.org.hedgefunds-investment.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"finance-binance.org.hedgefunds-investment.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011628; classtype:social-engineering; sid:6011628; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.14267.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.14267.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011629; classtype:social-engineering; sid:6011629; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hsbc-batalkan.transaksi.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hsbc-batalkan.transaksi.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011630; classtype:social-engineering; sid:6011630; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail.careerpostings.org/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"webmail.careerpostings.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011631; classtype:social-engineering; sid:6011631; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mycodashop.topup-diamonds.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mycodashop.topup-diamonds.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011632; classtype:social-engineering; sid:6011632; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (top-28circles.com/id-update)"; flow:established,to_server; http.uri; content:"/id-update"; startswith; fast_pattern; http.host; content:"top-28circles.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011633; classtype:social-engineering; sid:6011633; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.vvww-roblox.co/users/984106838/profile/)"; flow:established,to_server; http.uri; content:"/users/984106838/profile/"; startswith; fast_pattern; http.host; content:"www.vvww-roblox.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011634; classtype:social-engineering; sid:6011634; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (snifferip.com/25vd4.png)"; flow:established,to_server; http.uri; content:"/25vd4.png"; startswith; fast_pattern; http.host; content:"snifferip.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011635; classtype:social-engineering; sid:6011635; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (finance1.expensenotifications.com/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"finance1.expensenotifications.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011636; classtype:social-engineering; sid:6011636; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-drantex-biz-slurnik-fravor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-drantex-biz-slurnik-fravor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011637; classtype:social-engineering; sid:6011637; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (logs.netaccess-management.net/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"logs.netaccess-management.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011638; classtype:social-engineering; sid:6011638; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ayushhanand07.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"ayushhanand07.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011639; classtype:social-engineering; sid:6011639; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tr.resmi-adresim-meritbet.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.tr.resmi-adresim-meritbet.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011640; classtype:social-engineering; sid:6011640; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloud.com.hr/Vbj/lzIR)"; flow:established,to_server; http.uri; content:"/Vbj/lzIR"; startswith; fast_pattern; http.host; content:"icloud.com.hr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011641; classtype:social-engineering; sid:6011641; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (claims-fraud-esl-org.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"claims-fraud-esl-org.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011642; classtype:social-engineering; sid:6011642; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17211.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17211.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011643; classtype:social-engineering; sid:6011643; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-plurnor-biz-vraltem-glurnax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-plurnor-biz-vraltem-glurnax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011644; classtype:social-engineering; sid:6011644; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zctkrs.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zctkrs.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011645; classtype:social-engineering; sid:6011645; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.orginal-resmi-meritbet.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.orginal-resmi-meritbet.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011646; classtype:social-engineering; sid:6011646; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (crafty-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"crafty-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011647; classtype:social-engineering; sid:6011647; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365bet011.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.365bet011.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011648; classtype:social-engineering; sid:6011648; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-virid-two-23.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-virid-two-23.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011649; classtype:social-engineering; sid:6011649; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail.sendpicz.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"webmail.sendpicz.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011650; classtype:social-engineering; sid:6011650; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-glortor-biz-qravtek-slarnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-glortor-biz-qravtek-slarnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011651; classtype:social-engineering; sid:6011651; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appleoficial.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"appleoficial.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011652; classtype:social-engineering; sid:6011652; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-tramnex-biz-vraqtor-slarnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-tramnex-biz-vraqtor-slarnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011653; classtype:social-engineering; sid:6011653; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-frurnax-biz-vrolnik-platem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-frurnax-biz-vrolnik-platem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011654; classtype:social-engineering; sid:6011654; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-undianresmishopee.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"info-undianresmishopee.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011655; classtype:social-engineering; sid:6011655; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (capable-article-728685.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"capable-article-728685.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011656; classtype:social-engineering; sid:6011656; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-veltro-biz-ganfur-zimka.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-veltro-biz-ganfur-zimka.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011657; classtype:social-engineering; sid:6011657; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whitepanda.info/48-1466-160526/?u=83C1466&e=igor_1979%40o2.pl&)"; flow:established,to_server; http.uri; content:"/48-1466-160526/?u=83C1466&e=igor_1979%40o2.pl&"; startswith; fast_pattern; http.host; content:"whitepanda.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011658; classtype:social-engineering; sid:6011658; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-fralvor-biz-vrolnax-qravtor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-fralvor-biz-vrolnax-qravtor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011659; classtype:social-engineering; sid:6011659; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-fruntax-biz-glortik-slarnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-fruntax-biz-glortik-slarnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011660; classtype:social-engineering; sid:6011660; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ghpostspapls.eu.cc/gh)"; flow:established,to_server; http.uri; content:"/gh"; startswith; fast_pattern; http.host; content:"ghpostspapls.eu.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011661; classtype:social-engineering; sid:6011661; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vroltor-biz-slatem-qurnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vroltor-biz-slatem-qurnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011662; classtype:social-engineering; sid:6011662; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login-facebook-facebook.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"login-facebook-facebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011663; classtype:social-engineering; sid:6011663; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17209.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17209.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011664; classtype:social-engineering; sid:6011664; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (finance1.expensenotifications.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"finance1.expensenotifications.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011665; classtype:social-engineering; sid:6011665; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faecbook.vn/timbannaygapngay05062026?a)"; flow:established,to_server; http.uri; content:"/timbannaygapngay05062026?a"; startswith; fast_pattern; http.host; content:"faecbook.vn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011666; classtype:social-engineering; sid:6011666; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (piosadn.info/PL-1466-160526/?u=97C1466&e=paulus71%40wp.pl&s3=P)"; flow:established,to_server; http.uri; content:"/PL-1466-160526/?u=97C1466&e=paulus71%40wp.pl&s3=P"; startswith; fast_pattern; http.host; content:"piosadn.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011667; classtype:social-engineering; sid:6011667; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hadiahresmishopee2022.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hadiahresmishopee2022.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011668; classtype:social-engineering; sid:6011668; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-tralnik-biz-qravlor-framtex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-tralnik-biz-qravlor-framtex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011669; classtype:social-engineering; sid:6011669; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p27t.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p27t.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011670; classtype:social-engineering; sid:6011670; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tk-globmall.top:42999/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tk-globmall.top:42999"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011671; classtype:social-engineering; sid:6011671; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.p28y.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.p28y.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011672; classtype:social-engineering; sid:6011672; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail.careerpostings.org/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"webmail.careerpostings.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011673; classtype:social-engineering; sid:6011673; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (afilianbismillah-coder.github.io/Pusat-bantuan-dana-resmi/)"; flow:established,to_server; http.uri; content:"/Pusat-bantuan-dana-resmi/"; startswith; fast_pattern; http.host; content:"afilianbismillah-coder.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011674; classtype:social-engineering; sid:6011674; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17206.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17206.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011675; classtype:social-engineering; sid:6011675; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-plavrix-biz-glarnek-vortam.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-plavrix-biz-glarnek-vortam.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011676; classtype:social-engineering; sid:6011676; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-dravor-biz-vroltex-fratem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-dravor-biz-vroltex-fratem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011677; classtype:social-engineering; sid:6011677; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloud.com.hr/Vbj/l/zIR)"; flow:established,to_server; http.uri; content:"/Vbj/l/zIR"; startswith; fast_pattern; http.host; content:"icloud.com.hr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011678; classtype:social-engineering; sid:6011678; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-dravik-biz-qoltem-frurnax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-dravik-biz-qoltem-frurnax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011679; classtype:social-engineering; sid:6011679; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.pl-oferta47377753.sbs/oferta/Garmin-Fenix-7X-Pro-Sapphire-Solar?id=4z8V8V5I9m6u9y7K1O8j9p0v4B0M5V9F)"; flow:established,to_server; http.uri; content:"/oferta/Garmin-Fenix-7X-Pro-Sapphire-Solar?id=4z8V8V5I9m6u9y7K1O8j9p0v4B0M5V9F"; startswith; fast_pattern; http.host; content:"allegrolokalnie.pl-oferta47377753.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011680; classtype:social-engineering; sid:6011680; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail.sendpicz.com/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"webmail.sendpicz.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011681; classtype:social-engineering; sid:6011681; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-qarnik-biz-glortex-vraltor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-qarnik-biz-glortex-vraltor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011682; classtype:social-engineering; sid:6011682; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sudo-thanos.github.io/Learnable22-Netflix_Clone/)"; flow:established,to_server; http.uri; content:"/Learnable22-Netflix_Clone/"; startswith; fast_pattern; http.host; content:"sudo-thanos.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011683; classtype:social-engineering; sid:6011683; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (okx-24c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"okx-24c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011684; classtype:social-engineering; sid:6011684; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vrolnex-biz-plurnik-glarnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vrolnex-biz-plurnik-glarnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011685; classtype:social-engineering; sid:6011685; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-drurnik-biz-fralor-slurnex-3m9.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-drurnik-biz-fralor-slurnex-3m9.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011686; classtype:social-engineering; sid:6011686; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17210.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17210.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011687; classtype:social-engineering; sid:6011687; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-travnik-biz-drantex-frultor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-travnik-biz-drantex-frultor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011688; classtype:social-engineering; sid:6011688; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vroltex-biz-slurnor-glatem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vroltex-biz-slurnor-glatem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011689; classtype:social-engineering; sid:6011689; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tk-gobamall.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.tk-gobamall.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011690; classtype:social-engineering; sid:6011690; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.finance-binance.org.hedgefunds-investment.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.finance-binance.org.hedgefunds-investment.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011691; classtype:social-engineering; sid:6011691; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-dorvik-biz-lamzen-prusko.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-dorvik-biz-lamzen-prusko.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011692; classtype:social-engineering; sid:6011692; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-slornor-biz-vraxnix-glavtek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-slornor-biz-vraxnix-glavtek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011693; classtype:social-engineering; sid:6011693; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-holvik-biz-crensa-vupra.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-holvik-biz-crensa-vupra.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011694; classtype:social-engineering; sid:6011694; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-travqor-biz-vrolnik-slarnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-travqor-biz-vrolnik-slarnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011695; classtype:social-engineering; sid:6011695; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-prexon-biz-talvex-nurki.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-prexon-biz-talvex-nurki.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011696; classtype:social-engineering; sid:6011696; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-dravtek-biz-glanvor-xurnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-dravtek-biz-glanvor-xurnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011697; classtype:social-engineering; sid:6011697; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (caring-kangaroo-307519.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"caring-kangaroo-307519.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011698; classtype:social-engineering; sid:6011698; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pemenangshopee-97.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pemenangshopee-97.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011699; classtype:social-engineering; sid:6011699; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365bet277.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.365bet277.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011700; classtype:social-engineering; sid:6011700; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.wakacje-2026-14302.click/oferta/Steam-deck-oled-1tb?id=0v3b5I1R3p6W1p2B4k1l0k3n2X2n1o1Q)"; flow:established,to_server; http.uri; content:"/oferta/Steam-deck-oled-1tb?id=0v3b5I1R3p6W1p2B4k1l0k3n2X2n1o1Q"; startswith; fast_pattern; http.host; content:"allegrolokalnie.wakacje-2026-14302.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011701; classtype:social-engineering; sid:6011701; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-dravix-biz-kolten-yurfa.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-dravix-biz-kolten-yurfa.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011702; classtype:social-engineering; sid:6011702; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (owa.donationsnonprofit.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"owa.donationsnonprofit.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011703; classtype:social-engineering; sid:6011703; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.pmeimg8.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"mail.pmeimg8.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011704; classtype:social-engineering; sid:6011704; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-glurnor-biz-vrolax-slatem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-glurnor-biz-vrolax-slatem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011705; classtype:social-engineering; sid:6011705; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17298.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17298.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011706; classtype:social-engineering; sid:6011706; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (central-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"central-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011707; classtype:social-engineering; sid:6011707; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-norvek-biz-jalmin-crofa.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-norvek-biz-jalmin-crofa.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011708; classtype:social-engineering; sid:6011708; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-braltex-biz-vorqan-glunor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-braltex-biz-vorqan-glunor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011709; classtype:social-engineering; sid:6011709; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail.premisp.net/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"webmail.premisp.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011710; classtype:social-engineering; sid:6011710; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nistokieas.azurewebsites.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nistokieas.azurewebsites.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011711; classtype:social-engineering; sid:6011711; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-jorvek-biz-luntra-pexdi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-jorvek-biz-luntra-pexdi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011712; classtype:social-engineering; sid:6011712; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.applm.org.mx/KEAssociates/CharleneFleming.html)"; flow:established,to_server; http.uri; content:"/KEAssociates/CharleneFleming.html"; startswith; fast_pattern; http.host; content:"www.applm.org.mx"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011713; classtype:social-engineering; sid:6011713; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-fravik-biz-qoltem-vrolnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-fravik-biz-qoltem-vrolnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011714; classtype:social-engineering; sid:6011714; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.program-resmi115.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.program-resmi115.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011715; classtype:social-engineering; sid:6011715; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.swanbitcoinpolicy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.swanbitcoinpolicy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011716; classtype:social-engineering; sid:6011716; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (veiw-desktop.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"veiw-desktop.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011717; classtype:social-engineering; sid:6011717; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.getrewardslogin.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.getrewardslogin.online"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011718; classtype:social-engineering; sid:6011718; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mereche.hub5723511.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mereche.hub5723511.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011719; classtype:social-engineering; sid:6011719; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.rezerwacja7692.sbs/oferta/nowa-elektryczna-hulajnoga-kukirin-g2-master-2025--stacyjka--gwarancja/702497734)"; flow:established,to_server; http.uri; content:"/oferta/nowa-elektryczna-hulajnoga-kukirin-g2-master-2025--stacyjka--gwarancja/702497734"; startswith; fast_pattern; http.host; content:"allegrolokalnie.rezerwacja7692.sbs"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011720; classtype:social-engineering; sid:6011720; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (getrewardslogin.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"getrewardslogin.online"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011721; classtype:social-engineering; sid:6011721; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.12312989834h340.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.12312989834h340.xyz"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011722; classtype:social-engineering; sid:6011722; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amaz.hub5723511.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amaz.hub5723511.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011723; classtype:social-engineering; sid:6011723; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (putard.ext843252.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"putard.ext843252.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011724; classtype:social-engineering; sid:6011724; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eitababado.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eitababado.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011725; classtype:social-engineering; sid:6011725; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cloud.ext843252.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cloud.ext843252.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011726; classtype:social-engineering; sid:6011726; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledge-comstarted.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"ledge-comstarted.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011727; classtype:social-engineering; sid:6011727; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sg-activation.bolt.host/~/index.html)"; flow:established,to_server; http.uri; content:"/~/index.html"; startswith; fast_pattern; http.host; content:"sg-activation.bolt.host"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011728; classtype:social-engineering; sid:6011728; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreictvr4yo2a5r3y4i6dsfyg5b5qvfmxztsykx2xcwgfw5ikb6zvdau.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreictvr4yo2a5r3y4i6dsfyg5b5qvfmxztsykx2xcwgfw5ikb6zvdau.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011729; classtype:social-engineering; sid:6011729; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (king-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"king-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011730; classtype:social-engineering; sid:6011730; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (asia.coinbaseinv.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"asia.coinbaseinv.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011731; classtype:social-engineering; sid:6011731; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (volmyactive.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"volmyactive.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011732; classtype:social-engineering; sid:6011732; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sundancecabinetdesign.com/wp/docusign/me/Windows/utility.php/download/download/index.php)"; flow:established,to_server; http.uri; content:"/wp/docusign/me/Windows/utility.php/download/download/index.php"; startswith; fast_pattern; http.host; content:"sundancecabinetdesign.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011733; classtype:social-engineering; sid:6011733; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortnitezone.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortnitezone.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011734; classtype:social-engineering; sid:6011734; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vranex-biz-plurnik-slatem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vranex-biz-plurnik-slatem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011735; classtype:social-engineering; sid:6011735; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sarsdar.assuredwebtest.info/ga/click/2-6627976-9-9824-19244-10568-0e851c108c-638966a0fb)"; flow:established,to_server; http.uri; content:"/ga/click/2-6627976-9-9824-19244-10568-0e851c108c-638966a0fb"; startswith; fast_pattern; http.host; content:"sarsdar.assuredwebtest.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011736; classtype:social-engineering; sid:6011736; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-drunor-biz-slarnex-fratik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-drunor-biz-slarnex-fratik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011737; classtype:social-engineering; sid:6011737; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (riben16.github.io/sayana/)"; flow:established,to_server; http.uri; content:"/sayana/"; startswith; fast_pattern; http.host; content:"riben16.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011738; classtype:social-engineering; sid:6011738; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blackwater.hostel.town/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"blackwater.hostel.town"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011739; classtype:social-engineering; sid:6011739; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.trustbastion.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.trustbastion.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011740; classtype:social-engineering; sid:6011740; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deeply.kileycsz.info/ga/click/2-6797747-9-9907-19357-10719-a0bdb08903-0a55634c5b)"; flow:established,to_server; http.uri; content:"/ga/click/2-6797747-9-9907-19357-10719-a0bdb08903-0a55634c5b"; startswith; fast_pattern; http.host; content:"deeply.kileycsz.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011741; classtype:social-engineering; sid:6011741; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (volmyactive.shop/h5/)"; flow:established,to_server; http.uri; content:"/h5/"; startswith; fast_pattern; http.host; content:"volmyactive.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011742; classtype:social-engineering; sid:6011742; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-qarnex-biz-slortor-glavnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-qarnex-biz-slortor-glavnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011743; classtype:social-engineering; sid:6011743; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-tralnix-biz-vroltex-glarnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-tralnix-biz-vroltex-glarnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011744; classtype:social-engineering; sid:6011744; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vsilex.com/docusign/Windows/utility.php/download/download/index.php)"; flow:established,to_server; http.uri; content:"/docusign/Windows/utility.php/download/download/index.php"; startswith; fast_pattern; http.host; content:"vsilex.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011745; classtype:social-engineering; sid:6011745; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docsonlineshare.hbhasnen.com/docsign/d0cs/Windows/utility.php/download/download/index.php)"; flow:established,to_server; http.uri; content:"/docsign/d0cs/Windows/utility.php/download/download/index.php"; startswith; fast_pattern; http.host; content:"docsonlineshare.hbhasnen.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011746; classtype:social-engineering; sid:6011746; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17105.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17105.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011747; classtype:social-engineering; sid:6011747; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-plurnik-biz-frurnax-qurnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-plurnik-biz-frurnax-qurnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011748; classtype:social-engineering; sid:6011748; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-plaqtor-biz-fralvik-qravnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-plaqtor-biz-fralvik-qravnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011749; classtype:social-engineering; sid:6011749; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (789greeting.com/2513501.doc/18a80a/fad0f483-81b2-45c6-ad47-7272058d9cb6/)"; flow:established,to_server; http.uri; content:"/2513501.doc/18a80a/fad0f483-81b2-45c6-ad47-7272058d9cb6/"; startswith; fast_pattern; http.host; content:"789greeting.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011750; classtype:social-engineering; sid:6011750; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (danaa-iindonesiaa.olgk.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"danaa-iindonesiaa.olgk.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011751; classtype:social-engineering; sid:6011751; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.securefilestorage.net/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"login.securefilestorage.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011752; classtype:social-engineering; sid:6011752; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bdovipqi.com/ph/personal/)"; flow:established,to_server; http.uri; content:"/ph/personal/"; startswith; fast_pattern; http.host; content:"bdovipqi.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011753; classtype:social-engineering; sid:6011753; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-slornik-biz-platem-frurnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-slornik-biz-platem-frurnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011754; classtype:social-engineering; sid:6011754; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreibhsdme4xafylyd264qskjwlrmuabh4egs3kyznjgaitzniuwwytm.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreibhsdme4xafylyd264qskjwlrmuabh4egs3kyznjgaitzniuwwytm.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011755; classtype:social-engineering; sid:6011755; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17117.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17117.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011756; classtype:social-engineering; sid:6011756; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (daodapps.netlify.app/wallets/)"; flow:established,to_server; http.uri; content:"/wallets/"; startswith; fast_pattern; http.host; content:"daodapps.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011757; classtype:social-engineering; sid:6011757; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (infoshopee2022.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"infoshopee2022.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011758; classtype:social-engineering; sid:6011758; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-frenzo-biz-kelmar-vudri.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-frenzo-biz-kelmar-vudri.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011759; classtype:social-engineering; sid:6011759; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roh-it05.github.io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"roh-it05.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011760; classtype:social-engineering; sid:6011760; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (globalterdaftarkan.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"globalterdaftarkan.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011761; classtype:social-engineering; sid:6011761; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-fraltem-biz-platik-slurnax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-fraltem-biz-platik-slurnax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011762; classtype:social-engineering; sid:6011762; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (876sytemverapcostchid.wasmer.app/login.php)"; flow:established,to_server; http.uri; content:"/login.php"; startswith; fast_pattern; http.host; content:"876sytemverapcostchid.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011763; classtype:social-engineering; sid:6011763; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.klzjsx.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.klzjsx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011764; classtype:social-engineering; sid:6011764; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-fralnex-biz-dravqor-vraxtik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-fralnex-biz-dravqor-vraxtik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011765; classtype:social-engineering; sid:6011765; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hvcurrent.info/PL-1466-160526/?u=97C1466&e=vicente%40ontinet.com&s3=&s4=&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/PL-1466-160526/?u=97C1466&e=vicente%40ontinet.com&s3=&s4=&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"hvcurrent.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011766; classtype:social-engineering; sid:6011766; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vrolnor-biz-slatik-glurnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vrolnor-biz-slatik-glurnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011767; classtype:social-engineering; sid:6011767; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sundancecabinetdesign.com/wp/docusign/me/Mac/utility.php/)"; flow:established,to_server; http.uri; content:"/wp/docusign/me/Mac/utility.php/"; startswith; fast_pattern; http.host; content:"sundancecabinetdesign.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011768; classtype:social-engineering; sid:6011768; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-framtor-biz-vrolnix-dravtek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-framtor-biz-vrolnix-dravtek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011769; classtype:social-engineering; sid:6011769; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portal-coinsquar-com.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"portal-coinsquar-com.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011770; classtype:social-engineering; sid:6011770; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezorsuites-io.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezorsuites-io.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011771; classtype:social-engineering; sid:6011771; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17110.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17110.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011772; classtype:social-engineering; sid:6011772; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hadiahshopeebigsale12.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hadiahshopeebigsale12.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011773; classtype:social-engineering; sid:6011773; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-glurnex-biz-vrolor-fraltem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-glurnex-biz-vrolor-fraltem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011774; classtype:social-engineering; sid:6011774; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (office365elementos.fwh.is/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"office365elementos.fwh.is"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011775; classtype:social-engineering; sid:6011775; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kynticsha.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kynticsha.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011776; classtype:social-engineering; sid:6011776; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-slavtor-biz-glarnex-plurnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-slavtor-biz-glarnex-plurnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011777; classtype:social-engineering; sid:6011777; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-vraqtor-biz-fruntax-slornik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-vraqtor-biz-fruntax-slornik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011778; classtype:social-engineering; sid:6011778; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.365bet277.com/eng/home/index)"; flow:established,to_server; http.uri; content:"/eng/home/index"; startswith; fast_pattern; http.host; content:"m.365bet277.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011779; classtype:social-engineering; sid:6011779; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.netaccess-management.com/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"mail.netaccess-management.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011780; classtype:social-engineering; sid:6011780; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (26l5-mgd0-4s1q.tri-le-mtek-com-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"26l5-mgd0-4s1q.tri-le-mtek-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011781; classtype:social-engineering; sid:6011781; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.phanpay.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app.phanpay.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011782; classtype:social-engineering; sid:6011782; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fraud-claims-esl.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fraud-claims-esl.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011783; classtype:social-engineering; sid:6011783; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (teste.atualizacao-empresas.com/inicio)"; flow:established,to_server; http.uri; content:"/inicio"; startswith; fast_pattern; http.host; content:"teste.atualizacao-empresas.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011784; classtype:social-engineering; sid:6011784; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vorlan-biz-plortem-qurnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vorlan-biz-plortem-qurnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011785; classtype:social-engineering; sid:6011785; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.m20r.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.m20r.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011786; classtype:social-engineering; sid:6011786; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-bugfix.pages.dev/js/web3.js/)"; flow:established,to_server; http.uri; content:"/js/web3.js/"; startswith; fast_pattern; http.host; content:"web-bugfix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011787; classtype:social-engineering; sid:6011787; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-framtex-biz-vrolnik-qarnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-framtex-biz-vrolnik-qarnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011788; classtype:social-engineering; sid:6011788; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (owa.supersaverdining.com/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"owa.supersaverdining.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011789; classtype:social-engineering; sid:6011789; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ben-ammar-ahmed.github.io/cybersecurity_phishing)"; flow:established,to_server; http.uri; content:"/cybersecurity_phishing"; startswith; fast_pattern; http.host; content:"ben-ammar-ahmed.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011790; classtype:social-engineering; sid:6011790; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (worker-sweet-thunder-0bd5.jdl71756.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"worker-sweet-thunder-0bd5.jdl71756.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011791; classtype:social-engineering; sid:6011791; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (decentranet.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"decentranet.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011792; classtype:social-engineering; sid:6011792; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.netaccess-management.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"mail.netaccess-management.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011793; classtype:social-engineering; sid:6011793; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.infoshopee-10.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.infoshopee-10.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011794; classtype:social-engineering; sid:6011794; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (promohadiah-shopee12.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"promohadiah-shopee12.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011795; classtype:social-engineering; sid:6011795; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (devhouda.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"devhouda.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011796; classtype:social-engineering; sid:6011796; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (securedbankfinancing.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"securedbankfinancing.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011797; classtype:social-engineering; sid:6011797; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galeryshopee2022.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"galeryshopee2022.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011798; classtype:social-engineering; sid:6011798; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-fralnix-biz-slurnor-platem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-fralnix-biz-slurnor-platem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011799; classtype:social-engineering; sid:6011799; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fromncostumerxid.revolusioner.web.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fromncostumerxid.revolusioner.web.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011800; classtype:social-engineering; sid:6011800; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-platik-biz-slurnex-vroltor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-platik-biz-slurnex-vroltor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011801; classtype:social-engineering; sid:6011801; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jawad-devpk.github.io/whatsapp-clone)"; flow:established,to_server; http.uri; content:"/whatsapp-clone"; startswith; fast_pattern; http.host; content:"jawad-devpk.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011802; classtype:social-engineering; sid:6011802; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-dranvik-biz-qoltex-frunax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-dranvik-biz-qoltex-frunax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011803; classtype:social-engineering; sid:6011803; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-fralqax-biz-slurnor-qarnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-fralqax-biz-slurnor-qarnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011804; classtype:social-engineering; sid:6011804; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kczim.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kczim.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011805; classtype:social-engineering; sid:6011805; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sundancecabinetdesign.com/wp/docusign/me/Windows/utility.php/download/index.php/)"; flow:established,to_server; http.uri; content:"/wp/docusign/me/Windows/utility.php/download/index.php/"; startswith; fast_pattern; http.host; content:"sundancecabinetdesign.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011806; classtype:social-engineering; sid:6011806; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.roblux2026.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.roblux2026.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011807; classtype:social-engineering; sid:6011807; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (claim-alert-esl.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"claim-alert-esl.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011808; classtype:social-engineering; sid:6011808; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeejkt337.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopeejkt337.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011809; classtype:social-engineering; sid:6011809; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (keoindia.com/jvibuagr/)"; flow:established,to_server; http.uri; content:"/jvibuagr/"; startswith; fast_pattern; http.host; content:"keoindia.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011810; classtype:social-engineering; sid:6011810; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sunny-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sunny-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011811; classtype:social-engineering; sid:6011811; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreigdm2txbgx2janmzdmdnezvdfa7i5kiajzltxpx7tj5nvjxikqvhq.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreigdm2txbgx2janmzdmdnezvdfa7i5kiajzltxpx7tj5nvjxikqvhq.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011812; classtype:social-engineering; sid:6011812; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (navyfederall.us/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"navyfederall.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011813; classtype:social-engineering; sid:6011813; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-qolnix-biz-glortor-fraltek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-qolnix-biz-glortor-fraltek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011814; classtype:social-engineering; sid:6011814; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kanhyakkushwaha.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"kanhyakkushwaha.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011815; classtype:social-engineering; sid:6011815; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bet365sport17.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bet365sport17.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011816; classtype:social-engineering; sid:6011816; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (claim-alert-esl.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"claim-alert-esl.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011817; classtype:social-engineering; sid:6011817; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login-stage.iws-action.com/jsdisabled)"; flow:established,to_server; http.uri; content:"/jsdisabled"; startswith; fast_pattern; http.host; content:"login-stage.iws-action.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011818; classtype:social-engineering; sid:6011818; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sundancecabinetdesign.com/wp/docusign/me/Mac/utility.php/download/download/index.php)"; flow:established,to_server; http.uri; content:"/wp/docusign/me/Mac/utility.php/download/download/index.php"; startswith; fast_pattern; http.host; content:"sundancecabinetdesign.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011819; classtype:social-engineering; sid:6011819; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (manazil3.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"manazil3.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011820; classtype:social-engineering; sid:6011820; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-tranik-biz-fraltem-qurnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-tranik-biz-fraltem-qurnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011821; classtype:social-engineering; sid:6011821; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mssdold.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mssdold.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011822; classtype:social-engineering; sid:6011822; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.promohadiah-shopee12.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.promohadiah-shopee12.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011823; classtype:social-engineering; sid:6011823; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vrolnix-biz-frurnor-platem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vrolnix-biz-frurnor-platem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011824; classtype:social-engineering; sid:6011824; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-franov-biz-qurnex-vroltor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-franov-biz-qurnex-vroltor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011825; classtype:social-engineering; sid:6011825; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.phanpay.io/en/)"; flow:established,to_server; http.uri; content:"/en/"; startswith; fast_pattern; http.host; content:"app.phanpay.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011826; classtype:social-engineering; sid:6011826; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.365bet277.com:443/chs/)"; flow:established,to_server; http.uri; content:"/chs/"; startswith; fast_pattern; http.host; content:"m.365bet277.com:443"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011827; classtype:social-engineering; sid:6011827; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.galeryshopee11-11.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.galeryshopee11-11.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011828; classtype:social-engineering; sid:6011828; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (onlineratingwork.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"onlineratingwork.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011829; classtype:social-engineering; sid:6011829; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vsilex.com/docusign/Mac/utility.php/download/download/index.php)"; flow:established,to_server; http.uri; content:"/docusign/Mac/utility.php/download/download/index.php"; startswith; fast_pattern; http.host; content:"vsilex.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011830; classtype:social-engineering; sid:6011830; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopeejkt337.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopeejkt337.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011831; classtype:social-engineering; sid:6011831; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17200.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17200.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011832; classtype:social-engineering; sid:6011832; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.auth-webang.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.auth-webang.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011833; classtype:social-engineering; sid:6011833; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-slornex-biz-dranvik-glurtor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-slornex-biz-dranvik-glurtor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011834; classtype:social-engineering; sid:6011834; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.365bet277.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.365bet277.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011835; classtype:social-engineering; sid:6011835; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hadiahresmishopeeindonesia.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hadiahresmishopeeindonesia.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011836; classtype:social-engineering; sid:6011836; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (httpbjlv.com/xdnpwbin/)"; flow:established,to_server; http.uri; content:"/xdnpwbin/"; startswith; fast_pattern; http.host; content:"httpbjlv.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011837; classtype:social-engineering; sid:6011837; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-narvik-biz-plortex-franul.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-narvik-biz-plortex-franul.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011838; classtype:social-engineering; sid:6011838; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gebyar-shope-2022.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.gebyar-shope-2022.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011839; classtype:social-engineering; sid:6011839; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (esl-claim-alert.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"esl-claim-alert.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011840; classtype:social-engineering; sid:6011840; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (magnitudenunmain.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"magnitudenunmain.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011841; classtype:social-engineering; sid:6011841; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreibhsdme4xafylyd264qskjwlrmuabh4egs3kyznjgaitzniuwwytm.ipfs.nftstorage.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreibhsdme4xafylyd264qskjwlrmuabh4egs3kyznjgaitzniuwwytm.ipfs.nftstorage.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011842; classtype:social-engineering; sid:6011842; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.programundianshopee11.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.programundianshopee11.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011843; classtype:social-engineering; sid:6011843; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-qurnik-biz-glatem-slornex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-qurnik-biz-glatem-slornex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011844; classtype:social-engineering; sid:6011844; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vsilex.com/docusign/Windows/utility.php)"; flow:established,to_server; http.uri; content:"/docusign/Windows/utility.php"; startswith; fast_pattern; http.host; content:"vsilex.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011845; classtype:social-engineering; sid:6011845; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deeply.kileycsz.info/ga/click/2-6666278-9-9907-19357-10719-a0bdb08903-19d085d5d6)"; flow:established,to_server; http.uri; content:"/ga/click/2-6666278-9-9907-19357-10719-a0bdb08903-19d085d5d6"; startswith; fast_pattern; http.host; content:"deeply.kileycsz.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011846; classtype:social-engineering; sid:6011846; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kynticsha.shop/h5/)"; flow:established,to_server; http.uri; content:"/h5/"; startswith; fast_pattern; http.host; content:"kynticsha.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011847; classtype:social-engineering; sid:6011847; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (draw88.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"draw88.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011848; classtype:social-engineering; sid:6011848; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-dranqor-biz-fruntex-slavrix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-dranqor-biz-fruntex-slavrix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011849; classtype:social-engineering; sid:6011849; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-plurnik-biz-frurnex-glatem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-plurnik-biz-frurnex-glatem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011850; classtype:social-engineering; sid:6011850; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hadiah-resmishopee2022.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hadiah-resmishopee2022.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011851; classtype:social-engineering; sid:6011851; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (validated-box-4c63.rwqgy3zd.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"validated-box-4c63.rwqgy3zd.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011852; classtype:social-engineering; sid:6011852; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17189.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17189.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011853; classtype:social-engineering; sid:6011853; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.brfekw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.brfekw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011854; classtype:social-engineering; sid:6011854; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (plan-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"plan-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011855; classtype:social-engineering; sid:6011855; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pablodaniel1779812892380.2091781.meusitehostgator.com.br/pp/P/log.php)"; flow:established,to_server; http.uri; content:"/pp/P/log.php"; startswith; fast_pattern; http.host; content:"pablodaniel1779812892380.2091781.meusitehostgator.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011856; classtype:social-engineering; sid:6011856; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (litmawers.pro/connect/web)"; flow:established,to_server; http.uri; content:"/connect/web"; startswith; fast_pattern; http.host; content:"litmawers.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011857; classtype:social-engineering; sid:6011857; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prteccionsgrddmcroffchtwh.iceiy.com/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"prteccionsgrddmcroffchtwh.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011858; classtype:social-engineering; sid:6011858; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.daftar-pemenang57.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.daftar-pemenang57.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011859; classtype:social-engineering; sid:6011859; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vsilex.com/docusign/Windows/utility.php/)"; flow:established,to_server; http.uri; content:"/docusign/Windows/utility.php/"; startswith; fast_pattern; http.host; content:"vsilex.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011860; classtype:social-engineering; sid:6011860; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365bet833.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.365bet833.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011861; classtype:social-engineering; sid:6011861; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mansi2oo4.github.io/Amazon-UI-Clone)"; flow:established,to_server; http.uri; content:"/Amazon-UI-Clone"; startswith; fast_pattern; http.host; content:"mansi2oo4.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011862; classtype:social-engineering; sid:6011862; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docsonlineshare.hbhasnen.com/docsign/d0cs/Mac/utility.php/download/index.php)"; flow:established,to_server; http.uri; content:"/docsign/d0cs/Mac/utility.php/download/index.php"; startswith; fast_pattern; http.host; content:"docsonlineshare.hbhasnen.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011863; classtype:social-engineering; sid:6011863; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (face-book.com.vn/timbannaygapcohautaailienhe?a)"; flow:established,to_server; http.uri; content:"/timbannaygapcohautaailienhe?a"; startswith; fast_pattern; http.host; content:"face-book.com.vn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011864; classtype:social-engineering; sid:6011864; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store.communitysectiongame.shop/item/AWP-AncientHeritage/)"; flow:established,to_server; http.uri; content:"/item/AWP-AncientHeritage/"; startswith; fast_pattern; http.host; content:"store.communitysectiongame.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011865; classtype:social-engineering; sid:6011865; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365bet838.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.365bet838.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011866; classtype:social-engineering; sid:6011866; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vraltex-biz-glurnor-qolvik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vraltex-biz-glurnor-qolvik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011867; classtype:social-engineering; sid:6011867; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docsonlineshare.hbhasnen.com/docsign/d0cs/Windows/utility.php/)"; flow:established,to_server; http.uri; content:"/docsign/d0cs/Windows/utility.php/"; startswith; fast_pattern; http.host; content:"docsonlineshare.hbhasnen.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011868; classtype:social-engineering; sid:6011868; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreicwavswq5o6zqdqq5kao6qpkb7bsq3lb7qraovbaah6646q3c75ee.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreicwavswq5o6zqdqq5kao6qpkb7bsq3lb7qraovbaah6646q3c75ee.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011869; classtype:social-engineering; sid:6011869; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-qarnex-biz-glurnik-slurnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-qarnex-biz-glurnik-slurnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011870; classtype:social-engineering; sid:6011870; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (capitana.co.il/korea.html)"; flow:established,to_server; http.uri; content:"/korea.html"; startswith; fast_pattern; http.host; content:"capitana.co.il"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011871; classtype:social-engineering; sid:6011871; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (navya639.github.io/Amazon_clone/)"; flow:established,to_server; http.uri; content:"/Amazon_clone/"; startswith; fast_pattern; http.host; content:"navya639.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011872; classtype:social-engineering; sid:6011872; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (saba-fatimaa.github.io/clone-Amazon/)"; flow:established,to_server; http.uri; content:"/clone-Amazon/"; startswith; fast_pattern; http.host; content:"saba-fatimaa.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011873; classtype:social-engineering; sid:6011873; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.365bet011.com/eng/home/index)"; flow:established,to_server; http.uri; content:"/eng/home/index"; startswith; fast_pattern; http.host; content:"m.365bet011.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011874; classtype:social-engineering; sid:6011874; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shared-document-cfb9de.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shared-document-cfb9de.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011875; classtype:social-engineering; sid:6011875; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17192.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17192.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011876; classtype:social-engineering; sid:6011876; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (owa.supersaverdining.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"owa.supersaverdining.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011877; classtype:social-engineering; sid:6011877; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meek-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meek-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011878; classtype:social-engineering; sid:6011878; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (claims-fraud-esl-org.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"claims-fraud-esl-org.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011879; classtype:social-engineering; sid:6011879; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (h23t.top/m/)"; flow:established,to_server; http.uri; content:"/m/"; startswith; fast_pattern; http.host; content:"h23t.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011880; classtype:social-engineering; sid:6011880; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (securedbankfinancing.com/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"securedbankfinancing.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011881; classtype:social-engineering; sid:6011881; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.8868kk.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.8868kk.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011882; classtype:social-engineering; sid:6011882; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rfv-internal-dev.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rfv-internal-dev.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011883; classtype:social-engineering; sid:6011883; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiarebs6fzk2fdl7nwihhbwejvw5pwuhytyqvpy7375stgw6m32haa.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiarebs6fzk2fdl7nwihhbwejvw5pwuhytyqvpy7375stgw6m32haa.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011884; classtype:social-engineering; sid:6011884; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.masssegner-dubai-nnew24h.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.masssegner-dubai-nnew24h.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011885; classtype:social-engineering; sid:6011885; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sundancecabinetdesign.com/wp/docusign/me/Mac/utility.php/download/index.php)"; flow:established,to_server; http.uri; content:"/wp/docusign/me/Mac/utility.php/download/index.php"; startswith; fast_pattern; http.host; content:"sundancecabinetdesign.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011886; classtype:social-engineering; sid:6011886; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pemenangshopee-2022.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.pemenangshopee-2022.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011887; classtype:social-engineering; sid:6011887; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vsilex.com/docusign/Mac/utility.php/)"; flow:established,to_server; http.uri; content:"/docusign/Mac/utility.php/"; startswith; fast_pattern; http.host; content:"vsilex.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011888; classtype:social-engineering; sid:6011888; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vroltem-biz-plarnik-qurnax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vroltem-biz-plarnik-qurnax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011889; classtype:social-engineering; sid:6011889; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinityweb-transform101010101.company/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfinityweb-transform101010101.company"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011890; classtype:social-engineering; sid:6011890; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.js44553.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.js44553.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011891; classtype:social-engineering; sid:6011891; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-plavtek-biz-fralnor-slunix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-plavtek-biz-fralnor-slunix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011892; classtype:social-engineering; sid:6011892; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.rezerwacja7692.sbs/oferta/nowa-elektryczna-hulajnoga-kukirin-g2-master-2025--stacyjka--gwarancja/702497734)"; flow:established,to_server; http.uri; content:"/oferta/nowa-elektryczna-hulajnoga-kukirin-g2-master-2025--stacyjka--gwarancja/702497734"; startswith; fast_pattern; http.host; content:"allegrolokalnie.rezerwacja7692.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011893; classtype:social-engineering; sid:6011893; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-fraltex-biz-plurnik-vranor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-fraltex-biz-plurnik-vranor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011894; classtype:social-engineering; sid:6011894; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiawo4tjsyxl3iviikfjzfd2b66wkhmmr2zrmr3yfsqf75iyxzkj7e.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiawo4tjsyxl3iviikfjzfd2b66wkhmmr2zrmr3yfsqf75iyxzkj7e.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011895; classtype:social-engineering; sid:6011895; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.galeryshopee22.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.galeryshopee22.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011896; classtype:social-engineering; sid:6011896; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zentro.top/PL-1466-160526/?e=xxx&s3=Adam&s4=Machaj&)"; flow:established,to_server; http.uri; content:"/PL-1466-160526/?e=xxx&s3=Adam&s4=Machaj&"; startswith; fast_pattern; http.host; content:"zentro.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011897; classtype:social-engineering; sid:6011897; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-slurnex-biz-vrolnik-glatem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-slurnex-biz-vrolnik-glatem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011898; classtype:social-engineering; sid:6011898; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (938673888.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"938673888.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011899; classtype:social-engineering; sid:6011899; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fedex-mx.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fedex-mx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011900; classtype:social-engineering; sid:6011900; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (esl-claim-alert.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"esl-claim-alert.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011901; classtype:social-engineering; sid:6011901; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.infoshopee2022.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.infoshopee2022.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011902; classtype:social-engineering; sid:6011902; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docsonlineshare.hbhasnen.com/docsign/d0cs/Mac/utility.php/)"; flow:established,to_server; http.uri; content:"/docsign/d0cs/Mac/utility.php/"; startswith; fast_pattern; http.host; content:"docsonlineshare.hbhasnen.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011903; classtype:social-engineering; sid:6011903; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (programundianshopee11.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"programundianshopee11.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011904; classtype:social-engineering; sid:6011904; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docsonlineshare.hbhasnen.com/docsign/d0cs/Windows/utility.php)"; flow:established,to_server; http.uri; content:"/docsign/d0cs/Windows/utility.php"; startswith; fast_pattern; http.host; content:"docsonlineshare.hbhasnen.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011905; classtype:social-engineering; sid:6011905; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (devgupta-in.github.io/Amazon-homepage-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-homepage-clone/"; startswith; fast_pattern; http.host; content:"devgupta-in.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011906; classtype:social-engineering; sid:6011906; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-plurnor-biz-qoltem-glatik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-plurnor-biz-qoltem-glatik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011907; classtype:social-engineering; sid:6011907; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.90manapp.com:9229/account/reg?code=42850)"; flow:established,to_server; http.uri; content:"/account/reg?code=42850"; startswith; fast_pattern; http.host; content:"m.90manapp.com:9229"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011908; classtype:social-engineering; sid:6011908; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.xx88js.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.xx88js.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011909; classtype:social-engineering; sid:6011909; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-vralqor-biz-fruntax-slarnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-vralqor-biz-fruntax-slarnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011910; classtype:social-engineering; sid:6011910; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (microsoftword.programgridsoft.com/?etext=2202.HLgk-IrqSjzkv-DTQsIXn2JjaW5xeXdxZmJ6Z3hzd3Y.d183d827e94e2ec2b53557a380b30d2f364fa6d9)"; flow:established,to_server; http.uri; content:"/?etext=2202.HLgk-IrqSjzkv-DTQsIXn2JjaW5xeXdxZmJ6Z3hzd3Y.d183d827e94e2ec2b53557a380b30d2f364fa6d9"; startswith; fast_pattern; http.host; content:"microsoftword.programgridsoft.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011911; classtype:social-engineering; sid:6011911; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whatsaplusoriginal.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whatsaplusoriginal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011912; classtype:social-engineering; sid:6011912; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortport.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortport.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011913; classtype:social-engineering; sid:6011913; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (infoshopee-10.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"infoshopee-10.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011914; classtype:social-engineering; sid:6011914; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (claims-fraud-esl-org.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"claims-fraud-esl-org.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011915; classtype:social-engineering; sid:6011915; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-slurnor-biz-vrolnik-glatix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-slurnor-biz-vrolnik-glatix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011916; classtype:social-engineering; sid:6011916; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwwwmgzineeluiza.online/produto&)"; flow:established,to_server; http.uri; content:"/produto&"; startswith; fast_pattern; http.host; content:"wwwwmgzineeluiza.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011917; classtype:social-engineering; sid:6011917; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jaioez.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jaioez.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011918; classtype:social-engineering; sid:6011918; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docsonlineshare.hbhasnen.com/docsign/d0cs/Mac/utility.php)"; flow:established,to_server; http.uri; content:"/docsign/d0cs/Mac/utility.php"; startswith; fast_pattern; http.host; content:"docsonlineshare.hbhasnen.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011919; classtype:social-engineering; sid:6011919; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hadiahresmishopeeindonesia.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"hadiahresmishopeeindonesia.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011920; classtype:social-engineering; sid:6011920; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.galeryshopee2022.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.galeryshopee2022.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011921; classtype:social-engineering; sid:6011921; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (27842636365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"27842636365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011922; classtype:social-engineering; sid:6011922; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-wheat-three.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-wheat-three.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011923; classtype:social-engineering; sid:6011923; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1dmaisluzawww.site/loading.php?token=PneuSeguro)"; flow:established,to_server; http.uri; content:"/loading.php?token=PneuSeguro"; startswith; fast_pattern; http.host; content:"1dmaisluzawww.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011924; classtype:social-engineering; sid:6011924; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pemenang-shopee-22.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.pemenang-shopee-22.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011925; classtype:social-engineering; sid:6011925; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-plaqtex-biz-vralnik-qarnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-plaqtex-biz-vralnik-qarnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011926; classtype:social-engineering; sid:6011926; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (phldgn.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"phldgn.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011927; classtype:social-engineering; sid:6011927; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-plurnax-biz-vratem-fralvik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-plurnax-biz-vratem-fralvik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011928; classtype:social-engineering; sid:6011928; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (g18m.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"g18m.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011929; classtype:social-engineering; sid:6011929; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-glurnax-biz-vroltex-dranor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-glurnax-biz-vroltex-dranor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011930; classtype:social-engineering; sid:6011930; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.securefilestorage.net/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"login.securefilestorage.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011931; classtype:social-engineering; sid:6011931; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblux2026.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"roblux2026.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011932; classtype:social-engineering; sid:6011932; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (antoinettegaudin.info/PL-1466-160526/?u=97C1466&e=tanumhub@54af9e7b9624c8c5622c7c73b2f5c19443b2.com&s3=&s4=&s5=%25%EF%BF%BDdress%25%25&s6=%25%25Zip%25%25&s7=%25%25City%25%25&s8=%25%25Phone%25%25)"; flow:established,to_server; http.uri; content:"/PL-1466-160526/?u=97C1466&e=tanumhub@54af9e7b9624c8c5622c7c73b2f5c19443b2.com&s3=&s4=&s5=%25%EF%BF%BDdress%25%25&s6=%25%25Zip%25%25&s7=%25%25City%25%25&s8=%25%25Phone%25%25"; startswith; fast_pattern; http.host; content:"antoinettegaudin.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011933; classtype:social-engineering; sid:6011933; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-trurnik-biz-glavtor-plunex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-trurnik-biz-glavtor-plunex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011934; classtype:social-engineering; sid:6011934; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (intverncertinvert.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"intverncertinvert.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011935; classtype:social-engineering; sid:6011935; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www-deutschen-kreditban-de.91-218-65-223.plesk.page/intel/)"; flow:established,to_server; http.uri; content:"/intel/"; startswith; fast_pattern; http.host; content:"www-deutschen-kreditban-de.91-218-65-223.plesk.page"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011936; classtype:social-engineering; sid:6011936; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ssomyuholldcdnapps.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"ssomyuholldcdnapps.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011937; classtype:social-engineering; sid:6011937; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (desktop-ledgrs.wixstudio.com/desktop)"; flow:established,to_server; http.uri; content:"/desktop"; startswith; fast_pattern; http.host; content:"desktop-ledgrs.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011938; classtype:social-engineering; sid:6011938; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (new-moon-peye.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"new-moon-peye.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011939; classtype:social-engineering; sid:6011939; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (homeapps-trezosuite.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"homeapps-trezosuite.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011940; classtype:social-engineering; sid:6011940; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bitunixx.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"bitunixx.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011941; classtype:social-engineering; sid:6011941; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.olutionsgro.com/curewaenopen/)"; flow:established,to_server; http.uri; content:"/curewaenopen/"; startswith; fast_pattern; http.host; content:"www.olutionsgro.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011942; classtype:social-engineering; sid:6011942; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dkde239rikozefri.g18.email/webcard/de/4J6I-94E9B5D2A0/)"; flow:established,to_server; http.uri; content:"/webcard/de/4J6I-94E9B5D2A0/"; startswith; fast_pattern; http.host; content:"dkde239rikozefri.g18.email"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011943; classtype:social-engineering; sid:6011943; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.450459483.lol/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.450459483.lol"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011944; classtype:social-engineering; sid:6011944; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.maclenumerique.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.maclenumerique.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011945; classtype:social-engineering; sid:6011945; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (learn-kerkenapp.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"learn-kerkenapp.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011946; classtype:social-engineering; sid:6011946; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mpi03b-6a.myshopify.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mpi03b-6a.myshopify.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011947; classtype:social-engineering; sid:6011947; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (homeapps-trezosuite.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"homeapps-trezosuite.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011948; classtype:social-engineering; sid:6011948; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bcaxe-reward.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bcaxe-reward.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6011949; classtype:social-engineering; sid:6011949; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (swisspostrack.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"swisspostrack.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011950; classtype:social-engineering; sid:6011950; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (parthivx1.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"parthivx1.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011951; classtype:social-engineering; sid:6011951; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (antttas.szm.sk/up/home.htm?vje9yijqula38x98zj81p2zdp5zw3levfatx6fsx39zajibsu6)"; flow:established,to_server; http.uri; content:"/up/home.htm?vje9yijqula38x98zj81p2zdp5zw3levfatx6fsx39zajibsu6"; startswith; fast_pattern; http.host; content:"antttas.szm.sk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011952; classtype:social-engineering; sid:6011952; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.js9851.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.js9851.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011953; classtype:social-engineering; sid:6011953; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prime-videosfrance.com/index.php/suivi)"; flow:established,to_server; http.uri; content:"/index.php/suivi"; startswith; fast_pattern; http.host; content:"prime-videosfrance.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011954; classtype:social-engineering; sid:6011954; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vxsct1811.avnam.net/ser/wordpress/wp-admin/includes/secr/Idsp3984762836/app/index.php?view=main&id=eb0ccaeffefa590d16ee6afaba918c68)"; flow:established,to_server; http.uri; content:"/ser/wordpress/wp-admin/includes/secr/Idsp3984762836/app/index.php?view=main&id=eb0ccaeffefa590d16ee6afaba918c68"; startswith; fast_pattern; http.host; content:"vxsct1811.avnam.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011955; classtype:social-engineering; sid:6011955; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.coinbase_prologin_log.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.coinbase_prologin_log.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011956; classtype:social-engineering; sid:6011956; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cordialcertmain.wasmer.app/mobile)"; flow:established,to_server; http.uri; content:"/mobile"; startswith; fast_pattern; http.host; content:"cordialcertmain.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011957; classtype:social-engineering; sid:6011957; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uurl.at/g9qQLi)"; flow:established,to_server; http.uri; content:"/g9qQLi"; startswith; fast_pattern; http.host; content:"uurl.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011958; classtype:social-engineering; sid:6011958; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (varnika6-hub.github.io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"varnika6-hub.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011959; classtype:social-engineering; sid:6011959; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prime-videosfrance.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"prime-videosfrance.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011960; classtype:social-engineering; sid:6011960; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.galabet-guncelaff.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.galabet-guncelaff.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011961; classtype:social-engineering; sid:6011961; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (harshkeni.github.io/instagram_login_page_clone/)"; flow:established,to_server; http.uri; content:"/instagram_login_page_clone/"; startswith; fast_pattern; http.host; content:"harshkeni.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011962; classtype:social-engineering; sid:6011962; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (h23u.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"h23u.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011963; classtype:social-engineering; sid:6011963; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thecourierguydept.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"thecourierguydept.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011964; classtype:social-engineering; sid:6011964; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-trezo-ai.zapier.app/help)"; flow:established,to_server; http.uri; content:"/help"; startswith; fast_pattern; http.host; content:"secure-trezo-ai.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011965; classtype:social-engineering; sid:6011965; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (outconfiadd.webcindario.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"outconfiadd.webcindario.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011966; classtype:social-engineering; sid:6011966; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-qravtem-biz-vrolnix-slarnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-qravtem-biz-vrolnix-slarnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011967; classtype:social-engineering; sid:6011967; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.yhcp668.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.yhcp668.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011968; classtype:social-engineering; sid:6011968; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.yh87766.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.yh87766.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011969; classtype:social-engineering; sid:6011969; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rdg.non-steam.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rdg.non-steam.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011970; classtype:social-engineering; sid:6011970; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adminveri.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"adminveri.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011971; classtype:social-engineering; sid:6011971; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (non-steam.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"non-steam.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011972; classtype:social-engineering; sid:6011972; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ghanapoest.eu.cc/gh)"; flow:established,to_server; http.uri; content:"/gh"; startswith; fast_pattern; http.host; content:"ghanapoest.eu.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011973; classtype:social-engineering; sid:6011973; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (egurrolea.com/azx/owa/owa.html)"; flow:established,to_server; http.uri; content:"/azx/owa/owa.html"; startswith; fast_pattern; http.host; content:"egurrolea.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011974; classtype:social-engineering; sid:6011974; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (segurapaymentsonline.lol/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"segurapaymentsonline.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011975; classtype:social-engineering; sid:6011975; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (madinirusufmain.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"madinirusufmain.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011976; classtype:social-engineering; sid:6011976; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agardepo.com.tr/crosco-tech/pastries/index.html)"; flow:established,to_server; http.uri; content:"/crosco-tech/pastries/index.html"; startswith; fast_pattern; http.host; content:"agardepo.com.tr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011977; classtype:social-engineering; sid:6011977; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ynk.rocks/voice/)"; flow:established,to_server; http.uri; content:"/voice/"; startswith; fast_pattern; http.host; content:"www.ynk.rocks"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011978; classtype:social-engineering; sid:6011978; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vxsct1811.avnam.net/ser/wordpress/wp-admin/includes/secr/Idsp3984762836)"; flow:established,to_server; http.uri; content:"/ser/wordpress/wp-admin/includes/secr/Idsp3984762836"; startswith; fast_pattern; http.host; content:"vxsct1811.avnam.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011979; classtype:social-engineering; sid:6011979; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aman365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aman365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011980; classtype:social-engineering; sid:6011980; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (haber7546.shop/auth)"; flow:established,to_server; http.uri; content:"/auth"; startswith; fast_pattern; http.host; content:"haber7546.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011981; classtype:social-engineering; sid:6011981; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17103.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17103.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011982; classtype:social-engineering; sid:6011982; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ridt.site.je/up/index.htm?i=1)"; flow:established,to_server; http.uri; content:"/up/index.htm?i=1"; startswith; fast_pattern; http.host; content:"ridt.site.je"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011983; classtype:social-engineering; sid:6011983; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mohdnafisalam.github.io/AMAZON-CLONE/)"; flow:established,to_server; http.uri; content:"/AMAZON-CLONE/"; startswith; fast_pattern; http.host; content:"mohdnafisalam.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011984; classtype:social-engineering; sid:6011984; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1217js.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1217js.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011985; classtype:social-engineering; sid:6011985; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chimex.com.mx/wp-admin/admin/am/infospage.php)"; flow:established,to_server; http.uri; content:"/wp-admin/admin/am/infospage.php"; startswith; fast_pattern; http.host; content:"chimex.com.mx"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011986; classtype:social-engineering; sid:6011986; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-frunov-biz-qarnex-platem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-frunov-biz-qarnex-platem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011987; classtype:social-engineering; sid:6011987; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mesnager-bussinesss1008f9725.netlify.app/home)"; flow:established,to_server; http.uri; content:"/home"; startswith; fast_pattern; http.host; content:"mesnager-bussinesss1008f9725.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011988; classtype:social-engineering; sid:6011988; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shanasyed.github.io/amazon-interface-clone/)"; flow:established,to_server; http.uri; content:"/amazon-interface-clone/"; startswith; fast_pattern; http.host; content:"shanasyed.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011989; classtype:social-engineering; sid:6011989; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mesnager-bussinesss1008f9725.netlify.app/?fbmeta)"; flow:established,to_server; http.uri; content:"/?fbmeta"; startswith; fast_pattern; http.host; content:"mesnager-bussinesss1008f9725.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011990; classtype:social-engineering; sid:6011990; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (regulatory-review.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"regulatory-review.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011991; classtype:social-engineering; sid:6011991; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (goshenmedia.co.ls/.well-known/axa.ch-26/axa.ch-ba/axa.ch/login.php)"; flow:established,to_server; http.uri; content:"/.well-known/axa.ch-26/axa.ch-ba/axa.ch/login.php"; startswith; fast_pattern; http.host; content:"goshenmedia.co.ls"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011992; classtype:social-engineering; sid:6011992; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (l0glnn-m1croqx0qftcom-0utloolx1drvvefil3es.fwh.is/index.html?email=lorumlab@49a20767dfe6cd447667491d2770bdd532c5.org)"; flow:established,to_server; http.uri; content:"/index.html?email=lorumlab@49a20767dfe6cd447667491d2770bdd532c5.org"; startswith; fast_pattern; http.host; content:"l0glnn-m1croqx0qftcom-0utloolx1drvvefil3es.fwh.is"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011993; classtype:social-engineering; sid:6011993; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-surnex-biz-kavtri-molza.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-surnex-biz-kavtri-molza.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011994; classtype:social-engineering; sid:6011994; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fsyinglilai.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fsyinglilai.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011995; classtype:social-engineering; sid:6011995; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cast-production-0209.up.railway.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cast-production-0209.up.railway.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011996; classtype:social-engineering; sid:6011996; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hearingassociates.s3.nl-ams.scw.cloud/den.html)"; flow:established,to_server; http.uri; content:"/den.html"; startswith; fast_pattern; http.host; content:"hearingassociates.s3.nl-ams.scw.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011997; classtype:social-engineering; sid:6011997; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (workouts.mystagingwebsite.com/wp-content/plugins/vinvourist/public/index.php)"; flow:established,to_server; http.uri; content:"/wp-content/plugins/vinvourist/public/index.php"; startswith; fast_pattern; http.host; content:"workouts.mystagingwebsite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011998; classtype:social-engineering; sid:6011998; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-zolvik-biz-qarnex-platir.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-zolvik-biz-qarnex-platir.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011999; classtype:social-engineering; sid:6011999; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pulihkan-akun-78u.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pulihkan-akun-78u.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012000; classtype:social-engineering; sid:6012000; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bnbhomes.in/Korea.html)"; flow:established,to_server; http.uri; content:"/Korea.html"; startswith; fast_pattern; http.host; content:"bnbhomes.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012001; classtype:social-engineering; sid:6012001; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (resarch.markusscholz.info/ga/click/2-9798776-10-8494-16604-9112-17afc9ad5f-f5e7bc8c21)"; flow:established,to_server; http.uri; content:"/ga/click/2-9798776-10-8494-16604-9112-17afc9ad5f-f5e7bc8c21"; startswith; fast_pattern; http.host; content:"resarch.markusscholz.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012002; classtype:social-engineering; sid:6012002; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cooltentregas.com.br/cumm/AMENCN-1/?email=galik2@ba305364ca4b31676ba03fa3849404cea7b8.com)"; flow:established,to_server; http.uri; content:"/cumm/AMENCN-1/?email=galik2@ba305364ca4b31676ba03fa3849404cea7b8.com"; startswith; fast_pattern; http.host; content:"cooltentregas.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012003; classtype:social-engineering; sid:6012003; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hadiah-resmishopee2022.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hadiah-resmishopee2022.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012004; classtype:social-engineering; sid:6012004; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mfacebook.com.vn/78eup3szuoi?a&l)"; flow:established,to_server; http.uri; content:"/78eup3szuoi?a&l"; startswith; fast_pattern; http.host; content:"mfacebook.com.vn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012005; classtype:social-engineering; sid:6012005; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.popandc.be/wp-admin/js/cgi-ent/index--000)"; flow:established,to_server; http.uri; content:"/wp-admin/js/cgi-ent/index--000"; startswith; fast_pattern; http.host; content:"www.popandc.be"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012006; classtype:social-engineering; sid:6012006; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (twilightbrand.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"twilightbrand.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012007; classtype:social-engineering; sid:6012007; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amnaakhtar15.github.io/Amazon-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-clone/"; startswith; fast_pattern; http.host; content:"amnaakhtar15.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012008; classtype:social-engineering; sid:6012008; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (joel-eapen.github.io/javascript-amazon-project/amazon.html)"; flow:established,to_server; http.uri; content:"/javascript-amazon-project/amazon.html"; startswith; fast_pattern; http.host; content:"joel-eapen.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012009; classtype:social-engineering; sid:6012009; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (akash24303.github.io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"akash24303.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012010; classtype:social-engineering; sid:6012010; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wetransfer-customize-files-shared.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wetransfer-customize-files-shared.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012011; classtype:social-engineering; sid:6012011; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (16504.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"16504.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012012; classtype:social-engineering; sid:6012012; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sqs.non-steam.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.sqs.non-steam.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012013; classtype:social-engineering; sid:6012013; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (php-bf442ch.wasmer.app/login.php)"; flow:established,to_server; http.uri; content:"/login.php"; startswith; fast_pattern; http.host; content:"php-bf442ch.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012014; classtype:social-engineering; sid:6012014; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (casinoseon.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"casinoseon.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012015; classtype:social-engineering; sid:6012015; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-fralvox-biz-qortem-dranix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-fralvox-biz-qortem-dranix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012016; classtype:social-engineering; sid:6012016; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cuuibase_prou_logi.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cuuibase_prou_logi.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012017; classtype:social-engineering; sid:6012017; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (googlebusiness.com-workspace.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"googlebusiness.com-workspace.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012018; classtype:social-engineering; sid:6012018; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.microsoft-1ogin.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.microsoft-1ogin.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012019; classtype:social-engineering; sid:6012019; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.galabet-tr157.co/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.galabet-tr157.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012020; classtype:social-engineering; sid:6012020; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paypal-c.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paypal-c.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012021; classtype:social-engineering; sid:6012021; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fnclaim.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fnclaim.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012022; classtype:social-engineering; sid:6012022; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cuuibase_prou_logi.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cuuibase_prou_logi.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012023; classtype:social-engineering; sid:6012023; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inlnk.co/VHjVN)"; flow:established,to_server; http.uri; content:"/VHjVN"; startswith; fast_pattern; http.host; content:"inlnk.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012024; classtype:social-engineering; sid:6012024; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (official-exodas.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"official-exodas.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012025; classtype:social-engineering; sid:6012025; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-glortex-biz-fralnor-qurnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-glortex-biz-fralnor-qurnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012026; classtype:social-engineering; sid:6012026; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s3.eu-north-1.amazonaws.com/us-east-3.console.aws.amazon.com007/Dhll.html)"; flow:established,to_server; http.uri; content:"/us-east-3.console.aws.amazon.com007/Dhll.html"; startswith; fast_pattern; http.host; content:"s3.eu-north-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012027; classtype:social-engineering; sid:6012027; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-pralzo-biz-velnik-dorqu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-pralzo-biz-velnik-dorqu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012028; classtype:social-engineering; sid:6012028; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (studentska-zadruga.ba/proctal/EN-G.html)"; flow:established,to_server; http.uri; content:"/proctal/EN-G.html"; startswith; fast_pattern; http.host; content:"studentska-zadruga.ba"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012029; classtype:social-engineering; sid:6012029; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (global-package-tracking.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"global-package-tracking.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012030; classtype:social-engineering; sid:6012030; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-vraxlor-biz-druntek-fralnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-vraxlor-biz-druntek-fralnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012031; classtype:social-engineering; sid:6012031; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mrluwas25.bubbleapps.io/version-test/111)"; flow:established,to_server; http.uri; content:"/version-test/111"; startswith; fast_pattern; http.host; content:"mrluwas25.bubbleapps.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012032; classtype:social-engineering; sid:6012032; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreifjwfze2ce74zbj6xilrzf3wixlub5w7ixt2iofzkd72vtndj7c2a.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreifjwfze2ce74zbj6xilrzf3wixlub5w7ixt2iofzkd72vtndj7c2a.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012033; classtype:social-engineering; sid:6012033; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ellisgroupofma.info/PL-1466-160526/?e=tanio7@8097e2947133de380a5724d8d70d208a5950.com&s3=Artur&s4=Plaskowski&s5=&s6=&s7=&s8=&u=97C1466)"; flow:established,to_server; http.uri; content:"/PL-1466-160526/?e=tanio7@8097e2947133de380a5724d8d70d208a5950.com&s3=Artur&s4=Plaskowski&s5=&s6=&s7=&s8=&u=97C1466"; startswith; fast_pattern; http.host; content:"ellisgroupofma.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012034; classtype:social-engineering; sid:6012034; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.vdhedheb-etws.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.vdhedheb-etws.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012035; classtype:social-engineering; sid:6012035; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-qoltor-biz-glarnor-vraltex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-qoltor-biz-glarnor-vraltex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012036; classtype:social-engineering; sid:6012036; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeebig777.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopeebig777.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012037; classtype:social-engineering; sid:6012037; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mrtm-ywoc-dm31.rdials-compasslabservices-com-s-account.workers.dev/api/session/init)"; flow:established,to_server; http.uri; content:"/api/session/init"; startswith; fast_pattern; http.host; content:"mrtm-ywoc-dm31.rdials-compasslabservices-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012038; classtype:social-engineering; sid:6012038; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-druntex-biz-glarnov-frutik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-druntex-biz-glarnov-frutik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012039; classtype:social-engineering; sid:6012039; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coinbase_prologin_log.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coinbase_prologin_log.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012040; classtype:social-engineering; sid:6012040; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-vromtek-biz-slortik-plarnix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-vromtek-biz-slortik-plarnix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012041; classtype:social-engineering; sid:6012041; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17092.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17092.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012042; classtype:social-engineering; sid:6012042; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (post-support.co/pages/login.php)"; flow:established,to_server; http.uri; content:"/pages/login.php"; startswith; fast_pattern; http.host; content:"post-support.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012043; classtype:social-engineering; sid:6012043; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aclearplace.ch/PL-1466-160526/?u=97C1466&e=tomek%40elt.pl&s3=&s4=&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/PL-1466-160526/?u=97C1466&e=tomek%40elt.pl&s3=&s4=&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"aclearplace.ch"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012044; classtype:social-engineering; sid:6012044; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrio.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrio.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012045; classtype:social-engineering; sid:6012045; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yuzuapp.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yuzuapp.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012046; classtype:social-engineering; sid:6012046; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (informacion-034--validar2901.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"informacion-034--validar2901.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012047; classtype:social-engineering; sid:6012047; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-plarnex-biz-frutek-vrolix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-plarnex-biz-frutek-vrolix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012048; classtype:social-engineering; sid:6012048; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-qornex-biz-vroltem-glurnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-qornex-biz-vroltem-glurnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012049; classtype:social-engineering; sid:6012049; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bdovawvip.com/ph/personal/)"; flow:established,to_server; http.uri; content:"/ph/personal/"; startswith; fast_pattern; http.host; content:"bdovawvip.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012050; classtype:social-engineering; sid:6012050; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verificar--seguridad884.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"verificar--seguridad884.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012051; classtype:social-engineering; sid:6012051; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tsgateway.non-steam.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tsgateway.non-steam.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012052; classtype:social-engineering; sid:6012052; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sdgf9af72f31706769d32bf1ff66cdec1d1gkj5jg95jg5k0hkg95kg0tk.pages.dev/NHQ031202LETTER.pdf)"; flow:established,to_server; http.uri; content:"/NHQ031202LETTER.pdf"; startswith; fast_pattern; http.host; content:"sdgf9af72f31706769d32bf1ff66cdec1d1gkj5jg95jg5k0hkg95kg0tk.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012053; classtype:social-engineering; sid:6012053; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (forms.logiforms.com/formdata/user_forms/94306_544262/417129/page1.html)"; flow:established,to_server; http.uri; content:"/formdata/user_forms/94306_544262/417129/page1.html"; startswith; fast_pattern; http.host; content:"forms.logiforms.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012054; classtype:social-engineering; sid:6012054; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (silent-dust-b567.elymatldielwa4741.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"silent-dust-b567.elymatldielwa4741.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012055; classtype:social-engineering; sid:6012055; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kqinbasepro_iogin.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kqinbasepro_iogin.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012056; classtype:social-engineering; sid:6012056; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hellpdesk.at/?r=d614261b-37fd-45ba-aea9-b8c120f1bc86)"; flow:established,to_server; http.uri; content:"/?r=d614261b-37fd-45ba-aea9-b8c120f1bc86"; startswith; fast_pattern; http.host; content:"hellpdesk.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012057; classtype:social-engineering; sid:6012057; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-qurnik-biz-glarnex-fratem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-qurnik-biz-glarnex-fratem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012058; classtype:social-engineering; sid:6012058; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreifdr7lz6qv44cqosz75kwam7x6gta3izhq5vqxyyeharddpacresi.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreifdr7lz6qv44cqosz75kwam7x6gta3izhq5vqxyyeharddpacresi.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012059; classtype:social-engineering; sid:6012059; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365-notifcation.com/93132a08184/0e7994f46ef77d17999eceef/index.php?id=263bdbd4879cc1000096daec31a771e7)"; flow:established,to_server; http.uri; content:"/93132a08184/0e7994f46ef77d17999eceef/index.php?id=263bdbd4879cc1000096daec31a771e7"; startswith; fast_pattern; http.host; content:"365-notifcation.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012060; classtype:social-engineering; sid:6012060; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9945670.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9945670.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012061; classtype:social-engineering; sid:6012061; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (unepsop.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"unepsop.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012062; classtype:social-engineering; sid:6012062; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galaxysurabaya.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galaxysurabaya.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012063; classtype:social-engineering; sid:6012063; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.s29j.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.s29j.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012064; classtype:social-engineering; sid:6012064; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (programme-hup.m365-microsoft.com/i/d721e212eb3094bfd99c9d047a94edaeb)"; flow:established,to_server; http.uri; content:"/i/d721e212eb3094bfd99c9d047a94edaeb"; startswith; fast_pattern; http.host; content:"programme-hup.m365-microsoft.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012065; classtype:social-engineering; sid:6012065; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fv-gigorder.forum/project/confirmation-order)"; flow:established,to_server; http.uri; content:"/project/confirmation-order"; startswith; fast_pattern; http.host; content:"fv-gigorder.forum"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012066; classtype:social-engineering; sid:6012066; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.airbnb-clone-theta-ruddy.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.airbnb-clone-theta-ruddy.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012067; classtype:social-engineering; sid:6012067; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreicgti5vthrvld3r7msmtanxoxgciool3sqmvgprctp5krdrehfcvu.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreicgti5vthrvld3r7msmtanxoxgciool3sqmvgprctp5krdrehfcvu.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012068; classtype:social-engineering; sid:6012068; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vrolor-biz-slatem-qurnax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vrolor-biz-slatem-qurnax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012069; classtype:social-engineering; sid:6012069; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fgzxcn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.fgzxcn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012070; classtype:social-engineering; sid:6012070; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stmarygj.info/41-1511-280526/?u=161C1515&e=crossier%2540etik.com&s3=Christophe&s4=Rossier&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/41-1511-280526/?u=161C1515&e=crossier%2540etik.com&s3=Christophe&s4=Rossier&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"stmarygj.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012071; classtype:social-engineering; sid:6012071; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (test-12-satr.github.io/test/)"; flow:established,to_server; http.uri; content:"/test/"; startswith; fast_pattern; http.host; content:"test-12-satr.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012072; classtype:social-engineering; sid:6012072; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kai-robot-middle-irrigation.trycloudflare.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kai-robot-middle-irrigation.trycloudflare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012073; classtype:social-engineering; sid:6012073; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (panel.charsooq.com/newnaver.html)"; flow:established,to_server; http.uri; content:"/newnaver.html"; startswith; fast_pattern; http.host; content:"panel.charsooq.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012074; classtype:social-engineering; sid:6012074; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.roblox.com.ge/login/)"; flow:established,to_server; http.uri; content:"/login/"; startswith; fast_pattern; http.host; content:"www.roblox.com.ge"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012075; classtype:social-engineering; sid:6012075; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.imtokevn.im/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.imtokevn.im"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012076; classtype:social-engineering; sid:6012076; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mmbxcdfg.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mmbxcdfg.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012077; classtype:social-engineering; sid:6012077; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (programme-hup.m365-microsoft.com/home/fe25e4a4bcbe488aa65868887cf94206/d721e212eb3094bfd99c9d047a94edaeb)"; flow:established,to_server; http.uri; content:"/home/fe25e4a4bcbe488aa65868887cf94206/d721e212eb3094bfd99c9d047a94edaeb"; startswith; fast_pattern; http.host; content:"programme-hup.m365-microsoft.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012078; classtype:social-engineering; sid:6012078; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.doeusignsafe.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.doeusignsafe.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012079; classtype:social-engineering; sid:6012079; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-xolmer-biz-trevik-nasqu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-xolmer-biz-trevik-nasqu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012080; classtype:social-engineering; sid:6012080; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreia7m7wyi7xnltk5kqkoy4m3nssthp2vnjertouskbhqknycjtb2o4.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreia7m7wyi7xnltk5kqkoy4m3nssthp2vnjertouskbhqknycjtb2o4.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012081; classtype:social-engineering; sid:6012081; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.yh87755.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.yh87755.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012082; classtype:social-engineering; sid:6012082; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (terzor-io.gitlab.io/begin)"; flow:established,to_server; http.uri; content:"/begin"; startswith; fast_pattern; http.host; content:"terzor-io.gitlab.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012083; classtype:social-engineering; sid:6012083; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-pelnor-biz-vextar-jumli.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-pelnor-biz-vextar-jumli.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012084; classtype:social-engineering; sid:6012084; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store-steampowered.online/gift_card)"; flow:established,to_server; http.uri; content:"/gift_card"; startswith; fast_pattern; http.host; content:"store-steampowered.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012085; classtype:social-engineering; sid:6012085; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-frontek-biz-slavqor-dramnix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-frontek-biz-slavqor-dramnix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012086; classtype:social-engineering; sid:6012086; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pro_coinbaslogin-io.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pro_coinbaslogin-io.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012087; classtype:social-engineering; sid:6012087; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tinyurl.com/Paypal727362/)"; flow:established,to_server; http.uri; content:"/Paypal727362/"; startswith; fast_pattern; http.host; content:"www.tinyurl.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012088; classtype:social-engineering; sid:6012088; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365bet002.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"365bet002.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012089; classtype:social-engineering; sid:6012089; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cooltentregas.com.br/cumm/AMENCN-1/en.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=Z2FsaWsyQGJhMzA1MzY0Y2E0YjMxNjc2YmEwM2ZhMzg0OTQwNGNlYTdiOC5jb20=&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1)"; flow:established,to_server; http.uri; content:"/cumm/AMENCN-1/en.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=Z2FsaWsyQGJhMzA1MzY0Y2E0YjMxNjc2YmEwM2ZhMzg0OTQwNGNlYTdiOC5jb20=&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1"; startswith; fast_pattern; http.host; content:"cooltentregas.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012090; classtype:social-engineering; sid:6012090; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (post-support.co/pages/ban.php)"; flow:established,to_server; http.uri; content:"/pages/ban.php"; startswith; fast_pattern; http.host; content:"post-support.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012091; classtype:social-engineering; sid:6012091; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee1969.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopee1969.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012092; classtype:social-engineering; sid:6012092; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (manyhotels.com.ng/mvcogjy/Veri.html)"; flow:established,to_server; http.uri; content:"/mvcogjy/Veri.html"; startswith; fast_pattern; http.host; content:"manyhotels.com.ng"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012093; classtype:social-engineering; sid:6012093; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (72264.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"72264.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012094; classtype:social-engineering; sid:6012094; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17106.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17106.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012095; classtype:social-engineering; sid:6012095; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mrtm-ywoc-dm31.rdials-compasslabservices-com-s-account.workers.dev/bedd06f2464a0b8f?email=)"; flow:established,to_server; http.uri; content:"/bedd06f2464a0b8f?email="; startswith; fast_pattern; http.host; content:"mrtm-ywoc-dm31.rdials-compasslabservices-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012096; classtype:social-engineering; sid:6012096; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allbestads.com/sign-in?op_token=5uDn296H92rPrYiwWwnVlDb0IiLK7ooomlZ2wta8I5hKXL0TAfeyrNQHVVxsNnqUI685CK8Tp5eMnnT80p8pyweso7d3FJA6DPV&uuid=921eea32-fe6a-4445-9a13-bde8d63cc8e7&hash=2&language=en)"; flow:established,to_server; http.uri; content:"/sign-in?op_token=5uDn296H92rPrYiwWwnVlDb0IiLK7ooomlZ2wta8I5hKXL0TAfeyrNQHVVxsNnqUI685CK8Tp5eMnnT80p8pyweso7d3FJA6DPV&uuid=921eea32-fe6a-4445-9a13-bde8d63cc8e7&hash=2&language=en"; startswith; fast_pattern; http.host; content:"allbestads.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012097; classtype:social-engineering; sid:6012097; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hindigame37-create.github.io/Instagram-)"; flow:established,to_server; http.uri; content:"/Instagram-"; startswith; fast_pattern; http.host; content:"hindigame37-create.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012098; classtype:social-engineering; sid:6012098; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortex.life/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortex.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012099; classtype:social-engineering; sid:6012099; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coinbase_v_login.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coinbase_v_login.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012100; classtype:social-engineering; sid:6012100; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pgijrcloud.non-steam.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pgijrcloud.non-steam.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012101; classtype:social-engineering; sid:6012101; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (esl-claim-alert.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"esl-claim-alert.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012102; classtype:social-engineering; sid:6012102; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dana-open-akun.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dana-open-akun.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012103; classtype:social-engineering; sid:6012103; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17094.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17094.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012104; classtype:social-engineering; sid:6012104; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enlacedecertificacionout.zya.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"enlacedecertificacionout.zya.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012105; classtype:social-engineering; sid:6012105; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coin-bse-app.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coin-bse-app.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012106; classtype:social-engineering; sid:6012106; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mussa-esliman.github.io/Responsive--Apple--Website-/)"; flow:established,to_server; http.uri; content:"/Responsive--Apple--Website-/"; startswith; fast_pattern; http.host; content:"mussa-esliman.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012107; classtype:social-engineering; sid:6012107; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bhaarathinesan.github.io/netflix-clone-js/)"; flow:established,to_server; http.uri; content:"/netflix-clone-js/"; startswith; fast_pattern; http.host; content:"bhaarathinesan.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012108; classtype:social-engineering; sid:6012108; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-plavnor-biz-fruntik-qalrex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-plavnor-biz-fruntik-qalrex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012109; classtype:social-engineering; sid:6012109; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prime-videosfrance.com/suivi)"; flow:established,to_server; http.uri; content:"/suivi"; startswith; fast_pattern; http.host; content:"prime-videosfrance.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012110; classtype:social-engineering; sid:6012110; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.xpj5s.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.xpj5s.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012111; classtype:social-engineering; sid:6012111; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (study.orsapaz.info/ga/click/2-6736491-9-8129-15917-8736-9d12ccec80-8e042984f4)"; flow:established,to_server; http.uri; content:"/ga/click/2-6736491-9-8129-15917-8736-9d12ccec80-8e042984f4"; startswith; fast_pattern; http.host; content:"study.orsapaz.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012112; classtype:social-engineering; sid:6012112; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-qolvrax-biz-slurnik-vromtek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-qolvrax-biz-slurnik-vromtek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012113; classtype:social-engineering; sid:6012113; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreici6nv56agv2t5tpzzcn4y4mpqu4fgfac7rnpn2vudtxg7gu76afu.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreici6nv56agv2t5tpzzcn4y4mpqu4fgfac7rnpn2vudtxg7gu76afu.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012114; classtype:social-engineering; sid:6012114; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prime-videos2026.com/suivi)"; flow:established,to_server; http.uri; content:"/suivi"; startswith; fast_pattern; http.host; content:"prime-videos2026.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012115; classtype:social-engineering; sid:6012115; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-notification.link/landing/form/67191dd7-6877-4f52-8995-8cb4330e825a)"; flow:established,to_server; http.uri; content:"/landing/form/67191dd7-6877-4f52-8995-8cb4330e825a"; startswith; fast_pattern; http.host; content:"secure-notification.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012116; classtype:social-engineering; sid:6012116; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (memnunpendcert.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"memnunpendcert.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012117; classtype:social-engineering; sid:6012117; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee2444.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopee2444.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012118; classtype:social-engineering; sid:6012118; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-fralqor-biz-vrontek-plamnix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-fralqor-biz-vrontek-plamnix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012119; classtype:social-engineering; sid:6012119; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (main.d10f1bairhzt3o.amplifyapp.com/?id=oranz@35989161f375bbc4a61ade3470818e985c30.org)"; flow:established,to_server; http.uri; content:"/?id=oranz@35989161f375bbc4a61ade3470818e985c30.org"; startswith; fast_pattern; http.host; content:"main.d10f1bairhzt3o.amplifyapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012120; classtype:social-engineering; sid:6012120; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en-taiyangcheng.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"en-taiyangcheng.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012121; classtype:social-engineering; sid:6012121; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shivaa.kiinoasnacks.info/ga/click/2-9843369-10-8685-16975-9310-1ae25ff4a6-d6714bdb7f)"; flow:established,to_server; http.uri; content:"/ga/click/2-9843369-10-8685-16975-9310-1ae25ff4a6-d6714bdb7f"; startswith; fast_pattern; http.host; content:"shivaa.kiinoasnacks.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012122; classtype:social-engineering; sid:6012122; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (esl-org-claims2.lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"esl-org-claims2.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012123; classtype:social-engineering; sid:6012123; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ra1csbt.pay-qoqa.cc/connect/session-eb879a0453a50ca82526b4699d4661a1cf/access/613d147ba96cff8304d0eeca897fd42c)"; flow:established,to_server; http.uri; content:"/connect/session-eb879a0453a50ca82526b4699d4661a1cf/access/613d147ba96cff8304d0eeca897fd42c"; startswith; fast_pattern; http.host; content:"ra1csbt.pay-qoqa.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012124; classtype:social-engineering; sid:6012124; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (demo.billmanthra.com/lawlibrary/secure_access-lawlibrary.html)"; flow:established,to_server; http.uri; content:"/lawlibrary/secure_access-lawlibrary.html"; startswith; fast_pattern; http.host; content:"demo.billmanthra.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012125; classtype:social-engineering; sid:6012125; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (conto.servizi.avivos290.t.mydomain.zone/VERIFICA-DATI/conto/conto)"; flow:established,to_server; http.uri; content:"/VERIFICA-DATI/conto/conto"; startswith; fast_pattern; http.host; content:"conto.servizi.avivos290.t.mydomain.zone"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012126; classtype:social-engineering; sid:6012126; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mitaomaodou.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mitaomaodou.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012127; classtype:social-engineering; sid:6012127; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcast-production-a95e.up.railway.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcast-production-a95e.up.railway.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012128; classtype:social-engineering; sid:6012128; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (scotiawealthmanagement.com.cobblestonesw.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"scotiawealthmanagement.com.cobblestonesw.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012129; classtype:social-engineering; sid:6012129; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (antas.szm.sk/up/home.htm?knuzjyvrpclivcuiqwz3hopf9rerq2fnir3ghtmp8qz6psni6c)"; flow:established,to_server; http.uri; content:"/up/home.htm?knuzjyvrpclivcuiqwz3hopf9rerq2fnir3ghtmp8qz6psni6c"; startswith; fast_pattern; http.host; content:"antas.szm.sk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012130; classtype:social-engineering; sid:6012130; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ellisgroupofma.info/PL-1466-160526/[email%C2%A0protected])"; flow:established,to_server; http.uri; content:"/PL-1466-160526/[email%C2%A0protected]"; startswith; fast_pattern; http.host; content:"ellisgroupofma.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012131; classtype:social-engineering; sid:6012131; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee2444.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopee2444.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012132; classtype:social-engineering; sid:6012132; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prime-videos2026.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"prime-videos2026.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012133; classtype:social-engineering; sid:6012133; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hkttxpayments.non-steam.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hkttxpayments.non-steam.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012134; classtype:social-engineering; sid:6012134; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-qolnix-biz-vroltor-glantek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-qolnix-biz-vroltor-glantek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012135; classtype:social-engineering; sid:6012135; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kqinbasepro_iogin.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kqinbasepro_iogin.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012136; classtype:social-engineering; sid:6012136; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-dravtem-biz-vrolnik-qarnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-dravtem-biz-vrolnik-qarnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012137; classtype:social-engineering; sid:6012137; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anttas.szm.sk/up/home.htm?fr2jp9yed0bg1b9dkaelargkxtzmpean6zq7qfk5c250ay2mj9)"; flow:established,to_server; http.uri; content:"/up/home.htm?fr2jp9yed0bg1b9dkaelargkxtzmpean6zq7qfk5c250ay2mj9"; startswith; fast_pattern; http.host; content:"anttas.szm.sk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012138; classtype:social-engineering; sid:6012138; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (admbyb.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"admbyb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012139; classtype:social-engineering; sid:6012139; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (generalhubservice.com/985205/)"; flow:established,to_server; http.uri; content:"/985205/"; startswith; fast_pattern; http.host; content:"generalhubservice.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012140; classtype:social-engineering; sid:6012140; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (top-top-rho.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"top-top-rho.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012141; classtype:social-engineering; sid:6012141; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.adminveri-forn.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.adminveri-forn.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012142; classtype:social-engineering; sid:6012142; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-glamtor-biz-vroltex-qarnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-glamtor-biz-vroltex-qarnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012143; classtype:social-engineering; sid:6012143; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-qurnex-biz-slurnor-vrolax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-qurnex-biz-slurnor-vrolax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012144; classtype:social-engineering; sid:6012144; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (resarch.markusscholz.info/ga/click/2-9679085-10-8494-16604-9112-17afc9ad5f-27b11aed3c)"; flow:established,to_server; http.uri; content:"/ga/click/2-9679085-10-8494-16604-9112-17afc9ad5f-27b11aed3c"; startswith; fast_pattern; http.host; content:"resarch.markusscholz.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012145; classtype:social-engineering; sid:6012145; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (22-abhi.github.io/netflix-clone-optimized)"; flow:established,to_server; http.uri; content:"/netflix-clone-optimized"; startswith; fast_pattern; http.host; content:"22-abhi.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012146; classtype:social-engineering; sid:6012146; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.exdsite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.exdsite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012147; classtype:social-engineering; sid:6012147; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth-wetrhug.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auth-wetrhug.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012148; classtype:social-engineering; sid:6012148; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.amazonpk-clone.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazonpk-clone.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012149; classtype:social-engineering; sid:6012149; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (haber7546.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"haber7546.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012150; classtype:social-engineering; sid:6012150; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.invfn.live/id/login)"; flow:established,to_server; http.uri; content:"/id/login"; startswith; fast_pattern; http.host; content:"www.invfn.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012151; classtype:social-engineering; sid:6012151; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maroon-info-652456.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"maroon-info-652456.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012152; classtype:social-engineering; sid:6012152; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (upce0.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"upce0.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012153; classtype:social-engineering; sid:6012153; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rwenzoritechub.com/doublec/po/rabi/v76IP9F/bm9taW5hdGluZ2NvbW1pdHRlZUB1a3JhaW5pYW5jdS5jb20=)"; flow:established,to_server; http.uri; content:"/doublec/po/rabi/v76IP9F/bm9taW5hdGluZ2NvbW1pdHRlZUB1a3JhaW5pYW5jdS5jb20="; startswith; fast_pattern; http.host; content:"rwenzoritechub.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012154; classtype:social-engineering; sid:6012154; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verifysbc-55787c.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"verifysbc-55787c.webflow.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012155; classtype:social-engineering; sid:6012155; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (io-coin-tracker.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"io-coin-tracker.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012156; classtype:social-engineering; sid:6012156; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prime-videofacture.com/suivi)"; flow:established,to_server; http.uri; content:"/suivi"; startswith; fast_pattern; http.host; content:"prime-videofacture.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012157; classtype:social-engineering; sid:6012157; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail--support.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webmail--support.framer.website"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012158; classtype:social-engineering; sid:6012158; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (informationenkontaktdkb1.sviluppo.host/de/content/login.php)"; flow:established,to_server; http.uri; content:"/de/content/login.php"; startswith; fast_pattern; http.host; content:"informationenkontaktdkb1.sviluppo.host"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012159; classtype:social-engineering; sid:6012159; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (home-cdnblofin.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"home-cdnblofin.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012160; classtype:social-engineering; sid:6012160; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.realdecorralejo.com/cgi-admin/signer.html)"; flow:established,to_server; http.uri; content:"/cgi-admin/signer.html"; startswith; fast_pattern; http.host; content:"www.realdecorralejo.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012161; classtype:social-engineering; sid:6012161; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nhgo-2xnx-cw12.jennifer-jencrosslaw-com-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nhgo-2xnx-cw12.jennifer-jencrosslaw-com-s-account.workers.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012162; classtype:social-engineering; sid:6012162; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e-ucenje-fsb-hr.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e-ucenje-fsb-hr.framer.website"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012163; classtype:social-engineering; sid:6012163; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (indexmxhwnvfiu4wu29174vfm4odq2fqwt6pnfzup3iwdwxy.restaurantedugandolfo.com.br/404.html)"; flow:established,to_server; http.uri; content:"/404.html"; startswith; fast_pattern; http.host; content:"indexmxhwnvfiu4wu29174vfm4odq2fqwt6pnfzup3iwdwxy.restaurantedugandolfo.com.br"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012164; classtype:social-engineering; sid:6012164; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2802124695-tt76vnpt-invoice.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2802124695-tt76vnpt-invoice.framer.website"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012165; classtype:social-engineering; sid:6012165; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (safemanagementatforiawdfield.vu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"safemanagementatforiawdfield.vu"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012166; classtype:social-engineering; sid:6012166; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rhinomadeusainc.shop/index.php/campaigns/at92141hxec2a/web-version/py271ebhay099)"; flow:established,to_server; http.uri; content:"/index.php/campaigns/at92141hxec2a/web-version/py271ebhay099"; startswith; fast_pattern; http.host; content:"rhinomadeusainc.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012167; classtype:social-engineering; sid:6012167; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aetherion921.github.io/homepage-practice-project/)"; flow:established,to_server; http.uri; content:"/homepage-practice-project/"; startswith; fast_pattern; http.host; content:"aetherion921.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012168; classtype:social-engineering; sid:6012168; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dytaln.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dytaln.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012169; classtype:social-engineering; sid:6012169; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tiwdve.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tiwdve.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012170; classtype:social-engineering; sid:6012170; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17067.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17067.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012171; classtype:social-engineering; sid:6012171; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.t70r.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.t70r.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012172; classtype:social-engineering; sid:6012172; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (conteste.pt/tlke/akcebnvctrxghkjjocbfdtg/login.htm)"; flow:established,to_server; http.uri; content:"/tlke/akcebnvctrxghkjjocbfdtg/login.htm"; startswith; fast_pattern; http.host; content:"conteste.pt"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012173; classtype:social-engineering; sid:6012173; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.outconfiadd.webcindario.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.outconfiadd.webcindario.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012174; classtype:social-engineering; sid:6012174; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365365m.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.365365m.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012175; classtype:social-engineering; sid:6012175; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vofxuw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vofxuw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012176; classtype:social-engineering; sid:6012176; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clownfish-app-her5f.ondigitalocean.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"clownfish-app-her5f.ondigitalocean.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012177; classtype:social-engineering; sid:6012177; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (x21d.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"x21d.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012178; classtype:social-engineering; sid:6012178; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.elxdnz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.elxdnz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012179; classtype:social-engineering; sid:6012179; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (grameenasevakendra.com/tobi/kl/lk/)"; flow:established,to_server; http.uri; content:"/tobi/kl/lk/"; startswith; fast_pattern; http.host; content:"grameenasevakendra.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012180; classtype:social-engineering; sid:6012180; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blockchnanlogin.gitbook.io/usa/)"; flow:established,to_server; http.uri; content:"/usa/"; startswith; fast_pattern; http.host; content:"blockchnanlogin.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012181; classtype:social-engineering; sid:6012181; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galabet.galay.cam/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galabet.galay.cam"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012182; classtype:social-engineering; sid:6012182; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15908.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15908.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012183; classtype:social-engineering; sid:6012183; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (markin.github.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"markin.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012184; classtype:social-engineering; sid:6012184; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gateway.breezehost.xyz/OE9D9ravE9vpi3v/)"; flow:established,to_server; http.uri; content:"/OE9D9ravE9vpi3v/"; startswith; fast_pattern; http.host; content:"gateway.breezehost.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012185; classtype:social-engineering; sid:6012185; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.arvjmx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.arvjmx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012186; classtype:social-engineering; sid:6012186; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bwrzke.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bwrzke.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012187; classtype:social-engineering; sid:6012187; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3659b.win/lottery.html)"; flow:established,to_server; http.uri; content:"/lottery.html"; startswith; fast_pattern; http.host; content:"3659b.win"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012188; classtype:social-engineering; sid:6012188; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zenin.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zenin.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012189; classtype:social-engineering; sid:6012189; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zicwxq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zicwxq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012190; classtype:social-engineering; sid:6012190; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tasuki.net/wp-content/meta-online-fb/login/)"; flow:established,to_server; http.uri; content:"/wp-content/meta-online-fb/login/"; startswith; fast_pattern; http.host; content:"tasuki.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012191; classtype:social-engineering; sid:6012191; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kjimpx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kjimpx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012192; classtype:social-engineering; sid:6012192; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e350.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e350.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012193; classtype:social-engineering; sid:6012193; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.zz88js.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.zz88js.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012194; classtype:social-engineering; sid:6012194; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (espaceclientorange.jimdofree.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"espaceclientorange.jimdofree.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012195; classtype:social-engineering; sid:6012195; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (postnlpakketten.beepleapp.eu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"postnlpakketten.beepleapp.eu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012196; classtype:social-engineering; sid:6012196; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roevalleyresort.spahotel.guru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"roevalleyresort.spahotel.guru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012197; classtype:social-engineering; sid:6012197; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clownfish-app-her5f.ondigitalocean.app/huh/index.html)"; flow:established,to_server; http.uri; content:"/huh/index.html"; startswith; fast_pattern; http.host; content:"clownfish-app-her5f.ondigitalocean.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012198; classtype:social-engineering; sid:6012198; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17195.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17195.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012199; classtype:social-engineering; sid:6012199; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (narrenschlag.de/authl/)"; flow:established,to_server; http.uri; content:"/authl/"; startswith; fast_pattern; http.host; content:"narrenschlag.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012200; classtype:social-engineering; sid:6012200; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-main.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-main.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012201; classtype:social-engineering; sid:6012201; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jptxus.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jptxus.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012202; classtype:social-engineering; sid:6012202; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365365q.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.365365q.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012203; classtype:social-engineering; sid:6012203; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-plornik-biz-travqor-vrultek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-plornik-biz-travqor-vrultek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012204; classtype:social-engineering; sid:6012204; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lw.ldxbch.com/xinfinifix/xinfini/)"; flow:established,to_server; http.uri; content:"/xinfinifix/xinfini/"; startswith; fast_pattern; http.host; content:"lw.ldxbch.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012205; classtype:social-engineering; sid:6012205; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vrolnik-biz-glurnex-qortem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vrolnik-biz-glurnex-qortem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012206; classtype:social-engineering; sid:6012206; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cqsssnwtj.com/instert/login.in)"; flow:established,to_server; http.uri; content:"/instert/login.in"; startswith; fast_pattern; http.host; content:"cqsssnwtj.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012207; classtype:social-engineering; sid:6012207; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fidgob.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.fidgob.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012208; classtype:social-engineering; sid:6012208; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (desktop-ledgre.zapier.app/live/)"; flow:established,to_server; http.uri; content:"/live/"; startswith; fast_pattern; http.host; content:"desktop-ledgre.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012209; classtype:social-engineering; sid:6012209; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflixclone-chi-ten.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflixclone-chi-ten.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012210; classtype:social-engineering; sid:6012210; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cqsssnwtj.com/instert/login.in/)"; flow:established,to_server; http.uri; content:"/instert/login.in/"; startswith; fast_pattern; http.host; content:"cqsssnwtj.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012211; classtype:social-engineering; sid:6012211; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.aunyjl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.aunyjl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012212; classtype:social-engineering; sid:6012212; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-3iy3nxf8t.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-3iy3nxf8t.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012213; classtype:social-engineering; sid:6012213; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (887790.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"887790.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012214; classtype:social-engineering; sid:6012214; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mbauik.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mbauik.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012215; classtype:social-engineering; sid:6012215; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meetamaskcriptologin.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meetamaskcriptologin.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012216; classtype:social-engineering; sid:6012216; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pessoleldept.com/?r=5a30fa6a-7f58-4a98-aae0-7e4257f7cdd5)"; flow:established,to_server; http.uri; content:"/?r=5a30fa6a-7f58-4a98-aae0-7e4257f7cdd5"; startswith; fast_pattern; http.host; content:"pessoleldept.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012217; classtype:social-engineering; sid:6012217; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (swer-e7csdkeahwashebs.z03.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"swer-e7csdkeahwashebs.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012218; classtype:social-engineering; sid:6012218; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jylxiq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jylxiq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012219; classtype:social-engineering; sid:6012219; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (msportal-pagos-grupos.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"msportal-pagos-grupos.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012220; classtype:social-engineering; sid:6012220; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.365365q.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.365365q.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012221; classtype:social-engineering; sid:6012221; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (net-flix-verif.bolt.host/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"net-flix-verif.bolt.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012222; classtype:social-engineering; sid:6012222; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (outceb.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"outceb.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012223; classtype:social-engineering; sid:6012223; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.krmdhg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.krmdhg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012224; classtype:social-engineering; sid:6012224; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.xbb.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.xbb.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012225; classtype:social-engineering; sid:6012225; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uhj-zgfcsa.wasmer.app/instapro)"; flow:established,to_server; http.uri; content:"/instapro"; startswith; fast_pattern; http.host; content:"uhj-zgfcsa.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012226; classtype:social-engineering; sid:6012226; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eng-ledgr-com.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eng-ledgr-com.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012227; classtype:social-engineering; sid:6012227; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (recent1.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"recent1.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012228; classtype:social-engineering; sid:6012228; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (darioandreella.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"darioandreella.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012229; classtype:social-engineering; sid:6012229; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreibeyykwgcztu75t7jipqbjliizpkwlkpdaqarxgmph35coirknoxu.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreibeyykwgcztu75t7jipqbjliizpkwlkpdaqarxgmph35coirknoxu.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012230; classtype:social-engineering; sid:6012230; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pc.fintrexc.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pc.fintrexc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012231; classtype:social-engineering; sid:6012231; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8847bet.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8847bet.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012232; classtype:social-engineering; sid:6012232; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dailyalokitodesh.com/cgi/service/maintain/update/webmin.html)"; flow:established,to_server; http.uri; content:"/cgi/service/maintain/update/webmin.html"; startswith; fast_pattern; http.host; content:"dailyalokitodesh.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012233; classtype:social-engineering; sid:6012233; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.galabet-tr158.co/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.galabet-tr158.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012234; classtype:social-engineering; sid:6012234; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.txqlrk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.txqlrk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012235; classtype:social-engineering; sid:6012235; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zdksqw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zdksqw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012236; classtype:social-engineering; sid:6012236; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (new-messeges-bird-dacc.kristina1080.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"new-messeges-bird-dacc.kristina1080.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012237; classtype:social-engineering; sid:6012237; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lfpnay.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lfpnay.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012238; classtype:social-engineering; sid:6012238; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zasebt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zasebt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012239; classtype:social-engineering; sid:6012239; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.vniswap-v3-interface.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.vniswap-v3-interface.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012240; classtype:social-engineering; sid:6012240; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gqowtm.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gqowtm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012241; classtype:social-engineering; sid:6012241; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xlkgjb.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xlkgjb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012242; classtype:social-engineering; sid:6012242; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gtjzyv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gtjzyv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012243; classtype:social-engineering; sid:6012243; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.gqtmprwa.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.gqtmprwa.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012244; classtype:social-engineering; sid:6012244; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gebyarhadiah1010.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.gebyarhadiah1010.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012245; classtype:social-engineering; sid:6012245; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.epbiqk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.epbiqk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012246; classtype:social-engineering; sid:6012246; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tdqjmc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tdqjmc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012247; classtype:social-engineering; sid:6012247; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mtrxqvlp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mtrxqvlp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012248; classtype:social-engineering; sid:6012248; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stage.myfidelitysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"stage.myfidelitysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012249; classtype:social-engineering; sid:6012249; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.czplwnvr.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.czplwnvr.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012250; classtype:social-engineering; sid:6012250; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bdosqx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bdosqx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012251; classtype:social-engineering; sid:6012251; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lzbhap.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lzbhap.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012252; classtype:social-engineering; sid:6012252; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.igwrdq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.igwrdq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012253; classtype:social-engineering; sid:6012253; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.croatiapools.com/DK/DKB/dkb/login.php/)"; flow:established,to_server; http.uri; content:"/DK/DKB/dkb/login.php/"; startswith; fast_pattern; http.host; content:"www.croatiapools.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012254; classtype:social-engineering; sid:6012254; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-uh4bkufsi.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-uh4bkufsi.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012255; classtype:social-engineering; sid:6012255; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hg937.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hg937.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012256; classtype:social-engineering; sid:6012256; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.paypal-c.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.paypal-c.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012257; classtype:social-engineering; sid:6012257; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.365365m.app/chs/)"; flow:established,to_server; http.uri; content:"/chs/"; startswith; fast_pattern; http.host; content:"m.365365m.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012258; classtype:social-engineering; sid:6012258; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (combscustoms.com/instert/login.in)"; flow:established,to_server; http.uri; content:"/instert/login.in"; startswith; fast_pattern; http.host; content:"combscustoms.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012259; classtype:social-engineering; sid:6012259; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3115ss.cc/agent.html)"; flow:established,to_server; http.uri; content:"/agent.html"; startswith; fast_pattern; http.host; content:"3115ss.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012260; classtype:social-engineering; sid:6012260; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.plqcbj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.plqcbj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012261; classtype:social-engineering; sid:6012261; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (darioandreella.com/da/)"; flow:established,to_server; http.uri; content:"/da/"; startswith; fast_pattern; http.host; content:"darioandreella.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012262; classtype:social-engineering; sid:6012262; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jprzwlnq.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jprzwlnq.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012263; classtype:social-engineering; sid:6012263; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mhjrai.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mhjrai.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012264; classtype:social-engineering; sid:6012264; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.airbnb-style-clone.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.airbnb-style-clone.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012265; classtype:social-engineering; sid:6012265; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (golink.evn.my.id/JfkbL)"; flow:established,to_server; http.uri; content:"/JfkbL"; startswith; fast_pattern; http.host; content:"golink.evn.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012266; classtype:social-engineering; sid:6012266; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pyatmo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pyatmo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012267; classtype:social-engineering; sid:6012267; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pemulihan-akun.dana-id.co4.in/t0f)"; flow:established,to_server; http.uri; content:"/t0f"; startswith; fast_pattern; http.host; content:"pemulihan-akun.dana-id.co4.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012268; classtype:social-engineering; sid:6012268; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gezmvt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gezmvt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012269; classtype:social-engineering; sid:6012269; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jqliwz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jqliwz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012270; classtype:social-engineering; sid:6012270; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mart.instawp.dev/DocuSign77.html)"; flow:established,to_server; http.uri; content:"/DocuSign77.html"; startswith; fast_pattern; http.host; content:"mart.instawp.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012271; classtype:social-engineering; sid:6012271; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.irjboz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.irjboz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012272; classtype:social-engineering; sid:6012272; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bitoraexchange.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bitoraexchange.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012273; classtype:social-engineering; sid:6012273; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ueljtp.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ueljtp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012274; classtype:social-engineering; sid:6012274; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.cznlwrpt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.cznlwrpt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012275; classtype:social-engineering; sid:6012275; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fritzhost-001-site1.site4future.com/9HX0BJstlwqNOinTSZnTP7IUkFnJ8gmFqLB1C2XsPfeLzcAuZMFKKbYF2KanV3AcmKoHZlxLKBmpeX9aI6EGUaZ9bOutDx2b7CJt)"; flow:established,to_server; http.uri; content:"/9HX0BJstlwqNOinTSZnTP7IUkFnJ8gmFqLB1C2XsPfeLzcAuZMFKKbYF2KanV3AcmKoHZlxLKBmpeX9aI6EGUaZ9bOutDx2b7CJt"; startswith; fast_pattern; http.host; content:"fritzhost-001-site1.site4future.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012276; classtype:social-engineering; sid:6012276; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9000-firebase-cloudstorage-1777303669425.cluster-thle3dudhffpwss7zs5hxaeu2o.cloudworkstations.dev/?eta=%20elan@275a73551d9cb59ac300f755426c8fb5c115.com)"; flow:established,to_server; http.uri; content:"/?eta=%20elan@275a73551d9cb59ac300f755426c8fb5c115.com"; startswith; fast_pattern; http.host; content:"9000-firebase-cloudstorage-1777303669425.cluster-thle3dudhffpwss7zs5hxaeu2o.cloudworkstations.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012277; classtype:social-engineering; sid:6012277; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.keqmnh.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.keqmnh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012278; classtype:social-engineering; sid:6012278; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.frwdit.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.frwdit.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012279; classtype:social-engineering; sid:6012279; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gqhbcl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gqhbcl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012280; classtype:social-engineering; sid:6012280; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.shopledgerapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app.shopledgerapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012281; classtype:social-engineering; sid:6012281; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-glarnex-biz-slurnik-vrolax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-glarnex-biz-slurnik-vrolax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012282; classtype:social-engineering; sid:6012282; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rkqeaw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rkqeaw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012283; classtype:social-engineering; sid:6012283; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jwtxqlrp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jwtxqlrp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012284; classtype:social-engineering; sid:6012284; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.aomenyinhebocai.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.aomenyinhebocai.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012285; classtype:social-engineering; sid:6012285; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365556.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.365556.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012286; classtype:social-engineering; sid:6012286; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dancing-tapioca-a460d0.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dancing-tapioca-a460d0.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012287; classtype:social-engineering; sid:6012287; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rhinomadeusainc.shop/index.php/campaigns/at92141hxec2a/track-url/ge292ktpn9b7f/4c9f899dcec11fc1a8c3710c1c06b5d05ec0b66e)"; flow:established,to_server; http.uri; content:"/index.php/campaigns/at92141hxec2a/track-url/ge292ktpn9b7f/4c9f899dcec11fc1a8c3710c1c06b5d05ec0b66e"; startswith; fast_pattern; http.host; content:"rhinomadeusainc.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012288; classtype:social-engineering; sid:6012288; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.global-package-tracking.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.global-package-tracking.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012289; classtype:social-engineering; sid:6012289; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.365365q.app:443/chs/)"; flow:established,to_server; http.uri; content:"/chs/"; startswith; fast_pattern; http.host; content:"m.365365q.app:443"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012290; classtype:social-engineering; sid:6012290; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rhinomadeusainc.shop/index.php/campaigns/at92141hxec2a/track-url/py271ebhay099/4c9f899dcec11fc1a8c3710c1c06b5d05ec0b66e)"; flow:established,to_server; http.uri; content:"/index.php/campaigns/at92141hxec2a/track-url/py271ebhay099/4c9f899dcec11fc1a8c3710c1c06b5d05ec0b66e"; startswith; fast_pattern; http.host; content:"rhinomadeusainc.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012291; classtype:social-engineering; sid:6012291; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.oupjxt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.oupjxt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012292; classtype:social-engineering; sid:6012292; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jbqspi.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jbqspi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012293; classtype:social-engineering; sid:6012293; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3115yy.cc/agent.html)"; flow:established,to_server; http.uri; content:"/agent.html"; startswith; fast_pattern; http.host; content:"3115yy.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012294; classtype:social-engineering; sid:6012294; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (holy-rain-1022.ceiltt0khkennedy42944.workers.dev/email-notification-meta-security-center)"; flow:established,to_server; http.uri; content:"/email-notification-meta-security-center"; startswith; fast_pattern; http.host; content:"holy-rain-1022.ceiltt0khkennedy42944.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012295; classtype:social-engineering; sid:6012295; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nikitatitung053.github.io/amazon_clone/)"; flow:established,to_server; http.uri; content:"/amazon_clone/"; startswith; fast_pattern; http.host; content:"nikitatitung053.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012296; classtype:social-engineering; sid:6012296; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater4.resmi-hkv2.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater4.resmi-hkv2.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012297; classtype:social-engineering; sid:6012297; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.blockex.world/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.blockex.world"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012298; classtype:social-engineering; sid:6012298; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-qravnik-biz-glurnor-fraltex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-qravnik-biz-glurnor-fraltex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012299; classtype:social-engineering; sid:6012299; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17065.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17065.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012300; classtype:social-engineering; sid:6012300; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bvnwzqp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.bvnwzqp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012301; classtype:social-engineering; sid:6012301; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bnmhgy.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bnmhgy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012302; classtype:social-engineering; sid:6012302; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiew7fbnac76pnq2nkw5you7mrwbzcgmgdb664vklfxmjb75p2xq2e.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiew7fbnac76pnq2nkw5you7mrwbzcgmgdb664vklfxmjb75p2xq2e.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012303; classtype:social-engineering; sid:6012303; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hvxsp.paskj.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hvxsp.paskj.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012304; classtype:social-engineering; sid:6012304; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xapp-inline105003.com/app/appline/)"; flow:established,to_server; http.uri; content:"/app/appline/"; startswith; fast_pattern; http.host; content:"xapp-inline105003.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012305; classtype:social-engineering; sid:6012305; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.deiwbc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.deiwbc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012306; classtype:social-engineering; sid:6012306; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zfreyw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zfreyw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012307; classtype:social-engineering; sid:6012307; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (getrobux16win.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"getrobux16win.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012308; classtype:social-engineering; sid:6012308; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rhinomadeusainc.shop/index.php/campaigns/at92141hxec2a/web-version/ge292ktpn9b7f)"; flow:established,to_server; http.uri; content:"/index.php/campaigns/at92141hxec2a/web-version/ge292ktpn9b7f"; startswith; fast_pattern; http.host; content:"rhinomadeusainc.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012309; classtype:social-engineering; sid:6012309; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wordpress-1633540-6467189.cloudwaysapps.com/lt/ch/CSX/)"; flow:established,to_server; http.uri; content:"/lt/ch/CSX/"; startswith; fast_pattern; http.host; content:"wordpress-1633540-6467189.cloudwaysapps.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012310; classtype:social-engineering; sid:6012310; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqznwptl.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqznwptl.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012311; classtype:social-engineering; sid:6012311; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (marianne-docschiffre.leitungsen.de/mmssmaumaki/)"; flow:established,to_server; http.uri; content:"/mmssmaumaki/"; startswith; fast_pattern; http.host; content:"marianne-docschiffre.leitungsen.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012312; classtype:social-engineering; sid:6012312; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sanria40.github.io/Netflix-login-page-front-end-/)"; flow:established,to_server; http.uri; content:"/Netflix-login-page-front-end-/"; startswith; fast_pattern; http.host; content:"sanria40.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012313; classtype:social-engineering; sid:6012313; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kdrmxv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kdrmxv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012314; classtype:social-engineering; sid:6012314; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.yrlauz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.yrlauz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012315; classtype:social-engineering; sid:6012315; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.aoizrb.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.aoizrb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012316; classtype:social-engineering; sid:6012316; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqzlknwp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqzlknwp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012317; classtype:social-engineering; sid:6012317; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.top-top-rho.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.top-top-rho.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012318; classtype:social-engineering; sid:6012318; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qgrbxs.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qgrbxs.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012319; classtype:social-engineering; sid:6012319; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dbo8np67.fcxgzx.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dbo8np67.fcxgzx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012320; classtype:social-engineering; sid:6012320; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17054.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17054.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012321; classtype:social-engineering; sid:6012321; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rwenzoritechub.com/doublec/po/rabi/v76IP9F/bm9taW5hdGluZ2NvbW1p)"; flow:established,to_server; http.uri; content:"/doublec/po/rabi/v76IP9F/bm9taW5hdGluZ2NvbW1p"; startswith; fast_pattern; http.host; content:"rwenzoritechub.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012322; classtype:social-engineering; sid:6012322; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flips.abuit.info/?app_vl=ZYFwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=tomek%40elt.pl&sui=%7Bsui%7D&fn=Piotr&ln=Maliszewski&p=&z=PLNAMERAW-3005-IND1)"; flow:established,to_server; http.uri; content:"/?app_vl=ZYFwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=tomek%40elt.pl&sui=%7Bsui%7D&fn=Piotr&ln=Maliszewski&p=&z=PLNAMERAW-3005-IND1"; startswith; fast_pattern; http.host; content:"flips.abuit.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012323; classtype:social-engineering; sid:6012323; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ycgvpx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ycgvpx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012324; classtype:social-engineering; sid:6012324; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wdzxig.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wdzxig.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012325; classtype:social-engineering; sid:6012325; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreig5dqrnyeb7z4hoz3qqfkbfgtcppfxrafvarjmwisxplboureoesa.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreig5dqrnyeb7z4hoz3qqfkbfgtcppfxrafvarjmwisxplboureoesa.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012326; classtype:social-engineering; sid:6012326; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (peteradedokun1.github.io/netflix/)"; flow:established,to_server; http.uri; content:"/netflix/"; startswith; fast_pattern; http.host; content:"peteradedokun1.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012327; classtype:social-engineering; sid:6012327; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galabetguncel.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galabetguncel.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012328; classtype:social-engineering; sid:6012328; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ghtrack.help/gh)"; flow:established,to_server; http.uri; content:"/gh"; startswith; fast_pattern; http.host; content:"ghtrack.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012329; classtype:social-engineering; sid:6012329; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecoviasemfila.guiasindividuais.online/ecovias/?xp=)"; flow:established,to_server; http.uri; content:"/ecovias/?xp="; startswith; fast_pattern; http.host; content:"ecoviasemfila.guiasindividuais.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012330; classtype:social-engineering; sid:6012330; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gfdtgbjas.itsaol.com/rmb)"; flow:established,to_server; http.uri; content:"/rmb"; startswith; fast_pattern; http.host; content:"gfdtgbjas.itsaol.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012331; classtype:social-engineering; sid:6012331; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bxcwun.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bxcwun.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012332; classtype:social-engineering; sid:6012332; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (newseasonmaterials.web.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"newseasonmaterials.web.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012333; classtype:social-engineering; sid:6012333; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (falling-sea-cdd6.ceiltt0khkennedy42944.workers.dev/email-notification-meta-security-center)"; flow:established,to_server; http.uri; content:"/email-notification-meta-security-center"; startswith; fast_pattern; http.host; content:"falling-sea-cdd6.ceiltt0khkennedy42944.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012334; classtype:social-engineering; sid:6012334; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cq989737.tw1.ru/nqs/)"; flow:established,to_server; http.uri; content:"/nqs/"; startswith; fast_pattern; http.host; content:"cq989737.tw1.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012335; classtype:social-engineering; sid:6012335; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.orutwf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.orutwf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012336; classtype:social-engineering; sid:6012336; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vniswap-v3-interface.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vniswap-v3-interface.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012337; classtype:social-engineering; sid:6012337; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.89240.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.89240.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012338; classtype:social-engineering; sid:6012338; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tvpxky.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tvpxky.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012339; classtype:social-engineering; sid:6012339; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gfakcx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gfakcx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012340; classtype:social-engineering; sid:6012340; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (somesubhranayak.github.io/NETFLIX/)"; flow:established,to_server; http.uri; content:"/NETFLIX/"; startswith; fast_pattern; http.host; content:"somesubhranayak.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012341; classtype:social-engineering; sid:6012341; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.24ml.de/2q/)"; flow:established,to_server; http.uri; content:"/2q/"; startswith; fast_pattern; http.host; content:"www.24ml.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012342; classtype:social-engineering; sid:6012342; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clear-https-nrxwo2lofzzgc2lgmzsws43fnyxgg2a.proxy.gigablast.org/it?applicationId=ebanking)"; flow:established,to_server; http.uri; content:"/it?applicationId=ebanking"; startswith; fast_pattern; http.host; content:"clear-https-nrxwo2lofzzgc2lgmzsws43fnyxgg2a.proxy.gigablast.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012343; classtype:social-engineering; sid:6012343; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mlltop.com/content/boaml/en_us/home.html)"; flow:established,to_server; http.uri; content:"/content/boaml/en_us/home.html"; startswith; fast_pattern; http.host; content:"mlltop.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012344; classtype:social-engineering; sid:6012344; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pqkamj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pqkamj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012345; classtype:social-engineering; sid:6012345; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mdbuyk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mdbuyk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012346; classtype:social-engineering; sid:6012346; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lvgwdq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lvgwdq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012347; classtype:social-engineering; sid:6012347; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bet365k16.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bet365k16.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012348; classtype:social-engineering; sid:6012348; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-main.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-main.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012349; classtype:social-engineering; sid:6012349; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (148624343.hs-sites-eu1.com/it/)"; flow:established,to_server; http.uri; content:"/it/"; startswith; fast_pattern; http.host; content:"148624343.hs-sites-eu1.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012350; classtype:social-engineering; sid:6012350; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kf.ognnwn.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kf.ognnwn.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012351; classtype:social-engineering; sid:6012351; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingek.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingek.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012352; classtype:social-engineering; sid:6012352; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xghjc.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xghjc.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012353; classtype:social-engineering; sid:6012353; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-leger-us.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-leger-us.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012354; classtype:social-engineering; sid:6012354; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webauto.sk/js/body.html)"; flow:established,to_server; http.uri; content:"/js/body.html"; startswith; fast_pattern; http.host; content:"webauto.sk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012355; classtype:social-engineering; sid:6012355; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.yeplfz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.yeplfz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012356; classtype:social-engineering; sid:6012356; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mt-swift.com-ustf.us/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mt-swift.com-ustf.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012357; classtype:social-engineering; sid:6012357; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hgqdet.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hgqdet.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012358; classtype:social-engineering; sid:6012358; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hwspuy.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hwspuy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012359; classtype:social-engineering; sid:6012359; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hostmyclaudehtml.com/p/QU_im40Uxk)"; flow:established,to_server; http.uri; content:"/p/QU_im40Uxk"; startswith; fast_pattern; http.host; content:"hostmyclaudehtml.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012360; classtype:social-engineering; sid:6012360; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nysclj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nysclj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012361; classtype:social-engineering; sid:6012361; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tonkotsutaro.info/41-1511-280526/?u=161C1515&e=test%2540example.com&s3=&s4=&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/41-1511-280526/?u=161C1515&e=test%2540example.com&s3=&s4=&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"tonkotsutaro.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012362; classtype:social-engineering; sid:6012362; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vrolor-biz-glurnik-slatem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vrolor-biz-glurnik-slatem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012363; classtype:social-engineering; sid:6012363; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiciaij2qznniztu7ofqnyoatv7tuuonnqbdm3v76jiqz3x2jhifka.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiciaij2qznniztu7ofqnyoatv7tuuonnqbdm3v76jiqz3x2jhifka.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012364; classtype:social-engineering; sid:6012364; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ldgrinyhgj.azalea1.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ldgrinyhgj.azalea1.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012365; classtype:social-engineering; sid:6012365; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.spotify-client-beta.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.spotify-client-beta.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012366; classtype:social-engineering; sid:6012366; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.monterres.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.monterres.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012367; classtype:social-engineering; sid:6012367; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.84123.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.84123.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012368; classtype:social-engineering; sid:6012368; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rhfupq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rhfupq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012369; classtype:social-engineering; sid:6012369; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgersupport-uk.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledgersupport-uk.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012370; classtype:social-engineering; sid:6012370; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fotra-sentra-biz-lomra-dokfi-sp19ct3mur.pages.dev/*)"; flow:established,to_server; http.uri; content:"/*"; startswith; fast_pattern; http.host; content:"fotra-sentra-biz-lomra-dokfi-sp19ct3mur.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012371; classtype:social-engineering; sid:6012371; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hdiruy.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.hdiruy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012372; classtype:social-engineering; sid:6012372; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeesale1010.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopeesale1010.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012373; classtype:social-engineering; sid:6012373; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (theatre.binaryinfohub.info/?app_vl=ZYFwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=user@example.com&sui=%7Bsui%7D&fn=&ln=&p=&z=PLNAMERAW-0106-digi9)"; flow:established,to_server; http.uri; content:"/?app_vl=ZYFwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=user@example.com&sui=%7Bsui%7D&fn=&ln=&p=&z=PLNAMERAW-0106-digi9"; startswith; fast_pattern; http.host; content:"theatre.binaryinfohub.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012374; classtype:social-engineering; sid:6012374; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dbo8np67.fcxgzx.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.dbo8np67.fcxgzx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012375; classtype:social-engineering; sid:6012375; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.sfrgmu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.sfrgmu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012376; classtype:social-engineering; sid:6012376; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ujpkfi.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ujpkfi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012377; classtype:social-engineering; sid:6012377; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (palakjha3004-ux.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"palakjha3004-ux.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012378; classtype:social-engineering; sid:6012378; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fcxgzx.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fcxgzx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012379; classtype:social-engineering; sid:6012379; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bunicretares.it.com/biromatas.php)"; flow:established,to_server; http.uri; content:"/biromatas.php"; startswith; fast_pattern; http.host; content:"bunicretares.it.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012380; classtype:social-engineering; sid:6012380; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.squjwr.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.squjwr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012381; classtype:social-engineering; sid:6012381; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.eqfpgt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.eqfpgt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012382; classtype:social-engineering; sid:6012382; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tezjda.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tezjda.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012383; classtype:social-engineering; sid:6012383; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bycp16.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bycp16.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012384; classtype:social-engineering; sid:6012384; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3659o.win/lottery.html)"; flow:established,to_server; http.uri; content:"/lottery.html"; startswith; fast_pattern; http.host; content:"3659o.win"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012385; classtype:social-engineering; sid:6012385; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (platforms.markusscholz.info/ga/click/2-6761812-10-8903-17422-9574-49708d3a5d-195e42334e)"; flow:established,to_server; http.uri; content:"/ga/click/2-6761812-10-8903-17422-9574-49708d3a5d-195e42334e"; startswith; fast_pattern; http.host; content:"platforms.markusscholz.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012386; classtype:social-engineering; sid:6012386; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store.workshopcommunityweb.com/sharedfiles/filesdetails/id=35225482505/)"; flow:established,to_server; http.uri; content:"/sharedfiles/filesdetails/id=35225482505/"; startswith; fast_pattern; http.host; content:"store.workshopcommunityweb.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012387; classtype:social-engineering; sid:6012387; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-trurnor-biz-qurnex-fraltem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-trurnor-biz-qurnex-fraltem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012388; classtype:social-engineering; sid:6012388; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.uvv.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.uvv.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012389; classtype:social-engineering; sid:6012389; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vjigbn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vjigbn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012390; classtype:social-engineering; sid:6012390; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.uyqtsm.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.uyqtsm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012391; classtype:social-engineering; sid:6012391; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ghtrack.buzz/gh)"; flow:established,to_server; http.uri; content:"/gh"; startswith; fast_pattern; http.host; content:"ghtrack.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012392; classtype:social-engineering; sid:6012392; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreidapp6cd2dymyd7jbl7xwpiqrdg77ldysyqrkzumqctmrvnldfjbq.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreidapp6cd2dymyd7jbl7xwpiqrdg77ldysyqrkzumqctmrvnldfjbq.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012393; classtype:social-engineering; sid:6012393; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fcs-gapxr.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fcs-gapxr.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012394; classtype:social-engineering; sid:6012394; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.stainedconcretefloorsbymichael.com/44dewp/bkd/)"; flow:established,to_server; http.uri; content:"/44dewp/bkd/"; startswith; fast_pattern; http.host; content:"www.stainedconcretefloorsbymichael.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012395; classtype:social-engineering; sid:6012395; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365okvip9.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.365okvip9.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012396; classtype:social-engineering; sid:6012396; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (combscustoms.com/instert/login.in/)"; flow:established,to_server; http.uri; content:"/instert/login.in/"; startswith; fast_pattern; http.host; content:"combscustoms.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012397; classtype:social-engineering; sid:6012397; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nljawh.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nljawh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012398; classtype:social-engineering; sid:6012398; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fritzhost-001-site1.site4future.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fritzhost-001-site1.site4future.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012399; classtype:social-engineering; sid:6012399; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gopay-help.official-ind0nesia-help.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gopay-help.official-ind0nesia-help.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012400; classtype:social-engineering; sid:6012400; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreihmdhypsmoquydwxxl6takzwne63rldqiphkgcmtztfvpx3yzmfpq.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreihmdhypsmoquydwxxl6takzwne63rldqiphkgcmtztfvpx3yzmfpq.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012401; classtype:social-engineering; sid:6012401; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agri-mobile4.bolt.host/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"agri-mobile4.bolt.host"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012402; classtype:social-engineering; sid:6012402; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atjimhaweralhwaaste40d3d.myclickfunnels.com/ficeally)"; flow:established,to_server; http.uri; content:"/ficeally"; startswith; fast_pattern; http.host; content:"atjimhaweralhwaaste40d3d.myclickfunnels.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012403; classtype:social-engineering; sid:6012403; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agri-mobile4.bolt.host/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"agri-mobile4.bolt.host"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012404; classtype:social-engineering; sid:6012404; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rodovias-dr9.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rodovias-dr9.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012405; classtype:social-engineering; sid:6012405; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faf-cuni-cz.bdpf-pf.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"faf-cuni-cz.bdpf-pf.online"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012406; classtype:social-engineering; sid:6012406; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wearebio.com/.well-known/-/.dihhd/)"; flow:established,to_server; http.uri; content:"/.well-known/-/.dihhd/"; startswith; fast_pattern; http.host; content:"wearebio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012407; classtype:social-engineering; sid:6012407; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smbc-support.claricezhao.com/newsinvestor-jp)"; flow:established,to_server; http.uri; content:"/newsinvestor-jp"; startswith; fast_pattern; http.host; content:"smbc-support.claricezhao.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012408; classtype:social-engineering; sid:6012408; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (psychiatria-kalisz.pl/wp-content/languages/DKB_new/loading_1.php)"; flow:established,to_server; http.uri; content:"/wp-content/languages/DKB_new/loading_1.php"; startswith; fast_pattern; http.host; content:"psychiatria-kalisz.pl"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012409; classtype:social-engineering; sid:6012409; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chatgpt.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"chatgpt.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012410; classtype:social-engineering; sid:6012410; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ajustarnovastaxas.uk/?LY3gZd98O9bJ3ZVGiT6g)"; flow:established,to_server; http.uri; content:"/?LY3gZd98O9bJ3ZVGiT6g"; startswith; fast_pattern; http.host; content:"ajustarnovastaxas.uk"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012411; classtype:social-engineering; sid:6012411; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (idxbillings-567804.com/it-26/)"; flow:established,to_server; http.uri; content:"/it-26/"; startswith; fast_pattern; http.host; content:"idxbillings-567804.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012412; classtype:social-engineering; sid:6012412; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (information-ameli.help/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"information-ameli.help"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012413; classtype:social-engineering; sid:6012413; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bnc.ondemand-cityspay.com/bnc/en/public/index.php)"; flow:established,to_server; http.uri; content:"/bnc/en/public/index.php"; startswith; fast_pattern; http.host; content:"bnc.ondemand-cityspay.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012414; classtype:social-engineering; sid:6012414; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docusign-electronicsignature.remote-otp.com/ID74591NF/html/ap0785185?rid=oFMAfF5)"; flow:established,to_server; http.uri; content:"/ID74591NF/html/ap0785185?rid=oFMAfF5"; startswith; fast_pattern; http.host; content:"docusign-electronicsignature.remote-otp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012415; classtype:social-engineering; sid:6012415; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wetransfer-shares-documents-of-hzb.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wetransfer-shares-documents-of-hzb.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012416; classtype:social-engineering; sid:6012416; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pahdidj.one/gh)"; flow:established,to_server; http.uri; content:"/gh"; startswith; fast_pattern; http.host; content:"pahdidj.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012417; classtype:social-engineering; sid:6012417; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (santander.atualizacao-seguranca.com/baser/)"; flow:established,to_server; http.uri; content:"/baser/"; startswith; fast_pattern; http.host; content:"santander.atualizacao-seguranca.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012418; classtype:social-engineering; sid:6012418; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kqnlpwrt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kqnlpwrt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012419; classtype:social-engineering; sid:6012419; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopeeid152.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopeeid152.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012420; classtype:social-engineering; sid:6012420; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiclx2rtmk2k77tsbghnjtvuk3tio7rsh6douxrekuvo4hkmogx7uy.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiclx2rtmk2k77tsbghnjtvuk3tio7rsh6douxrekuvo4hkmogx7uy.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012421; classtype:social-engineering; sid:6012421; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (awsapprunner-s0uth0dnscom-dp6hagq0og1y.edgeone.dev/webindex.html)"; flow:established,to_server; http.uri; content:"/webindex.html"; startswith; fast_pattern; http.host; content:"awsapprunner-s0uth0dnscom-dp6hagq0og1y.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012422; classtype:social-engineering; sid:6012422; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (perfilseleto.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"perfilseleto.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012423; classtype:social-engineering; sid:6012423; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.klxqmrvp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.klxqmrvp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012424; classtype:social-engineering; sid:6012424; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (158-158-8-83.cprapid.com/de/update.php?bnfv9ys33x7oz6zhe9ck)"; flow:established,to_server; http.uri; content:"/de/update.php?bnfv9ys33x7oz6zhe9ck"; startswith; fast_pattern; http.host; content:"158-158-8-83.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012425; classtype:social-engineering; sid:6012425; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hsyflq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hsyflq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012426; classtype:social-engineering; sid:6012426; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ntombifuthi-mashinini.github.io/Neflix-Landing-Page/)"; flow:established,to_server; http.uri; content:"/Neflix-Landing-Page/"; startswith; fast_pattern; http.host; content:"ntombifuthi-mashinini.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012427; classtype:social-engineering; sid:6012427; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mqtrvpkx.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mqtrvpkx.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012428; classtype:social-engineering; sid:6012428; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lnstagramchecker.github.io/AccCheck/)"; flow:established,to_server; http.uri; content:"/AccCheck/"; startswith; fast_pattern; http.host; content:"lnstagramchecker.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012429; classtype:social-engineering; sid:6012429; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (quitarbloqueocuenta.iceiy.com/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"quitarbloqueocuenta.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012430; classtype:social-engineering; sid:6012430; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (track.globaltracklabs.com/3d84a4ea-5516-4d68-a723-8d3512e364e6)"; flow:established,to_server; http.uri; content:"/3d84a4ea-5516-4d68-a723-8d3512e364e6"; startswith; fast_pattern; http.host; content:"track.globaltracklabs.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012431; classtype:social-engineering; sid:6012431; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoja64.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoja64.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012432; classtype:social-engineering; sid:6012432; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.santander.atualizacao-seguranca.com/baser)"; flow:established,to_server; http.uri; content:"/baser"; startswith; fast_pattern; http.host; content:"www.santander.atualizacao-seguranca.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012433; classtype:social-engineering; sid:6012433; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abdel505-001-site1.ltempurl.com/swsscom/Login.php?57ff375152bfdd9ea1093e2ce512bd3b)"; flow:established,to_server; http.uri; content:"/swsscom/Login.php?57ff375152bfdd9ea1093e2ce512bd3b"; startswith; fast_pattern; http.host; content:"abdel505-001-site1.ltempurl.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012434; classtype:social-engineering; sid:6012434; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.35391986365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.35391986365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012435; classtype:social-engineering; sid:6012435; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xc-amazon.com/ap/us/en/Login.php)"; flow:established,to_server; http.uri; content:"/ap/us/en/Login.php"; startswith; fast_pattern; http.host; content:"www.xc-amazon.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012436; classtype:social-engineering; sid:6012436; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (x8pshdpfonzje43.s3-website-us-east-1.amazonaws.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"x8pshdpfonzje43.s3-website-us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012437; classtype:social-engineering; sid:6012437; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bradesco.atualizacao-seguranca.com/login.php?hash=6912088696a299f9f7c83e7.19404289)"; flow:established,to_server; http.uri; content:"/login.php?hash=6912088696a299f9f7c83e7.19404289"; startswith; fast_pattern; http.host; content:"bradesco.atualizacao-seguranca.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012438; classtype:social-engineering; sid:6012438; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ushiejohn29-boop.github.io/on)"; flow:established,to_server; http.uri; content:"/on"; startswith; fast_pattern; http.host; content:"ushiejohn29-boop.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012439; classtype:social-engineering; sid:6012439; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6a018e4588b9f91c8adf0a0b--velvety-churros-49cd43.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6a018e4588b9f91c8adf0a0b--velvety-churros-49cd43.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012440; classtype:social-engineering; sid:6012440; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atjimhaweralhwaaste40d3d.myclickfunnels.com/bolsappa)"; flow:established,to_server; http.uri; content:"/bolsappa"; startswith; fast_pattern; http.host; content:"atjimhaweralhwaaste40d3d.myclickfunnels.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012441; classtype:social-engineering; sid:6012441; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chrjtm.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"chrjtm.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012442; classtype:social-engineering; sid:6012442; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-slavnik-biz-vroltex-glamtor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-slavnik-biz-vroltex-glamtor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012443; classtype:social-engineering; sid:6012443; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (supersetapp.mystagingwebsite.com/wp-content/plugins/creative/public/index.php)"; flow:established,to_server; http.uri; content:"/wp-content/plugins/creative/public/index.php"; startswith; fast_pattern; http.host; content:"supersetapp.mystagingwebsite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012444; classtype:social-engineering; sid:6012444; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (santander.atualizacao-seguranca.com/inicio/)"; flow:established,to_server; http.uri; content:"/inicio/"; startswith; fast_pattern; http.host; content:"santander.atualizacao-seguranca.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012445; classtype:social-engineering; sid:6012445; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (domain-nb.com/BELnGRvuQSlHrcl4AdZquKveqKzxiwY3hPMsRQYcUPF/C0KdWTmucJytlOciVBvrZzTLGM52idy71hDfN19+fM/k4WEpkDlLbLysQZWK3%20VmukvRlJiggTJtn4IM1Q/)"; flow:established,to_server; http.uri; content:"/BELnGRvuQSlHrcl4AdZquKveqKzxiwY3hPMsRQYcUPF/C0KdWTmucJytlOciVBvrZzTLGM52idy71hDfN19+fM/k4WEpkDlLbLysQZWK3%20VmukvRlJiggTJtn4IM1Q/"; startswith; fast_pattern; http.host; content:"domain-nb.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012446; classtype:social-engineering; sid:6012446; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (new-recovery.info-meta-noreply.com/pemulihan/code.php)"; flow:established,to_server; http.uri; content:"/pemulihan/code.php"; startswith; fast_pattern; http.host; content:"new-recovery.info-meta-noreply.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012447; classtype:social-engineering; sid:6012447; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.myfidelitysite.com/Deborah/deborah-heart---lung-center/13623)"; flow:established,to_server; http.uri; content:"/Deborah/deborah-heart---lung-center/13623"; startswith; fast_pattern; http.host; content:"www.myfidelitysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012448; classtype:social-engineering; sid:6012448; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suncoastcreditunion.at/login.php)"; flow:established,to_server; http.uri; content:"/login.php"; startswith; fast_pattern; http.host; content:"suncoastcreditunion.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012449; classtype:social-engineering; sid:6012449; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (teams.cloud-server.net.in/app/9TSMAH5wbCutuBSaCrMqQB)"; flow:established,to_server; http.uri; content:"/app/9TSMAH5wbCutuBSaCrMqQB"; startswith; fast_pattern; http.host; content:"teams.cloud-server.net.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012450; classtype:social-engineering; sid:6012450; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (noble-crimson-je1qnkwv.edgeone.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"noble-crimson-je1qnkwv.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012451; classtype:social-engineering; sid:6012451; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (n44yg.app.link/hPm3PAV4O3b)"; flow:established,to_server; http.uri; content:"/hPm3PAV4O3b"; startswith; fast_pattern; http.host; content:"n44yg.app.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012452; classtype:social-engineering; sid:6012452; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloudoficial.com/cMKqu/)"; flow:established,to_server; http.uri; content:"/cMKqu/"; startswith; fast_pattern; http.host; content:"icloudoficial.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012453; classtype:social-engineering; sid:6012453; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (engagement-v3.mektor.eu/?auth2=ARFiHrqpCW9rM1XqEaXGJvSjjjr7trfS)"; flow:established,to_server; http.uri; content:"/?auth2=ARFiHrqpCW9rM1XqEaXGJvSjjjr7trfS"; startswith; fast_pattern; http.host; content:"engagement-v3.mektor.eu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012454; classtype:social-engineering; sid:6012454; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (x.gd/Lafaj)"; flow:established,to_server; http.uri; content:"/Lafaj"; startswith; fast_pattern; http.host; content:"x.gd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012455; classtype:social-engineering; sid:6012455; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (umusidiz.myhostpoint.ch/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"umusidiz.myhostpoint.ch"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012456; classtype:social-engineering; sid:6012456; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-d68525cbc6144dcaaac2fc0354aa17dd.r2.dev/New-DocusignRedir2.html)"; flow:established,to_server; http.uri; content:"/New-DocusignRedir2.html"; startswith; fast_pattern; http.host; content:"pub-d68525cbc6144dcaaac2fc0354aa17dd.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012457; classtype:social-engineering; sid:6012457; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8868v8.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8868v8.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012458; classtype:social-engineering; sid:6012458; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.gala-girisler.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.gala-girisler.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012459; classtype:social-engineering; sid:6012459; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (compact-tan-u27htcil.edgeone.app/?%24web_only=true&_branch_match_id=1593106289862315862&_branch_referrer=H4sIAAAAAAAAA8soKSkottLXzzMxqUzXSywo0MvJzMvWzwjINQ5wDDPxN06yrytKTUstKsrMS49PKsovL04tsnXOKMrPTQUANQ56qjwAAAA%3D)"; flow:established,to_server; http.uri; content:"/?%24web_only=true&_branch_match_id=1593106289862315862&_branch_referrer=H4sIAAAAAAAAA8soKSkottLXzzMxqUzXSywo0MvJzMvWzwjINQ5wDDPxN06yrytKTUstKsrMS49PKsovL04tsnXOKMrPTQUANQ56qjwAAAA%3D"; startswith; fast_pattern; http.host; content:"compact-tan-u27htcil.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012460; classtype:social-engineering; sid:6012460; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rnicrosoft-support.human-resources.services/i/a67010b9a3b8c49f89eca04a28761a129)"; flow:established,to_server; http.uri; content:"/i/a67010b9a3b8c49f89eca04a28761a129"; startswith; fast_pattern; http.host; content:"rnicrosoft-support.human-resources.services"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012461; classtype:social-engineering; sid:6012461; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t9jz-rz7w-mzfi.rsadler.workers.dev/885c4c3684518ddc?email=delexhub@74749dcf9f33ccdf898fcfc7af671045b691.net)"; flow:established,to_server; http.uri; content:"/885c4c3684518ddc?email=delexhub@74749dcf9f33ccdf898fcfc7af671045b691.net"; startswith; fast_pattern; http.host; content:"t9jz-rz7w-mzfi.rsadler.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012462; classtype:social-engineering; sid:6012462; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wilsonhousecamden.hostel.town/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wilsonhousecamden.hostel.town"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012463; classtype:social-engineering; sid:6012463; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kdzuwiojef.yoga/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kdzuwiojef.yoga"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012464; classtype:social-engineering; sid:6012464; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cpgtestwebapp.azurewebsites.net/wizard/start_submit)"; flow:established,to_server; http.uri; content:"/wizard/start_submit"; startswith; fast_pattern; http.host; content:"cpgtestwebapp.azurewebsites.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012465; classtype:social-engineering; sid:6012465; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cerberrtecrossmein.wasmer.app/checkout)"; flow:established,to_server; http.uri; content:"/checkout"; startswith; fast_pattern; http.host; content:"cerberrtecrossmein.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012466; classtype:social-engineering; sid:6012466; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sharedfiles.slatestructural.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sharedfiles.slatestructural.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012467; classtype:social-engineering; sid:6012467; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wearebio.com/.well-known/acme-challenge/-/.osjsd/)"; flow:established,to_server; http.uri; content:"/.well-known/acme-challenge/-/.osjsd/"; startswith; fast_pattern; http.host; content:"wearebio.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012468; classtype:social-engineering; sid:6012468; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (daanaiindonesiia.mll.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"daanaiindonesiia.mll.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012469; classtype:social-engineering; sid:6012469; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (onedriveronedriveo.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"onedriveronedriveo.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012470; classtype:social-engineering; sid:6012470; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.enjscaffolding.co.uk/82F67135F75D00A/index.html)"; flow:established,to_server; http.uri; content:"/82F67135F75D00A/index.html"; startswith; fast_pattern; http.host; content:"www.enjscaffolding.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012471; classtype:social-engineering; sid:6012471; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.lmvxtrpq.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.lmvxtrpq.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012472; classtype:social-engineering; sid:6012472; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cautious-garbanzo-eight.vercel.app/mdatubinesocom2083.html)"; flow:established,to_server; http.uri; content:"/mdatubinesocom2083.html"; startswith; fast_pattern; http.host; content:"cautious-garbanzo-eight.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012473; classtype:social-engineering; sid:6012473; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (knowledgeable.edu.sa/profil/?id=lastupdate2026n3e05d)"; flow:established,to_server; http.uri; content:"/profil/?id=lastupdate2026n3e05d"; startswith; fast_pattern; http.host; content:"knowledgeable.edu.sa"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012474; classtype:social-engineering; sid:6012474; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hotelproorlandotrial-whatsapp.herokuapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hotelproorlandotrial-whatsapp.herokuapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012475; classtype:social-engineering; sid:6012475; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.progran-shopee14.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.progran-shopee14.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012476; classtype:social-engineering; sid:6012476; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.program-resmi189.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.program-resmi189.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012477; classtype:social-engineering; sid:6012477; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.santander.atualizacao-seguranca.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.santander.atualizacao-seguranca.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012478; classtype:social-engineering; sid:6012478; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.assettradeinc.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.assettradeinc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012479; classtype:social-engineering; sid:6012479; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suncoastcreditunion.at/checking-accounts.php)"; flow:established,to_server; http.uri; content:"/checking-accounts.php"; startswith; fast_pattern; http.host; content:"suncoastcreditunion.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012480; classtype:social-engineering; sid:6012480; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.txqmrlaq.cfd/com/#/index)"; flow:established,to_server; http.uri; content:"/com/#/index"; startswith; fast_pattern; http.host; content:"dpd.txqmrlaq.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012481; classtype:social-engineering; sid:6012481; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.js92266.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.js92266.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012482; classtype:social-engineering; sid:6012482; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.sun792.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.sun792.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012483; classtype:social-engineering; sid:6012483; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreifuiu3tudoctwygusc7lktugtwmwhfh7uqn2xafijbcgvbtknc5tu.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreifuiu3tudoctwygusc7lktugtwmwhfh7uqn2xafijbcgvbtknc5tu.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012484; classtype:social-engineering; sid:6012484; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (piedrasdecolon.com.ar/docusign/DAM_Trade_Group_May-Contract.pdf)"; flow:established,to_server; http.uri; content:"/docusign/DAM_Trade_Group_May-Contract.pdf"; startswith; fast_pattern; http.host; content:"piedrasdecolon.com.ar"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012485; classtype:social-engineering; sid:6012485; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go.sparkpostmail1.com/f/a/3Mk15eaYdJlYKOgUjaHb5Q~~/AAW0yBA~/PSrbl-_NOQq9JJ9opDznwHLvqvcu6CJCkR8XfcIrYIG97QuV4CG67OhbZH6gUA4C1CT6Qwhtd4aQ_A4wyAwObDTqTiddKQE2Pa1BclMS8yJ0aE0g_f8piI0CTzVheqP2zKc8wAmynD75_JKWLwNLkKldpipJOTY085LlldBI5XVbD77CMyqq_cAEIklTv9cXV-Q3rnizn6fVGfOVXwLcYjtIyVMiAxtybKJUGQBuT5w~)"; flow:established,to_server; http.uri; content:"/f/a/3Mk15eaYdJlYKOgUjaHb5Q~~/AAW0yBA~/PSrbl-_NOQq9JJ9opDznwHLvqvcu6CJCkR8XfcIrYIG97QuV4CG67OhbZH6gUA4C1CT6Qwhtd4aQ_A4wyAwObDTqTiddKQE2Pa1BclMS8yJ0aE0g_f8piI0CTzVheqP2zKc8wAmynD75_JKWLwNLkKldpipJOTY085LlldBI5XVbD77CMyqq_cAEIklTv9cXV-Q3rnizn6fVGfOVXwLcYjtIyVMiAxtybKJUGQBuT5w~"; startswith; fast_pattern; http.host; content:"go.sparkpostmail1.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012486; classtype:social-engineering; sid:6012486; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.n-project-2025-netflix.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.n-project-2025-netflix.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012487; classtype:social-engineering; sid:6012487; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inicio-sesionverifimail829.zya.me/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"inicio-sesionverifimail829.zya.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012488; classtype:social-engineering; sid:6012488; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafybeiemb5z6so2dakuqswuqwoaoci3ifrulyygkdpoexmtv63lu4qrhai.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafybeiemb5z6so2dakuqswuqwoaoci3ifrulyygkdpoexmtv63lu4qrhai.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012489; classtype:social-engineering; sid:6012489; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook.mumbaiairlines.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook.mumbaiairlines.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012490; classtype:social-engineering; sid:6012490; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3capjiecp3qtjcx.s3-website-us-east-1.amazonaws.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3capjiecp3qtjcx.s3-website-us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012491; classtype:social-engineering; sid:6012491; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sporternaehrung-lambertz.de/jtl.php)"; flow:established,to_server; http.uri; content:"/jtl.php"; startswith; fast_pattern; http.host; content:"www.sporternaehrung-lambertz.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012492; classtype:social-engineering; sid:6012492; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (binancelivetrade.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"binancelivetrade.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012493; classtype:social-engineering; sid:6012493; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bussiness-center.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bussiness-center.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012494; classtype:social-engineering; sid:6012494; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suncoastcreditunion.at/online-banking.php)"; flow:established,to_server; http.uri; content:"/online-banking.php"; startswith; fast_pattern; http.host; content:"suncoastcreditunion.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012495; classtype:social-engineering; sid:6012495; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jwrzqxlp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jwrzqxlp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012496; classtype:social-engineering; sid:6012496; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hasolanalsa.co/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hasolanalsa.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012497; classtype:social-engineering; sid:6012497; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dbsbanklfc2025.com/?entity=31321)"; flow:established,to_server; http.uri; content:"/?entity=31321"; startswith; fast_pattern; http.host; content:"dbsbanklfc2025.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012498; classtype:social-engineering; sid:6012498; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hosxtk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hosxtk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012499; classtype:social-engineering; sid:6012499; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-acco.github.io/insta/)"; flow:established,to_server; http.uri; content:"/insta/"; startswith; fast_pattern; http.host; content:"account-acco.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012500; classtype:social-engineering; sid:6012500; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ushiejohn29-boop.github.io/an)"; flow:established,to_server; http.uri; content:"/an"; startswith; fast_pattern; http.host; content:"ushiejohn29-boop.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012501; classtype:social-engineering; sid:6012501; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bdlimon063-creator.github.io/facebook.com/)"; flow:established,to_server; http.uri; content:"/facebook.com/"; startswith; fast_pattern; http.host; content:"bdlimon063-creator.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012502; classtype:social-engineering; sid:6012502; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wang1-hhg8cfabceg7c4b6.z02.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wang1-hhg8cfabceg7c4b6.z02.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012503; classtype:social-engineering; sid:6012503; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nab.438825.cc/au/rewards/)"; flow:established,to_server; http.uri; content:"/au/rewards/"; startswith; fast_pattern; http.host; content:"nab.438825.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012504; classtype:social-engineering; sid:6012504; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myubs.ch-account.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"myubs.ch-account.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012505; classtype:social-engineering; sid:6012505; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jxtrmpqv.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jxtrmpqv.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012506; classtype:social-engineering; sid:6012506; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hostingoo.sviluppo.host/ss/)"; flow:established,to_server; http.uri; content:"/ss/"; startswith; fast_pattern; http.host; content:"hostingoo.sviluppo.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012507; classtype:social-engineering; sid:6012507; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.84899286365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.84899286365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012508; classtype:social-engineering; sid:6012508; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sabapar22.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"sabapar22.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012509; classtype:social-engineering; sid:6012509; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (track-ghk.help/gh)"; flow:established,to_server; http.uri; content:"/gh"; startswith; fast_pattern; http.host; content:"track-ghk.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012510; classtype:social-engineering; sid:6012510; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1nstagra.mooo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1nstagra.mooo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012511; classtype:social-engineering; sid:6012511; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (by8662.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"by8662.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012512; classtype:social-engineering; sid:6012512; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook.mumbaiairlines.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook.mumbaiairlines.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012513; classtype:social-engineering; sid:6012513; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jzlwqntv.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jzlwqntv.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012514; classtype:social-engineering; sid:6012514; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pwtvkh.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pwtvkh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012515; classtype:social-engineering; sid:6012515; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (virgowebadobelogin-en.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"virgowebadobelogin-en.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012516; classtype:social-engineering; sid:6012516; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-pi-nine.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-pi-nine.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012517; classtype:social-engineering; sid:6012517; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.luagwq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.luagwq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012518; classtype:social-engineering; sid:6012518; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flirt-contacts.com/views/fb.php?lang=us&set=s2&domain=track.globaltracklabs.com&cep=TXrR0Fwoh-40RgZHMH8FEY5dqaICu2c47bG9mZhbgYdvw0LrP4tSOtFj7n0UJh9wLFHtK2HAt5hc6z8dya9mjn_HRoMOOYwfEf8Ut-nNhzGepjATSLlpBBNn9proUkRug9N-4ZCF1gEKjGhUi2wM7E34UAoNQx-zsqRfPzeb40_0WrBC6ew0C0vcn-EjFM34RGe6fFsWqaBqaftbUnxlHCezpg4-VWX_aOTs01OCAtQqPyOJac-hXlBzaFmucsvU2l7YtTclDWul9K0x1mKF-ToKdAHYEo3fTJfmeyqDNooEe9yL2kGrpvzQf0wtrih30Un2ZNlnibQTDGjKe0lXIcZXv9Ns1UcVzWY0Tp1yHK9YLI9ajrM4vrMlB7Cw1OXL&lptoken=17a1818506d5432a04dc)"; flow:established,to_server; http.uri; content:"/views/fb.php?lang=us&set=s2&domain=track.globaltracklabs.com&cep=TXrR0Fwoh-40RgZHMH8FEY5dqaICu2c47bG9mZhbgYdvw0LrP4tSOtFj7n0UJh9wLFHtK2HAt5hc6z8dya9mjn_HRoMOOYwfEf8Ut-nNhzGepjATSLlpBBNn9proUkRug9N-4ZCF1gEKjGhUi2wM7E34UAoNQx-zsqRfPzeb40_0WrBC6ew0C0vcn-EjFM34RGe6fFsWqaBqaftbUnxlHCezpg4-VWX_aOTs01OCAtQqPyOJac-hXlBzaFmucsvU2l7YtTclDWul9K0x1mKF-ToKdAHYEo3fTJfmeyqDNooEe9yL2kGrpvzQf0wtrih30Un2ZNlnibQTDGjKe0lXIcZXv9Ns1UcVzWY0Tp1yHK9YLI9ajrM4vrMlB7Cw1OXL&lptoken=17a1818506d5432a04dc"; startswith; fast_pattern; http.host; content:"flirt-contacts.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012519; classtype:social-engineering; sid:6012519; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (krishnanishad05.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"krishnanishad05.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012520; classtype:social-engineering; sid:6012520; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bunkbrisbane.hostel.town/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bunkbrisbane.hostel.town"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012521; classtype:social-engineering; sid:6012521; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zhalfd.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zhalfd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012522; classtype:social-engineering; sid:6012522; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.myfidelitysite.com/Deborah)"; flow:established,to_server; http.uri; content:"/Deborah"; startswith; fast_pattern; http.host; content:"www.myfidelitysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012523; classtype:social-engineering; sid:6012523; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bdi-mfghs.wasmer.app/eaglerefining)"; flow:established,to_server; http.uri; content:"/eaglerefining"; startswith; fast_pattern; http.host; content:"bdi-mfghs.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012524; classtype:social-engineering; sid:6012524; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verificar-s3guromxx.zya.me/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"verificar-s3guromxx.zya.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012525; classtype:social-engineering; sid:6012525; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sporternaehrung-lambertz.de/jtl.php?JTLSHOP=0taj5ff02cdbejd4mh4mgpiqd4)"; flow:established,to_server; http.uri; content:"/jtl.php?JTLSHOP=0taj5ff02cdbejd4mh4mgpiqd4"; startswith; fast_pattern; http.host; content:"www.sporternaehrung-lambertz.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012526; classtype:social-engineering; sid:6012526; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeeid152.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopeeid152.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012527; classtype:social-engineering; sid:6012527; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-clone-teal-iota.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-teal-iota.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012528; classtype:social-engineering; sid:6012528; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iniciosociedad.solanaplopcoin.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"iniciosociedad.solanaplopcoin.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012529; classtype:social-engineering; sid:6012529; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (creatinginfinity.github.io/Mini-Airbnb)"; flow:established,to_server; http.uri; content:"/Mini-Airbnb"; startswith; fast_pattern; http.host; content:"creatinginfinity.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012530; classtype:social-engineering; sid:6012530; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loandinvaliti.fwh.is/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"loandinvaliti.fwh.is"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012531; classtype:social-engineering; sid:6012531; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mitha-imascko-llgin.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mitha-imascko-llgin.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012532; classtype:social-engineering; sid:6012532; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rd8x6w8uco7mjx9.s3-website-us-east-1.amazonaws.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rd8x6w8uco7mjx9.s3-website-us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012533; classtype:social-engineering; sid:6012533; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (att03899.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"att03899.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012534; classtype:social-engineering; sid:6012534; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (teams.cloud-server.net.in/app/yxR9h6Lhgu3UTEE4SLMW4L)"; flow:established,to_server; http.uri; content:"/app/yxR9h6Lhgu3UTEE4SLMW4L"; startswith; fast_pattern; http.host; content:"teams.cloud-server.net.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012535; classtype:social-engineering; sid:6012535; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (office-docusign-net.tammy-e82.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"office-docusign-net.tammy-e82.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012536; classtype:social-engineering; sid:6012536; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (progran-shopee14.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"progran-shopee14.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012537; classtype:social-engineering; sid:6012537; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my-netflix-clone-nine.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"my-netflix-clone-nine.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012538; classtype:social-engineering; sid:6012538; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shorter.gg/VYxNEt)"; flow:established,to_server; http.uri; content:"/VYxNEt"; startswith; fast_pattern; http.host; content:"shorter.gg"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012539; classtype:social-engineering; sid:6012539; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.myfidelitysite.com/RVNAhealth/rvnahealth/14129)"; flow:established,to_server; http.uri; content:"/RVNAhealth/rvnahealth/14129"; startswith; fast_pattern; http.host; content:"www.myfidelitysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012540; classtype:social-engineering; sid:6012540; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coinbaseru.ru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coinbaseru.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012541; classtype:social-engineering; sid:6012541; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galabetbet.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galabetbet.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012542; classtype:social-engineering; sid:6012542; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9000-firebase-ship-1779913820229.cluster-zti5ytzhlffjiqj6bp4giuli3u.cloudworkstations.dev/?monospaceUid=444857/)"; flow:established,to_server; http.uri; content:"/?monospaceUid=444857/"; startswith; fast_pattern; http.host; content:"9000-firebase-ship-1779913820229.cluster-zti5ytzhlffjiqj6bp4giuli3u.cloudworkstations.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012543; classtype:social-engineering; sid:6012543; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hvyasq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hvyasq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012544; classtype:social-engineering; sid:6012544; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (new-recovery.info-meta-noreply.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"new-recovery.info-meta-noreply.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012545; classtype:social-engineering; sid:6012545; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (april-eyes-repair-asian.trycloudflare.com/login.html)"; flow:established,to_server; http.uri; content:"/login.html"; startswith; fast_pattern; http.host; content:"april-eyes-repair-asian.trycloudflare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012546; classtype:social-engineering; sid:6012546; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (selalu.me/rhS7B5)"; flow:established,to_server; http.uri; content:"/rhS7B5"; startswith; fast_pattern; http.host; content:"selalu.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012547; classtype:social-engineering; sid:6012547; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ortonhall.spahotel.guru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ortonhall.spahotel.guru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012548; classtype:social-engineering; sid:6012548; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vpu9v6w044xfmvu.s3-website-us-east-1.amazonaws.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vpu9v6w044xfmvu.s3-website-us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012549; classtype:social-engineering; sid:6012549; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kltqvxtp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kltqvxtp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012550; classtype:social-engineering; sid:6012550; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (au2n02frx5v32wo.s3-website-us-east-1.amazonaws.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"au2n02frx5v32wo.s3-website-us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012551; classtype:social-engineering; sid:6012551; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (program-resmi189.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"program-resmi189.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012552; classtype:social-engineering; sid:6012552; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (temiloluwatestimony981-create.github.io/Netflix/)"; flow:established,to_server; http.uri; content:"/Netflix/"; startswith; fast_pattern; http.host; content:"temiloluwatestimony981-create.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012553; classtype:social-engineering; sid:6012553; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mxtqvrlp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mxtqvrlp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012554; classtype:social-engineering; sid:6012554; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lkptar.enterprisepolicycenterassist.com/public/index?ref=business-support-center-DASDFDSYUYEE43FJDSHFSDFsetting%25popup?client_id=889943718806-ual26tplnot2ea8b7n5t4p77keo8eb)"; flow:established,to_server; http.uri; content:"/public/index?ref=business-support-center-DASDFDSYUYEE43FJDSHFSDFsetting%25popup?client_id=889943718806-ual26tplnot2ea8b7n5t4p77keo8eb"; startswith; fast_pattern; http.host; content:"lkptar.enterprisepolicycenterassist.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012555; classtype:social-engineering; sid:6012555; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alameenmuhd1.github.io/NetflixHomepage/)"; flow:established,to_server; http.uri; content:"/NetflixHomepage/"; startswith; fast_pattern; http.host; content:"alameenmuhd1.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012556; classtype:social-engineering; sid:6012556; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.myfidelitysite.com/RVNAhealth)"; flow:established,to_server; http.uri; content:"/RVNAhealth"; startswith; fast_pattern; http.host; content:"www.myfidelitysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012557; classtype:social-engineering; sid:6012557; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.opensea-mintslive98.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.opensea-mintslive98.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012558; classtype:social-engineering; sid:6012558; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-132755649dce44fe95257f08abf4c1b6.r2.dev/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-132755649dce44fe95257f08abf4c1b6.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012559; classtype:social-engineering; sid:6012559; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ep-it-mq5kky6hr1dw3-b0gbaad7eghchacz.z02.azurefd.net/Win20Errfb020/index.html)"; flow:established,to_server; http.uri; content:"/Win20Errfb020/index.html"; startswith; fast_pattern; http.host; content:"ep-it-mq5kky6hr1dw3-b0gbaad7eghchacz.z02.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012560; classtype:social-engineering; sid:6012560; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xyros-01.github.io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"xyros-01.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012561; classtype:social-engineering; sid:6012561; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mqvzlxpt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mqvzlxpt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012562; classtype:social-engineering; sid:6012562; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (raniattri.github.io/amazon-clone-project)"; flow:established,to_server; http.uri; content:"/amazon-clone-project"; startswith; fast_pattern; http.host; content:"raniattri.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012563; classtype:social-engineering; sid:6012563; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (leeabbeylondon.hostel.town/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"leeabbeylondon.hostel.town"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012564; classtype:social-engineering; sid:6012564; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qevvax.courses/75775dd/)"; flow:established,to_server; http.uri; content:"/75775dd/"; startswith; fast_pattern; http.host; content:"qevvax.courses"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012565; classtype:social-engineering; sid:6012565; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (engagement-v3.mektor.eu/bp/conglomorate)"; flow:established,to_server; http.uri; content:"/bp/conglomorate"; startswith; fast_pattern; http.host; content:"engagement-v3.mektor.eu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012566; classtype:social-engineering; sid:6012566; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.team-d.co/p/qmzy-adpq/rvyzkgjx)"; flow:established,to_server; http.uri; content:"/p/qmzy-adpq/rvyzkgjx"; startswith; fast_pattern; http.host; content:"s.team-d.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012567; classtype:social-engineering; sid:6012567; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.next-netflix-23rd-kappa.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.next-netflix-23rd-kappa.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012568; classtype:social-engineering; sid:6012568; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chrome-extension-dfhsdfhjgsjsgjsyuou.airdrop.investments/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"chrome-extension-dfhsdfhjgsjsgjsyuou.airdrop.investments"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012569; classtype:social-engineering; sid:6012569; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pnelcds.ezzzybos.us/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pnelcds.ezzzybos.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012570; classtype:social-engineering; sid:6012570; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agrotrade.co.in/g/ddfghhj/gffg/alibaba/)"; flow:established,to_server; http.uri; content:"/g/ddfghhj/gffg/alibaba/"; startswith; fast_pattern; http.host; content:"agrotrade.co.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012571; classtype:social-engineering; sid:6012571; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bradesco.atualizacao-seguranca.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bradesco.atualizacao-seguranca.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012572; classtype:social-engineering; sid:6012572; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (occidentes.web-colombia.org/occidente/)"; flow:established,to_server; http.uri; content:"/occidente/"; startswith; fast_pattern; http.host; content:"occidentes.web-colombia.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012573; classtype:social-engineering; sid:6012573; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bill.remote-otp.com/?rid=jY2jrPo)"; flow:established,to_server; http.uri; content:"/?rid=jY2jrPo"; startswith; fast_pattern; http.host; content:"bill.remote-otp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012574; classtype:social-engineering; sid:6012574; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bcpaym.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bcpaym.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012575; classtype:social-engineering; sid:6012575; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blockfi-docs-net.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"blockfi-docs-net.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012576; classtype:social-engineering; sid:6012576; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.guplnr.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.guplnr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012577; classtype:social-engineering; sid:6012577; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram.sitaci.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram.sitaci.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012578; classtype:social-engineering; sid:6012578; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (teams.cloud-server.net.in/app/ut8i8WqxUJJfAqm9DtUJC4)"; flow:established,to_server; http.uri; content:"/app/ut8i8WqxUJJfAqm9DtUJC4"; startswith; fast_pattern; http.host; content:"teams.cloud-server.net.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012579; classtype:social-engineering; sid:6012579; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (track-ghk.top/gh)"; flow:established,to_server; http.uri; content:"/gh"; startswith; fast_pattern; http.host; content:"track-ghk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012580; classtype:social-engineering; sid:6012580; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sparkasseonline.my/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.sparkasseonline.my"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012581; classtype:social-engineering; sid:6012581; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cargacartola.timdai.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cargacartola.timdai.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012582; classtype:social-engineering; sid:6012582; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vgsgu2.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vgsgu2.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012583; classtype:social-engineering; sid:6012583; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (refacture-video.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"refacture-video.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012584; classtype:social-engineering; sid:6012584; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dwgr-8ug8-53to.rsadler.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dwgr-8ug8-53to.rsadler.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012585; classtype:social-engineering; sid:6012585; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreieumvwdihpbpflkla34r6jdnugdqpa2wwpq44qwfjchmm36g76z4i.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreieumvwdihpbpflkla34r6jdnugdqpa2wwpq44qwfjchmm36g76z4i.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012586; classtype:social-engineering; sid:6012586; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suncoastcreditunion.at/routing-number.php)"; flow:established,to_server; http.uri; content:"/routing-number.php"; startswith; fast_pattern; http.host; content:"suncoastcreditunion.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012587; classtype:social-engineering; sid:6012587; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rodovias-dr9.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rodovias-dr9.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012588; classtype:social-engineering; sid:6012588; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acopadomundoestaaivaiperde.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"acopadomundoestaaivaiperde.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012589; classtype:social-engineering; sid:6012589; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (softmicro.s3-website-us-east-1.amazonaws.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"softmicro.s3-website-us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012590; classtype:social-engineering; sid:6012590; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.nwrqlptg.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.nwrqlptg.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012591; classtype:social-engineering; sid:6012591; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ilbcedu01mm.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ilbcedu01mm.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012592; classtype:social-engineering; sid:6012592; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (105655777.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"105655777.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012593; classtype:social-engineering; sid:6012593; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (twinkle-14.github.io/Movie-clone/)"; flow:established,to_server; http.uri; content:"/Movie-clone/"; startswith; fast_pattern; http.host; content:"twinkle-14.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012594; classtype:social-engineering; sid:6012594; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kqrlpvat.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kqrlpvat.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012595; classtype:social-engineering; sid:6012595; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (office-document-sign.tammy-e82.workers.dev/app)"; flow:established,to_server; http.uri; content:"/app"; startswith; fast_pattern; http.host; content:"office-document-sign.tammy-e82.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012596; classtype:social-engineering; sid:6012596; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myubs.ch-account.com/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"myubs.ch-account.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012597; classtype:social-engineering; sid:6012597; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rnicrosoft-support.human-resources.services/home/22181e737cbf4788b2ec2371645d6b64/a67010b9a3b8c49f89eca04a28761a129)"; flow:established,to_server; http.uri; content:"/home/22181e737cbf4788b2ec2371645d6b64/a67010b9a3b8c49f89eca04a28761a129"; startswith; fast_pattern; http.host; content:"rnicrosoft-support.human-resources.services"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012598; classtype:social-engineering; sid:6012598; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usadailyletter.com/Pu/diff.html)"; flow:established,to_server; http.uri; content:"/Pu/diff.html"; startswith; fast_pattern; http.host; content:"usadailyletter.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012599; classtype:social-engineering; sid:6012599; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sporternaehrung-lambertz.de/newsletter.php)"; flow:established,to_server; http.uri; content:"/newsletter.php"; startswith; fast_pattern; http.host; content:"www.sporternaehrung-lambertz.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012600; classtype:social-engineering; sid:6012600; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roank029.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"roank029.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012601; classtype:social-engineering; sid:6012601; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (track-ghk.click/gh)"; flow:established,to_server; http.uri; content:"/gh"; startswith; fast_pattern; http.host; content:"track-ghk.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012602; classtype:social-engineering; sid:6012602; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kajendiranm.github.io/Airbnb-Clone/)"; flow:established,to_server; http.uri; content:"/Airbnb-Clone/"; startswith; fast_pattern; http.host; content:"kajendiranm.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012603; classtype:social-engineering; sid:6012603; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rnejda.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rnejda.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012604; classtype:social-engineering; sid:6012604; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.surl.lu/kfniiu/)"; flow:established,to_server; http.uri; content:"/kfniiu/"; startswith; fast_pattern; http.host; content:"www.surl.lu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012605; classtype:social-engineering; sid:6012605; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mobile.canswkq.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mobile.canswkq.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012606; classtype:social-engineering; sid:6012606; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eri0-dreayi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eri0-dreayi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012607; classtype:social-engineering; sid:6012607; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.pnzlwrqt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.pnzlwrqt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012608; classtype:social-engineering; sid:6012608; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bieeeneficiofogape.solanaplopcoin.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bieeeneficiofogape.solanaplopcoin.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012609; classtype:social-engineering; sid:6012609; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (admin.nbgstravel.co.za/redirec.htm)"; flow:established,to_server; http.uri; content:"/redirec.htm"; startswith; fast_pattern; http.host; content:"admin.nbgstravel.co.za"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012610; classtype:social-engineering; sid:6012610; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (officeally.mystagingwebsite.com/wp-content/plugins/agoriasuio/public/index.php)"; flow:established,to_server; http.uri; content:"/wp-content/plugins/agoriasuio/public/index.php"; startswith; fast_pattern; http.host; content:"officeally.mystagingwebsite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012611; classtype:social-engineering; sid:6012611; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suncoastcreditunion.at/savings-accounts.php)"; flow:established,to_server; http.uri; content:"/savings-accounts.php"; startswith; fast_pattern; http.host; content:"suncoastcreditunion.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012612; classtype:social-engineering; sid:6012612; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cripthub.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cripthub.org"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012613; classtype:social-engineering; sid:6012613; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rebbywllet.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"rebbywllet.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012614; classtype:social-engineering; sid:6012614; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (new-rabbyy.wixstudio.com/wallet)"; flow:established,to_server; http.uri; content:"/wallet"; startswith; fast_pattern; http.host; content:"new-rabbyy.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012615; classtype:social-engineering; sid:6012615; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (home-rubyycdn.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"home-rubyycdn.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012616; classtype:social-engineering; sid:6012616; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.redirection-france-colis.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.redirection-france-colis.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012617; classtype:social-engineering; sid:6012617; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (extensionwalletio.wixstudio.com/myextension)"; flow:established,to_server; http.uri; content:"/myextension"; startswith; fast_pattern; http.host; content:"extensionwalletio.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012618; classtype:social-engineering; sid:6012618; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (monespace-reglement.com/support/login/)"; flow:established,to_server; http.uri; content:"/support/login/"; startswith; fast_pattern; http.host; content:"monespace-reglement.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012619; classtype:social-engineering; sid:6012619; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c4ksw3.cfd/o/ws6l0/1768848617406)"; flow:established,to_server; http.uri; content:"/o/ws6l0/1768848617406"; startswith; fast_pattern; http.host; content:"c4ksw3.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012620; classtype:social-engineering; sid:6012620; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.40023i-s.shop/login.html)"; flow:established,to_server; http.uri; content:"/login.html"; startswith; fast_pattern; http.host; content:"allegro.40023i-s.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012621; classtype:social-engineering; sid:6012621; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eng-rabby.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eng-rabby.wasmer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012622; classtype:social-engineering; sid:6012622; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rabbe-extension.wixstudio.com/rabby-en)"; flow:established,to_server; http.uri; content:"/rabby-en"; startswith; fast_pattern; http.host; content:"rabbe-extension.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012623; classtype:social-engineering; sid:6012623; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (caconstructionweb.com/bdhvio/)"; flow:established,to_server; http.uri; content:"/bdhvio/"; startswith; fast_pattern; http.host; content:"caconstructionweb.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012624; classtype:social-engineering; sid:6012624; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (us-rabbyy.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"us-rabbyy.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012625; classtype:social-engineering; sid:6012625; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (homepage-rabbycdn.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"homepage-rabbycdn.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012626; classtype:social-engineering; sid:6012626; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trade-rabbyapps.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"trade-rabbyapps.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012627; classtype:social-engineering; sid:6012627; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (us-rabbyy.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"us-rabbyy.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012628; classtype:social-engineering; sid:6012628; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (desktopap-live.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"desktopap-live.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012629; classtype:social-engineering; sid:6012629; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appstarted-ledgro.wixstudio.com/start)"; flow:established,to_server; http.uri; content:"/start"; startswith; fast_pattern; http.host; content:"appstarted-ledgro.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012630; classtype:social-engineering; sid:6012630; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (author-3lx.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"author-3lx.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012631; classtype:social-engineering; sid:6012631; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-login-page-two.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-login-page-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012632; classtype:social-engineering; sid:6012632; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hotdoc-rf-pending.com/pages/captcha.php)"; flow:established,to_server; http.uri; content:"/pages/captcha.php"; startswith; fast_pattern; http.host; content:"hotdoc-rf-pending.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012633; classtype:social-engineering; sid:6012633; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rxppyy.github.io/discord-web)"; flow:established,to_server; http.uri; content:"/discord-web"; startswith; fast_pattern; http.host; content:"rxppyy.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012634; classtype:social-engineering; sid:6012634; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-eng-ndax---cdn-authh.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sso-eng-ndax---cdn-authh.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012635; classtype:social-engineering; sid:6012635; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.osbjlt.shop/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.osbjlt.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012636; classtype:social-engineering; sid:6012636; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (httpssbc-net-signin.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"httpssbc-net-signin.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012637; classtype:social-engineering; sid:6012637; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kasmli313univ.github.io/bodanovismartoce/)"; flow:established,to_server; http.uri; content:"/bodanovismartoce/"; startswith; fast_pattern; http.host; content:"kasmli313univ.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012638; classtype:social-engineering; sid:6012638; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.creditoahoraconbdvenlinea.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.creditoahoraconbdvenlinea.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012639; classtype:social-engineering; sid:6012639; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (browse.sdton.info/ga/click/2-8871055-13-9888-19327-10831-91b6c4e01f-afed3a2c44/)"; flow:established,to_server; http.uri; content:"/ga/click/2-8871055-13-9888-19327-10831-91b6c4e01f-afed3a2c44/"; startswith; fast_pattern; http.host; content:"browse.sdton.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012640; classtype:social-engineering; sid:6012640; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (srv1540807.hstgr.cloud/wp-content/upgrade/home/login.html)"; flow:established,to_server; http.uri; content:"/wp-content/upgrade/home/login.html"; startswith; fast_pattern; http.host; content:"srv1540807.hstgr.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012641; classtype:social-engineering; sid:6012641; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vmozass.info/m/_GYmTfY7uNKsxR3Wu1-nvFW1)"; flow:established,to_server; http.uri; content:"/m/_GYmTfY7uNKsxR3Wu1-nvFW1"; startswith; fast_pattern; http.host; content:"vmozass.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012642; classtype:social-engineering; sid:6012642; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (psee.io/96lbzj)"; flow:established,to_server; http.uri; content:"/96lbzj"; startswith; fast_pattern; http.host; content:"psee.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012643; classtype:social-engineering; sid:6012643; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (julian-wine-cleanup-searched.trycloudflare.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"julian-wine-cleanup-searched.trycloudflare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012644; classtype:social-engineering; sid:6012644; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.wojiaogg.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"login.wojiaogg.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012645; classtype:social-engineering; sid:6012645; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (beaz-c7czfkh3guhaffaf.z03.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"beaz-c7czfkh3guhaffaf.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012646; classtype:social-engineering; sid:6012646; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lazaro277.github.io/spotify)"; flow:established,to_server; http.uri; content:"/spotify"; startswith; fast_pattern; http.host; content:"lazaro277.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012647; classtype:social-engineering; sid:6012647; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (underwave.digital/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"underwave.digital"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012648; classtype:social-engineering; sid:6012648; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abbey88bmuwatruc7-0fkvvedfqvd7mcbqx0sedb.vercel.app/bsaehwa34rhbsdfbda32s.html/)"; flow:established,to_server; http.uri; content:"/bsaehwa34rhbsdfbda32s.html/"; startswith; fast_pattern; http.host; content:"abbey88bmuwatruc7-0fkvvedfqvd7mcbqx0sedb.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012649; classtype:social-engineering; sid:6012649; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee1929.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopee1929.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012650; classtype:social-engineering; sid:6012650; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hotdoc-rf-pending-medicare.com/pages/captcha.php/)"; flow:established,to_server; http.uri; content:"/pages/captcha.php/"; startswith; fast_pattern; http.host; content:"hotdoc-rf-pending-medicare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012651; classtype:social-engineering; sid:6012651; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (staging.citiretailservices.citibankonlline.com/?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTc4MTE3MTY5MywiaWF0IjoxNzgxMTY0NDkzLCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIzMnJ2ZmFyZ25sNWd1cWN0ZHNiMWs0NDQiLCJuYmYiOjE3ODExNjQ0OTMsInRzIjoxNzgxMTY0NDkzMzUxMjA2fQ.8dMp0i-GRON3ZSd6v3LfdofXKKWfYRN71asdd1qTY5s&sid=d4a1b9f1-656a-11f1-9283-0930d8bd4552)"; flow:established,to_server; http.uri; content:"/?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTc4MTE3MTY5MywiaWF0IjoxNzgxMTY0NDkzLCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIzMnJ2ZmFyZ25sNWd1cWN0ZHNiMWs0NDQiLCJuYmYiOjE3ODExNjQ0OTMsInRzIjoxNzgxMTY0NDkzMzUxMjA2fQ.8dMp0i-GRON3ZSd6v3LfdofXKKWfYRN71asdd1qTY5s&sid=d4a1b9f1-656a-11f1-9283-0930d8bd4552"; startswith; fast_pattern; http.host; content:"staging.citiretailservices.citibankonlline.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012652; classtype:social-engineering; sid:6012652; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.web-git-06-09-fixwebtdpallnetworksoptionupdatest-619c96-uniswap.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.web-git-06-09-fixwebtdpallnetworksoptionupdatest-619c96-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012653; classtype:social-engineering; sid:6012653; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (creditoahoraconbdvenlinea.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"creditoahoraconbdvenlinea.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012654; classtype:social-engineering; sid:6012654; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (l6angk.top/o/ws6l0/1768848617406#selectedbank9)"; flow:established,to_server; http.uri; content:"/o/ws6l0/1768848617406#selectedbank9"; startswith; fast_pattern; http.host; content:"l6angk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012655; classtype:social-engineering; sid:6012655; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tiny.cc/jd94101/)"; flow:established,to_server; http.uri; content:"/jd94101/"; startswith; fast_pattern; http.host; content:"www.tiny.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012656; classtype:social-engineering; sid:6012656; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-dranik-biz-plurnor-fralqax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-dranik-biz-plurnor-fralqax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012657; classtype:social-engineering; sid:6012657; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (daniel-stingl.de:3456/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"daniel-stingl.de:3456"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012658; classtype:social-engineering; sid:6012658; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sxteamcotmmunity.com/3757459994)"; flow:established,to_server; http.uri; content:"/3757459994"; startswith; fast_pattern; http.host; content:"sxteamcotmmunity.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012659; classtype:social-engineering; sid:6012659; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galicia-web-prototype.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galicia-web-prototype.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012660; classtype:social-engineering; sid:6012660; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hotdoc-rf-pending-medicare.com/pages/captcha.php)"; flow:established,to_server; http.uri; content:"/pages/captcha.php"; startswith; fast_pattern; http.host; content:"hotdoc-rf-pending-medicare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012661; classtype:social-engineering; sid:6012661; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ravlix-biz-sentox-1425.pages.dev/heartily_welcome?id=103892392070173&page_name=Monica%20A%20Garcia/)"; flow:established,to_server; http.uri; content:"/heartily_welcome?id=103892392070173&page_name=Monica%20A%20Garcia/"; startswith; fast_pattern; http.host; content:"ravlix-biz-sentox-1425.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012662; classtype:social-engineering; sid:6012662; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fdsbu.forms.marketingsbu.com.uy/panel/login)"; flow:established,to_server; http.uri; content:"/panel/login"; startswith; fast_pattern; http.host; content:"fdsbu.forms.marketingsbu.com.uy"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012663; classtype:social-engineering; sid:6012663; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (track.amplatzgiving.info/ga/click/2-17094644-21-10227-20003-11079-6e0e4443c1-aa5d763999)"; flow:established,to_server; http.uri; content:"/ga/click/2-17094644-21-10227-20003-11079-6e0e4443c1-aa5d763999"; startswith; fast_pattern; http.host; content:"track.amplatzgiving.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012664; classtype:social-engineering; sid:6012664; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.zeropayment.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.zeropayment.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012665; classtype:social-engineering; sid:6012665; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.blueatlastesting.com/slonearchitects/)"; flow:established,to_server; http.uri; content:"/slonearchitects/"; startswith; fast_pattern; http.host; content:"www.blueatlastesting.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012666; classtype:social-engineering; sid:6012666; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (140bae.senes.at/bncearn/incnb.php/)"; flow:established,to_server; http.uri; content:"/bncearn/incnb.php/"; startswith; fast_pattern; http.host; content:"140bae.senes.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012667; classtype:social-engineering; sid:6012667; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sun7798.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sun7798.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012668; classtype:social-engineering; sid:6012668; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.teams-zvl.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"s.teams-zvl.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012669; classtype:social-engineering; sid:6012669; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sharepoint-upload-ndlv.donnelcady1.workers.dev/l/O8kUZFH377s)"; flow:established,to_server; http.uri; content:"/l/O8kUZFH377s"; startswith; fast_pattern; http.host; content:"sharepoint-upload-ndlv.donnelcady1.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012670; classtype:social-engineering; sid:6012670; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trplochu.carroll-230.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trplochu.carroll-230.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012671; classtype:social-engineering; sid:6012671; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reactjsinstagramclone.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"reactjsinstagramclone.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012672; classtype:social-engineering; sid:6012672; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (afnansaqib52-cpu.github.io/-amazon-clone-)"; flow:established,to_server; http.uri; content:"/-amazon-clone-"; startswith; fast_pattern; http.host; content:"afnansaqib52-cpu.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012673; classtype:social-engineering; sid:6012673; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-login-page-two.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-login-page-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012674; classtype:social-engineering; sid:6012674; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (se.nm.gnfkg.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"se.nm.gnfkg.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012675; classtype:social-engineering; sid:6012675; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (onlineausde.andhrauniversity.edu.in/studentLogin/Payments/)"; flow:established,to_server; http.uri; content:"/studentLogin/Payments/"; startswith; fast_pattern; http.host; content:"onlineausde.andhrauniversity.edu.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012676; classtype:social-engineering; sid:6012676; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netempresas.atualizacao-seguranca.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netempresas.atualizacao-seguranca.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012677; classtype:social-engineering; sid:6012677; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accounts.iruabmkakw.com/en/login)"; flow:established,to_server; http.uri; content:"/en/login"; startswith; fast_pattern; http.host; content:"accounts.iruabmkakw.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012678; classtype:social-engineering; sid:6012678; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (payal135001-ship-it.github.io/amazon-project/)"; flow:established,to_server; http.uri; content:"/amazon-project/"; startswith; fast_pattern; http.host; content:"payal135001-ship-it.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012679; classtype:social-engineering; sid:6012679; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreidgb26kajtcksilisi2oifeijkz3hrctc4n7v2awrlqq4h7yv65le.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreidgb26kajtcksilisi2oifeijkz3hrctc4n7v2awrlqq4h7yv65le.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012680; classtype:social-engineering; sid:6012680; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netempresas.atualizacao-seguranca.com/login.php?hash=1927883646a2b0f39778563.87271436)"; flow:established,to_server; http.uri; content:"/login.php?hash=1927883646a2b0f39778563.87271436"; startswith; fast_pattern; http.host; content:"www.netempresas.atualizacao-seguranca.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012681; classtype:social-engineering; sid:6012681; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (authorizedfixednode.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"authorizedfixednode.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012682; classtype:social-engineering; sid:6012682; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (h5mijp.cfd/o/ws6l0/1768848617406#selectedbank9)"; flow:established,to_server; http.uri; content:"/o/ws6l0/1768848617406#selectedbank9"; startswith; fast_pattern; http.host; content:"h5mijp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012683; classtype:social-engineering; sid:6012683; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pljnsad.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pljnsad.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012684; classtype:social-engineering; sid:6012684; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (o1p2x9d.lol/o/ws6l0/1768848617406#selectedbank9)"; flow:established,to_server; http.uri; content:"/o/ws6l0/1768848617406#selectedbank9"; startswith; fast_pattern; http.host; content:"o1p2x9d.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012685; classtype:social-engineering; sid:6012685; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-clone-zeta-five.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-zeta-five.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012686; classtype:social-engineering; sid:6012686; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sikel-corn-sans.click/m/V5wc8ZpFM0osINI2-yMie5av)"; flow:established,to_server; http.uri; content:"/m/V5wc8ZpFM0osINI2-yMie5av"; startswith; fast_pattern; http.host; content:"sikel-corn-sans.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012687; classtype:social-engineering; sid:6012687; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (youngs147.courvillemayarde-wj-r-c4072.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"youngs147.courvillemayarde-wj-r-c4072.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012688; classtype:social-engineering; sid:6012688; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adithyac18.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"adithyac18.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012689; classtype:social-engineering; sid:6012689; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rodoviasdobrasil.digital/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rodoviasdobrasil.digital"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012690; classtype:social-engineering; sid:6012690; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (madeforthis.s-ed1.cloud.gcore.lu/xls/review-file.html)"; flow:established,to_server; http.uri; content:"/xls/review-file.html"; startswith; fast_pattern; http.host; content:"madeforthis.s-ed1.cloud.gcore.lu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012691; classtype:social-engineering; sid:6012691; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coinbase_x_login.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coinbase_x_login.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012692; classtype:social-engineering; sid:6012692; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-clone-login.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-clone-login.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012693; classtype:social-engineering; sid:6012693; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-delta-two.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-delta-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012694; classtype:social-engineering; sid:6012694; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-git-arc-chain-support-uniswap.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-git-arc-chain-support-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012695; classtype:social-engineering; sid:6012695; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (czxiqmvqgnsjnfkdj-gijoxucfyu5dwno1ulmt0m.vercel.app/bsaehwa34rhbsdfbda32s)"; flow:established,to_server; http.uri; content:"/bsaehwa34rhbsdfbda32s"; startswith; fast_pattern; http.host; content:"czxiqmvqgnsjnfkdj-gijoxucfyu5dwno1ulmt0m.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012696; classtype:social-engineering; sid:6012696; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (giftshopee79.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"giftshopee79.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012697; classtype:social-engineering; sid:6012697; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.eri0-dreayi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.eri0-dreayi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012698; classtype:social-engineering; sid:6012698; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shex7amuu-cmd.github.io/Apple)"; flow:established,to_server; http.uri; content:"/Apple"; startswith; fast_pattern; http.host; content:"shex7amuu-cmd.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012699; classtype:social-engineering; sid:6012699; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagramclone-umber.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagramclone-umber.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012700; classtype:social-engineering; sid:6012700; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-drab-nu.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-drab-nu.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012701; classtype:social-engineering; sid:6012701; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store.communitysectionsgames.shop/workshop/AK47-EternalDecay/)"; flow:established,to_server; http.uri; content:"/workshop/AK47-EternalDecay/"; startswith; fast_pattern; http.host; content:"store.communitysectionsgames.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012702; classtype:social-engineering; sid:6012702; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klelnanzeigen-deutsch.srvc-de834294.info/getpaymentm/226332644/m9)"; flow:established,to_server; http.uri; content:"/getpaymentm/226332644/m9"; startswith; fast_pattern; http.host; content:"klelnanzeigen-deutsch.srvc-de834294.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012703; classtype:social-engineering; sid:6012703; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thwmigj.yudasise.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"thwmigj.yudasise.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012704; classtype:social-engineering; sid:6012704; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (codenf.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"codenf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012705; classtype:social-engineering; sid:6012705; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vmozass.info/m/9JsKA9r3THwO7rlB27h0CbQb)"; flow:established,to_server; http.uri; content:"/m/9JsKA9r3THwO7rlB27h0CbQb"; startswith; fast_pattern; http.host; content:"vmozass.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012706; classtype:social-engineering; sid:6012706; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netcoins-login-sso-ca-x.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netcoins-login-sso-ca-x.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012707; classtype:social-engineering; sid:6012707; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (109tyesy.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"109tyesy.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012708; classtype:social-engineering; sid:6012708; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reactjsinstagramclone.vercel.app/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"reactjsinstagramclone.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012709; classtype:social-engineering; sid:6012709; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abbey88bmuwatruc7-0fkvvedfqvd7mcbqx0sedb.vercel.app/bsaehwa34rhbsdfbda32s)"; flow:established,to_server; http.uri; content:"/bsaehwa34rhbsdfbda32s"; startswith; fast_pattern; http.host; content:"abbey88bmuwatruc7-0fkvvedfqvd7mcbqx0sedb.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012710; classtype:social-engineering; sid:6012710; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metameaslogiz.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metameaslogiz.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012711; classtype:social-engineering; sid:6012711; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-clone-xi-one.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-clone-xi-one.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012712; classtype:social-engineering; sid:6012712; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klelnanzeigen-deutsch.id90617.info/getpaymentm/216827172/m9)"; flow:established,to_server; http.uri; content:"/getpaymentm/216827172/m9"; startswith; fast_pattern; http.host; content:"klelnanzeigen-deutsch.id90617.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012713; classtype:social-engineering; sid:6012713; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365bet332.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.365bet332.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012714; classtype:social-engineering; sid:6012714; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-drab-nu.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-drab-nu.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012715; classtype:social-engineering; sid:6012715; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.munhdl.shop/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.munhdl.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012716; classtype:social-engineering; sid:6012716; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yxd2-wdbf-hch6.piyush-goti-soilengineersltd-com-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yxd2-wdbf-hch6.piyush-goti-soilengineersltd-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012717; classtype:social-engineering; sid:6012717; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.00057365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.00057365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012718; classtype:social-engineering; sid:6012718; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee1929.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.shopee1929.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012719; classtype:social-engineering; sid:6012719; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.25365x.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.25365x.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012720; classtype:social-engineering; sid:6012720; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.crestpointivsbk.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.crestpointivsbk.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012721; classtype:social-engineering; sid:6012721; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreig6osgy7ndyfux3ma7lukuwogvviqc6nmpd62qrsvsamsgzg5hawa.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreig6osgy7ndyfux3ma7lukuwogvviqc6nmpd62qrsvsamsgzg5hawa.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012722; classtype:social-engineering; sid:6012722; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (msquarantainedmail.business-insights.live/wwwbp9005c6diurl/)"; flow:established,to_server; http.uri; content:"/wwwbp9005c6diurl/"; startswith; fast_pattern; http.host; content:"msquarantainedmail.business-insights.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012723; classtype:social-engineering; sid:6012723; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-coral-iota.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-coral-iota.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012724; classtype:social-engineering; sid:6012724; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.app.ronghaihuagong.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.app.ronghaihuagong.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012725; classtype:social-engineering; sid:6012725; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dm8576.github.io/Amezon/)"; flow:established,to_server; http.uri; content:"/Amezon/"; startswith; fast_pattern; http.host; content:"dm8576.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012726; classtype:social-engineering; sid:6012726; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (page-roblox.com/users/257334741403/profile)"; flow:established,to_server; http.uri; content:"/users/257334741403/profile"; startswith; fast_pattern; http.host; content:"page-roblox.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012727; classtype:social-engineering; sid:6012727; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (68-210-204-122.cprapid.com/ch/update.php?gypf82q129bd8admgvjl)"; flow:established,to_server; http.uri; content:"/ch/update.php?gypf82q129bd8admgvjl"; startswith; fast_pattern; http.host; content:"68-210-204-122.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012728; classtype:social-engineering; sid:6012728; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (purple-beach-0cc85d910.7.azurestaticapps.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"purple-beach-0cc85d910.7.azurestaticapps.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012729; classtype:social-engineering; sid:6012729; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bucota.shop/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bucota.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012730; classtype:social-engineering; sid:6012730; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.yokold.citiretailservices.citibankonlline.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.yokold.citiretailservices.citibankonlline.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012731; classtype:social-engineering; sid:6012731; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (czxiqmvqgnsjnfkdj-gijoxucfyu5dwno1ulmt0m.vercel.app/bsaehwa34rhbsdfbda32s.html/)"; flow:established,to_server; http.uri; content:"/bsaehwa34rhbsdfbda32s.html/"; startswith; fast_pattern; http.host; content:"czxiqmvqgnsjnfkdj-gijoxucfyu5dwno1ulmt0m.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012732; classtype:social-engineering; sid:6012732; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (track-device.help/QwJ)"; flow:established,to_server; http.uri; content:"/QwJ"; startswith; fast_pattern; http.host; content:"track-device.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012733; classtype:social-engineering; sid:6012733; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mybluecheck-verify-manager.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mybluecheck-verify-manager.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012734; classtype:social-engineering; sid:6012734; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi697.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"info-resmi697.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012735; classtype:social-engineering; sid:6012735; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netempresas.atualizacao-seguranca.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netempresas.atualizacao-seguranca.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012736; classtype:social-engineering; sid:6012736; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pvenu46.github.io/alfidotech-netflix-clone/)"; flow:established,to_server; http.uri; content:"/alfidotech-netflix-clone/"; startswith; fast_pattern; http.host; content:"pvenu46.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012737; classtype:social-engineering; sid:6012737; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flowersshopping.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"flowersshopping.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012738; classtype:social-engineering; sid:6012738; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brtzxv.sbs/HF)"; flow:established,to_server; http.uri; content:"/HF"; startswith; fast_pattern; http.host; content:"brtzxv.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012739; classtype:social-engineering; sid:6012739; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (good.coinbaseinv.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"good.coinbaseinv.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012740; classtype:social-engineering; sid:6012740; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiabtggf4pvukd6vsagw3bswoivyqet36ocb4ujr74e64gbfvqrz7u.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiabtggf4pvukd6vsagw3bswoivyqet36ocb4ujr74e64gbfvqrz7u.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012741; classtype:social-engineering; sid:6012741; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (safe-ejgup.top/m/FUEVhDxhmU5hOfy3fOcgCFM5)"; flow:established,to_server; http.uri; content:"/m/FUEVhDxhmU5hOfy3fOcgCFM5"; startswith; fast_pattern; http.host; content:"safe-ejgup.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012742; classtype:social-engineering; sid:6012742; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hotdoc-rf-pending.com/pages/captcha.php/)"; flow:established,to_server; http.uri; content:"/pages/captcha.php/"; startswith; fast_pattern; http.host; content:"hotdoc-rf-pending.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012743; classtype:social-engineering; sid:6012743; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (microsoftweb365.fwh.is/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"microsoftweb365.fwh.is"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012744; classtype:social-engineering; sid:6012744; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bet365f.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bet365f.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012745; classtype:social-engineering; sid:6012745; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fr.bjjizhuangxiang.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fr.bjjizhuangxiang.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012746; classtype:social-engineering; sid:6012746; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robloxi.co/users/767705078/profilee)"; flow:established,to_server; http.uri; content:"/users/767705078/profilee"; startswith; fast_pattern; http.host; content:"robloxi.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012747; classtype:social-engineering; sid:6012747; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shringdoc.shop/Adobe_Installer)"; flow:established,to_server; http.uri; content:"/Adobe_Installer"; startswith; fast_pattern; http.host; content:"shringdoc.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012748; classtype:social-engineering; sid:6012748; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (satyamsk05.github.io/instagram.site)"; flow:established,to_server; http.uri; content:"/instagram.site"; startswith; fast_pattern; http.host; content:"satyamsk05.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012749; classtype:social-engineering; sid:6012749; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (g20j-c9rv-o3yh.iris-investore-net-s-account.workers.dev/b7014589342fa525?email=/)"; flow:established,to_server; http.uri; content:"/b7014589342fa525?email=/"; startswith; fast_pattern; http.host; content:"g20j-c9rv-o3yh.iris-investore-net-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012750; classtype:social-engineering; sid:6012750; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sam-string.github.io/Amazon-website-clone-/)"; flow:established,to_server; http.uri; content:"/Amazon-website-clone-/"; startswith; fast_pattern; http.host; content:"sam-string.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012751; classtype:social-engineering; sid:6012751; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.reactjsinstagramclone.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.reactjsinstagramclone.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012752; classtype:social-engineering; sid:6012752; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.23276936365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.23276936365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012753; classtype:social-engineering; sid:6012753; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klelnanzeigen-deutsch.srvc-de734294.info/getpaymentm/261733977/m9)"; flow:established,to_server; http.uri; content:"/getpaymentm/261733977/m9"; startswith; fast_pattern; http.host; content:"klelnanzeigen-deutsch.srvc-de734294.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012754; classtype:social-engineering; sid:6012754; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-clone-login.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-clone-login.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012755; classtype:social-engineering; sid:6012755; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.vdd.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.vdd.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012756; classtype:social-engineering; sid:6012756; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (billion-3f8.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"billion-3f8.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012757; classtype:social-engineering; sid:6012757; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreihidbjzgt4de5atwlyoqjqhxmzcabatdqn4kksec6f44ayjphls2q.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreihidbjzgt4de5atwlyoqjqhxmzcabatdqn4kksec6f44ayjphls2q.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012758; classtype:social-engineering; sid:6012758; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pocztowy-link.online/o/ws6l0/1768848617406#selectedbank9)"; flow:established,to_server; http.uri; content:"/o/ws6l0/1768848617406#selectedbank9"; startswith; fast_pattern; http.host; content:"pocztowy-link.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012759; classtype:social-engineering; sid:6012759; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.adskin.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app.adskin.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012760; classtype:social-engineering; sid:6012760; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.coinbase_x_login.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.coinbase_x_login.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012761; classtype:social-engineering; sid:6012761; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wlt.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wlt.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012762; classtype:social-engineering; sid:6012762; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (forwox.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"forwox.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012763; classtype:social-engineering; sid:6012763; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (24761a05n2-netizen.github.io/netflix_webpage/)"; flow:established,to_server; http.uri; content:"/netflix_webpage/"; startswith; fast_pattern; http.host; content:"24761a05n2-netizen.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012764; classtype:social-engineering; sid:6012764; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiftx3ioy3hebqsyco4cp6r35k47joehzs4mv52ty7awn7qfq27e4y.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiftx3ioy3hebqsyco4cp6r35k47joehzs4mv52ty7awn7qfq27e4y.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012765; classtype:social-engineering; sid:6012765; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mt12352.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mt12352.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012766; classtype:social-engineering; sid:6012766; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (noticias.almacen.nodo12c.radiosnet.com.ar/Office/)"; flow:established,to_server; http.uri; content:"/Office/"; startswith; fast_pattern; http.host; content:"noticias.almacen.nodo12c.radiosnet.com.ar"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012767; classtype:social-engineering; sid:6012767; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (julian-wine-cleanup-searched.trycloudflare.com/login.html)"; flow:established,to_server; http.uri; content:"/login.html"; startswith; fast_pattern; http.host; content:"julian-wine-cleanup-searched.trycloudflare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012768; classtype:social-engineering; sid:6012768; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (srujana882006.github.io/amazon-css-clone/)"; flow:established,to_server; http.uri; content:"/amazon-css-clone/"; startswith; fast_pattern; http.host; content:"srujana882006.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012769; classtype:social-engineering; sid:6012769; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tiktok.shop599.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tiktok.shop599.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012770; classtype:social-engineering; sid:6012770; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sikel-corn-sans.click/m/FX13nylJgdFou7CfBeXH0uPl)"; flow:established,to_server; http.uri; content:"/m/FX13nylJgdFou7CfBeXH0uPl"; startswith; fast_pattern; http.host; content:"sikel-corn-sans.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012771; classtype:social-engineering; sid:6012771; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.vwk.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.vwk.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012772; classtype:social-engineering; sid:6012772; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (infoval.lol/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"infoval.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012773; classtype:social-engineering; sid:6012773; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metameaslogiz.gitbook.io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"metameaslogiz.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012774; classtype:social-engineering; sid:6012774; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bet365-6iy.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bet365-6iy.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012775; classtype:social-engineering; sid:6012775; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gemnxixlogen.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gemnxixlogen.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012776; classtype:social-engineering; sid:6012776; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (safe-pvlox.cfd/m/eC514hH4eYS_4mY9l1MrII1z)"; flow:established,to_server; http.uri; content:"/m/eC514hH4eYS_4mY9l1MrII1z"; startswith; fast_pattern; http.host; content:"safe-pvlox.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012777; classtype:social-engineering; sid:6012777; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.a2zapk.co/1368404-spotify-music-and-podcasts-9-0-30-242-ab-experimental-cloned-armeabi-v7a-arm64-v8a-a2z.html)"; flow:established,to_server; http.uri; content:"/1368404-spotify-music-and-podcasts-9-0-30-242-ab-experimental-cloned-armeabi-v7a-arm64-v8a-a2z.html"; startswith; fast_pattern; http.host; content:"www.a2zapk.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012778; classtype:social-engineering; sid:6012778; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brtzxa.cfd/HF)"; flow:established,to_server; http.uri; content:"/HF"; startswith; fast_pattern; http.host; content:"brtzxa.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012779; classtype:social-engineering; sid:6012779; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klelnanzeigen-deutsch.id735904.info/getpaymentm/238112484/m9)"; flow:established,to_server; http.uri; content:"/getpaymentm/238112484/m9"; startswith; fast_pattern; http.host; content:"klelnanzeigen-deutsch.id735904.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012780; classtype:social-engineering; sid:6012780; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (map-iphone.com/QPP)"; flow:established,to_server; http.uri; content:"/QPP"; startswith; fast_pattern; http.host; content:"map-iphone.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012781; classtype:social-engineering; sid:6012781; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (idyllic-bienenstitch-58f9de.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"idyllic-bienenstitch-58f9de.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012782; classtype:social-engineering; sid:6012782; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1xlite-01617.pro/en/block)"; flow:established,to_server; http.uri; content:"/en/block"; startswith; fast_pattern; http.host; content:"1xlite-01617.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012783; classtype:social-engineering; sid:6012783; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klelnanzeigen-deutsch.srvc-de834294.info/getpaymentm/229846930/m9)"; flow:established,to_server; http.uri; content:"/getpaymentm/229846930/m9"; startswith; fast_pattern; http.host; content:"klelnanzeigen-deutsch.srvc-de834294.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012784; classtype:social-engineering; sid:6012784; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.jwc.ronghaihuagong.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.jwc.ronghaihuagong.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012785; classtype:social-engineering; sid:6012785; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robloxi.co/login?returlUrl=1015010701)"; flow:established,to_server; http.uri; content:"/login?returlUrl=1015010701"; startswith; fast_pattern; http.host; content:"robloxi.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012786; classtype:social-engineering; sid:6012786; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netempresas.atualizacao-seguranca.com/login.php?hash=16882277576a2b0f395f6c16.96822531)"; flow:established,to_server; http.uri; content:"/login.php?hash=16882277576a2b0f395f6c16.96822531"; startswith; fast_pattern; http.host; content:"netempresas.atualizacao-seguranca.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012787; classtype:social-engineering; sid:6012787; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amz0n.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amz0n.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012788; classtype:social-engineering; sid:6012788; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (czxiqmvqgnsjnfkdj-gijoxucfyu5dwno1ulmt0m.vercel.app/bsaehwa34rhbsdfbda32s.html)"; flow:established,to_server; http.uri; content:"/bsaehwa34rhbsdfbda32s.html"; startswith; fast_pattern; http.host; content:"czxiqmvqgnsjnfkdj-gijoxucfyu5dwno1ulmt0m.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012789; classtype:social-engineering; sid:6012789; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.authorizedfixednode.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.authorizedfixednode.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012790; classtype:social-engineering; sid:6012790; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.vns9394.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.vns9394.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012791; classtype:social-engineering; sid:6012791; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zonaeventmaterials.web.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zonaeventmaterials.web.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012792; classtype:social-engineering; sid:6012792; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fedexpcf.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fedexpcf.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012793; classtype:social-engineering; sid:6012793; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eb8rvu.top/o/ws6l0/1768848617406#selectedbank9)"; flow:established,to_server; http.uri; content:"/o/ws6l0/1768848617406#selectedbank9"; startswith; fast_pattern; http.host; content:"eb8rvu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012794; classtype:social-engineering; sid:6012794; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a3u2q1.lat/o/ws6l0/1768848617406#selectedbank9)"; flow:established,to_server; http.uri; content:"/o/ws6l0/1768848617406#selectedbank9"; startswith; fast_pattern; http.host; content:"a3u2q1.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012795; classtype:social-engineering; sid:6012795; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcsupportdesk.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pcsupportdesk.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012796; classtype:social-engineering; sid:6012796; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (krishnapriya-78797.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"krishnapriya-78797.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012797; classtype:social-engineering; sid:6012797; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.vipozon.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.vipozon.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012798; classtype:social-engineering; sid:6012798; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hotdoc-rf-pending.com/pages/login.php)"; flow:established,to_server; http.uri; content:"/pages/login.php"; startswith; fast_pattern; http.host; content:"hotdoc-rf-pending.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012799; classtype:social-engineering; sid:6012799; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreibh53t73kz5qwnmfjieva3j3ksdhbltthzlpjys33iws3uryri3vy.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreibh53t73kz5qwnmfjieva3j3ksdhbltthzlpjys33iws3uryri3vy.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012800; classtype:social-engineering; sid:6012800; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.apple-website-clone-liard.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.apple-website-clone-liard.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012801; classtype:social-engineering; sid:6012801; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (satyamsk05.github.io/instagram.site/)"; flow:established,to_server; http.uri; content:"/instagram.site/"; startswith; fast_pattern; http.host; content:"satyamsk05.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012802; classtype:social-engineering; sid:6012802; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1xlite-01617.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1xlite-01617.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012803; classtype:social-engineering; sid:6012803; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiaziuicwhwde6ysxzks4udfr5ud4mutnde32ra26vq5zulhidoqaq.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiaziuicwhwde6ysxzks4udfr5ud4mutnde32ra26vq5zulhidoqaq.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012804; classtype:social-engineering; sid:6012804; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsappclone-inky.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsappclone-inky.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012805; classtype:social-engineering; sid:6012805; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mohdshadav.github.io/Amazon-Clone-Project1/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone-Project1/"; startswith; fast_pattern; http.host; content:"mohdshadav.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012806; classtype:social-engineering; sid:6012806; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (orange513.sjmwu.top/?orange=513)"; flow:established,to_server; http.uri; content:"/?orange=513"; startswith; fast_pattern; http.host; content:"orange513.sjmwu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012807; classtype:social-engineering; sid:6012807; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cliente.oficialrodovia.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cliente.oficialrodovia.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012808; classtype:social-engineering; sid:6012808; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (headcage.info/Q0g0MS1OMTUxNS1EMDkwNjA2/?u=161C1515&e=cotiy64366%40smlmail.com&s3=&s4=&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/Q0g0MS1OMTUxNS1EMDkwNjA2/?u=161C1515&e=cotiy64366%40smlmail.com&s3=&s4=&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"headcage.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012809; classtype:social-engineering; sid:6012809; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xpapsuq.lol/o/ws6l0/1768848617406#selectedbank9)"; flow:established,to_server; http.uri; content:"/o/ws6l0/1768848617406#selectedbank9"; startswith; fast_pattern; http.host; content:"xpapsuq.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012810; classtype:social-engineering; sid:6012810; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kevinulve-dev.github.io/bnp-cib/)"; flow:established,to_server; http.uri; content:"/bnp-cib/"; startswith; fast_pattern; http.host; content:"kevinulve-dev.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012811; classtype:social-engineering; sid:6012811; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nmyuxo.shop/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nmyuxo.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012812; classtype:social-engineering; sid:6012812; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klelnanzeigen-deutsch.srvc-de834294.info/getpaymentm/189494676/m9)"; flow:established,to_server; http.uri; content:"/getpaymentm/189494676/m9"; startswith; fast_pattern; http.host; content:"klelnanzeigen-deutsch.srvc-de834294.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012813; classtype:social-engineering; sid:6012813; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.angkabet39201.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.angkabet39201.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012814; classtype:social-engineering; sid:6012814; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (policycompliancereview.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"policycompliancereview.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012815; classtype:social-engineering; sid:6012815; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (connect.mylittleballoonco.info/41-1511-280526/?u=14C1515&e=oror@e6e51f3b1410b31af47cdea8c08858ac755e.net&s3=&s4=&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/41-1511-280526/?u=14C1515&e=oror@e6e51f3b1410b31af47cdea8c08858ac755e.net&s3=&s4=&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"connect.mylittleballoonco.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012816; classtype:social-engineering; sid:6012816; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-clone-puce-delta.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-clone-puce-delta.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012817; classtype:social-engineering; sid:6012817; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (khushi-kumari98.github.io/flipkart-frontend-clone/)"; flow:established,to_server; http.uri; content:"/flipkart-frontend-clone/"; startswith; fast_pattern; http.host; content:"khushi-kumari98.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012818; classtype:social-engineering; sid:6012818; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365bet987.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.365bet987.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012819; classtype:social-engineering; sid:6012819; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vicsmart173-prog.github.io/FedEx-Express-delivery-company.com/)"; flow:established,to_server; http.uri; content:"/FedEx-Express-delivery-company.com/"; startswith; fast_pattern; http.host; content:"vicsmart173-prog.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012820; classtype:social-engineering; sid:6012820; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cadastro-entregador.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cadastro-entregador.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012821; classtype:social-engineering; sid:6012821; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abbey88bmuwatruc7-0fkvvedfqvd7mcbqx0sedb.vercel.app/bsaehwa34rhbsdfbda32s.html)"; flow:established,to_server; http.uri; content:"/bsaehwa34rhbsdfbda32s.html"; startswith; fast_pattern; http.host; content:"abbey88bmuwatruc7-0fkvvedfqvd7mcbqx0sedb.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012822; classtype:social-engineering; sid:6012822; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortex.lol/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortex.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012823; classtype:social-engineering; sid:6012823; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiclrefg2edsve3usoverjqvpfwsp4qwt4vcv6ebclcwcstp4fry7i.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiclrefg2edsve3usoverjqvpfwsp4qwt4vcv6ebclcwcstp4fry7i.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012824; classtype:social-engineering; sid:6012824; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-plarnix-biz-qolvrax-vromtek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-plarnix-biz-qolvrax-vromtek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012825; classtype:social-engineering; sid:6012825; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.upsxdt.shop/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.upsxdt.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012826; classtype:social-engineering; sid:6012826; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (testing-67.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"testing-67.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012827; classtype:social-engineering; sid:6012827; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bdsyxl.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bdsyxl.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012828; classtype:social-engineering; sid:6012828; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auspost.customerservicew.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auspost.customerservicew.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012829; classtype:social-engineering; sid:6012829; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (berx-c4d2h3hnepbnfhfa.z03.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"berx-c4d2h3hnepbnfhfa.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012830; classtype:social-engineering; sid:6012830; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brtzxv.cfd/HF)"; flow:established,to_server; http.uri; content:"/HF"; startswith; fast_pattern; http.host; content:"brtzxv.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012831; classtype:social-engineering; sid:6012831; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazonmarketing1234.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"amazonmarketing1234.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012832; classtype:social-engineering; sid:6012832; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.109tyesy.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.109tyesy.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012833; classtype:social-engineering; sid:6012833; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aquakey.click/m/lX-uqRzK_35Qh3UsSnT6SZ5m)"; flow:established,to_server; http.uri; content:"/m/lX-uqRzK_35Qh3UsSnT6SZ5m"; startswith; fast_pattern; http.host; content:"aquakey.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012834; classtype:social-engineering; sid:6012834; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dcgqka.shop/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dcgqka.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012835; classtype:social-engineering; sid:6012835; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (caesmarevento.com.br/set/1/1/)"; flow:established,to_server; http.uri; content:"/set/1/1/"; startswith; fast_pattern; http.host; content:"caesmarevento.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012836; classtype:social-engineering; sid:6012836; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rapid-pine-457.allcompredirectportalshare.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rapid-pine-457.allcompredirectportalshare.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012837; classtype:social-engineering; sid:6012837; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-1e1e5882cdef4467b149e1bfab4eb3e6.r2.dev/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-1e1e5882cdef4467b149e1bfab4eb3e6.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012838; classtype:social-engineering; sid:6012838; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.7931187365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.7931187365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012839; classtype:social-engineering; sid:6012839; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (expresshomesolutionllc.info/CH41-N1515-D090606/?e=Tgalet@d59fc8954c59c468e55053f135fc7b20e438.org&s3=Thierry&s4=Baudin&s5=Mypost24pt784721&s6=&s7=&s8=&u=12C1515)"; flow:established,to_server; http.uri; content:"/CH41-N1515-D090606/?e=Tgalet@d59fc8954c59c468e55053f135fc7b20e438.org&s3=Thierry&s4=Baudin&s5=Mypost24pt784721&s6=&s7=&s8=&u=12C1515"; startswith; fast_pattern; http.host; content:"expresshomesolutionllc.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012840; classtype:social-engineering; sid:6012840; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wap.s7pc1yz45n.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wap.s7pc1yz45n.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012841; classtype:social-engineering; sid:6012841; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tiktok.shop599.com/h5/)"; flow:established,to_server; http.uri; content:"/h5/"; startswith; fast_pattern; http.host; content:"tiktok.shop599.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012842; classtype:social-engineering; sid:6012842; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.holibm.shop/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.holibm.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012843; classtype:social-engineering; sid:6012843; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hotdoc-rf-pending.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hotdoc-rf-pending.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012844; classtype:social-engineering; sid:6012844; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (swarajpattnaik84coder.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"swarajpattnaik84coder.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012845; classtype:social-engineering; sid:6012845; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fortnitechecking.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fortnitechecking.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012846; classtype:social-engineering; sid:6012846; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (53ge-tnwz-fa00.blake-wascom-callcmc-com-s-account.workers.dev/f69bd9f5635f40b0?email=@)"; flow:established,to_server; http.uri; content:"/f69bd9f5635f40b0?email=@"; startswith; fast_pattern; http.host; content:"53ge-tnwz-fa00.blake-wascom-callcmc-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012847; classtype:social-engineering; sid:6012847; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sidrachaindexteam.com/wallets/connect/metamask/)"; flow:established,to_server; http.uri; content:"/wallets/connect/metamask/"; startswith; fast_pattern; http.host; content:"sidrachaindexteam.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012848; classtype:social-engineering; sid:6012848; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a1270050.xsph.ru/s3.east-005-a-1db39d6a1b0485b16b052c82a823a006/payment/quickbook-authentication.htm?eta=Sdanio2@68831f8596dbb13cebd2d14b76f84403a1d1.org)"; flow:established,to_server; http.uri; content:"/s3.east-005-a-1db39d6a1b0485b16b052c82a823a006/payment/quickbook-authentication.htm?eta=Sdanio2@68831f8596dbb13cebd2d14b76f84403a1d1.org"; startswith; fast_pattern; http.host; content:"a1270050.xsph.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012849; classtype:social-engineering; sid:6012849; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aquakey.click/m/dFzfMxXeITXmuQUglmsvfann)"; flow:established,to_server; http.uri; content:"/m/dFzfMxXeITXmuQUglmsvfann"; startswith; fast_pattern; http.host; content:"aquakey.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012850; classtype:social-engineering; sid:6012850; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (saibovip144.cc:8989/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"saibovip144.cc:8989"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012851; classtype:social-engineering; sid:6012851; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c4ksw3.cfd/o/ws6l0/1768848617406#selectedbank9)"; flow:established,to_server; http.uri; content:"/o/ws6l0/1768848617406#selectedbank9"; startswith; fast_pattern; http.host; content:"c4ksw3.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012852; classtype:social-engineering; sid:6012852; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (everyday.replacey.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"everyday.replacey.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012853; classtype:social-engineering; sid:6012853; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fdsbu.forms.marketingsbu.com.uy/panel/exportador)"; flow:established,to_server; http.uri; content:"/panel/exportador"; startswith; fast_pattern; http.host; content:"fdsbu.forms.marketingsbu.com.uy"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012854; classtype:social-engineering; sid:6012854; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deltaportallog.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"deltaportallog.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012855; classtype:social-engineering; sid:6012855; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bridge-oi.zapier.app/ioapp)"; flow:established,to_server; http.uri; content:"/ioapp"; startswith; fast_pattern; http.host; content:"bridge-oi.zapier.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012856; classtype:social-engineering; sid:6012856; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deltacollegeu.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"deltacollegeu.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012857; classtype:social-engineering; sid:6012857; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.smbc-card.com/mem/index.jsp#/?conn_id=f929fa02-8a45-409d-bdbf-1629748f2118/)"; flow:established,to_server; http.uri; content:"/mem/index.jsp#/?conn_id=f929fa02-8a45-409d-bdbf-1629748f2118/"; startswith; fast_pattern; http.host; content:"www.smbc-card.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012858; classtype:social-engineering; sid:6012858; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ssuphuld.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"ssuphuld.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012859; classtype:social-engineering; sid:6012859; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sign-in-to-xfinity-1763.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sign-in-to-xfinity-1763.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012860; classtype:social-engineering; sid:6012860; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (newapplyscureappioaergamekrogfaerigkoomgear.bujanoci.net/?ehkmvsduwt)"; flow:established,to_server; http.uri; content:"/?ehkmvsduwt"; startswith; fast_pattern; http.host; content:"newapplyscureappioaergamekrogfaerigkoomgear.bujanoci.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012861; classtype:social-engineering; sid:6012861; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (creditmutuel-opposition.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"creditmutuel-opposition.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012862; classtype:social-engineering; sid:6012862; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (homely-attributes-155419.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"homely-attributes-155419.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012863; classtype:social-engineering; sid:6012863; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (parastesintago.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"parastesintago.click"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012864; classtype:social-engineering; sid:6012864; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (open-ledgrecom.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"open-ledgrecom.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012865; classtype:social-engineering; sid:6012865; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pasastesintag.pics/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pasastesintag.pics"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012866; classtype:social-engineering; sid:6012866; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sbc-verifier-sign-in-eb7663.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sbc-verifier-sign-in-eb7663.webflow.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012867; classtype:social-engineering; sid:6012867; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (n-jp.co/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"n-jp.co"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012868; classtype:social-engineering; sid:6012868; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (987656789.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"987656789.framer.website"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012869; classtype:social-engineering; sid:6012869; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fraiserfromiptoinnovation.com/director-uwp)"; flow:established,to_server; http.uri; content:"/director-uwp"; startswith; fast_pattern; http.host; content:"fraiserfromiptoinnovation.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012870; classtype:social-engineering; sid:6012870; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (caring-quicker-964590.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"caring-quicker-964590.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012871; classtype:social-engineering; sid:6012871; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2026-06-14.sqllq.com/en/?howtosuecslplasma.org#nolanguage)"; flow:established,to_server; http.uri; content:"/en/?howtosuecslplasma.org#nolanguage"; startswith; fast_pattern; http.host; content:"2026-06-14.sqllq.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012872; classtype:social-engineering; sid:6012872; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amzaboprime002.pro/index.php)"; flow:established,to_server; http.uri; content:"/index.php"; startswith; fast_pattern; http.host; content:"amzaboprime002.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6012873; classtype:social-engineering; sid:6012873; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bet365-bet365a-org.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bet365-bet365a-org.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012874; classtype:social-engineering; sid:6012874; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hxkwoy.shop/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hxkwoy.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012875; classtype:social-engineering; sid:6012875; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booking-dubai-desert-safaria.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"booking-dubai-desert-safaria.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012876; classtype:social-engineering; sid:6012876; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.1adt42o0cbo5.com/account/reg?code=20611)"; flow:established,to_server; http.uri; content:"/account/reg?code=20611"; startswith; fast_pattern; http.host; content:"m.1adt42o0cbo5.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012877; classtype:social-engineering; sid:6012877; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xecloud.duckdns.org/cgi-bin/index.ha/)"; flow:established,to_server; http.uri; content:"/cgi-bin/index.ha/"; startswith; fast_pattern; http.host; content:"xecloud.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012878; classtype:social-engineering; sid:6012878; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi991.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi991.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012879; classtype:social-engineering; sid:6012879; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (polyelectrolyte.com/it/fatture/)"; flow:established,to_server; http.uri; content:"/it/fatture/"; startswith; fast_pattern; http.host; content:"polyelectrolyte.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012880; classtype:social-engineering; sid:6012880; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pusatshopee88.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pusatshopee88.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012881; classtype:social-engineering; sid:6012881; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stmaryspavilion.info/48-1576-050626/?u=162C1576&e=mam%40op.pl&s3=an&s4=ewa&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/48-1576-050626/?u=162C1576&e=mam%40op.pl&s3=an&s4=ewa&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"stmaryspavilion.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012882; classtype:social-engineering; sid:6012882; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-plurnex-biz-vroltor-glatik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-plurnex-biz-vroltor-glatik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012883; classtype:social-engineering; sid:6012883; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (satisfied-operator-199590.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"satisfied-operator-199590.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012884; classtype:social-engineering; sid:6012884; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezrrsuite.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezrrsuite.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012885; classtype:social-engineering; sid:6012885; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (truea1hsbdjhbsjhddsjdsd-cbfubtfngrg3gmd0.z02.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"truea1hsbdjhbsjhddsjdsd-cbfubtfngrg3gmd0.z02.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012886; classtype:social-engineering; sid:6012886; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chromeextension.fun/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"chromeextension.fun"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012887; classtype:social-engineering; sid:6012887; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-badge-vip5.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"verify-badge-vip5.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012888; classtype:social-engineering; sid:6012888; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agadvantagegroup.com/public/view/)"; flow:established,to_server; http.uri; content:"/public/view/"; startswith; fast_pattern; http.host; content:"agadvantagegroup.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012889; classtype:social-engineering; sid:6012889; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.w86365.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.w86365.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012890; classtype:social-engineering; sid:6012890; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fortniteinv.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fortniteinv.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012891; classtype:social-engineering; sid:6012891; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vrolnax-biz-slatem-qurnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vrolnax-biz-slatem-qurnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012892; classtype:social-engineering; sid:6012892; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (buzzsphere.org/durhammedical)"; flow:established,to_server; http.uri; content:"/durhammedical"; startswith; fast_pattern; http.host; content:"buzzsphere.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012893; classtype:social-engineering; sid:6012893; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiverr-work-space.pro/project/maria4)"; flow:established,to_server; http.uri; content:"/project/maria4"; startswith; fast_pattern; http.host; content:"fiverr-work-space.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012894; classtype:social-engineering; sid:6012894; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booking-coom-duubai-fllight-tickets.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"booking-coom-duubai-fllight-tickets.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012895; classtype:social-engineering; sid:6012895; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoja73.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoja73.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012896; classtype:social-engineering; sid:6012896; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.start-ledgercom.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.start-ledgercom.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012897; classtype:social-engineering; sid:6012897; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dgyuehuiwan.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.dgyuehuiwan.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012898; classtype:social-engineering; sid:6012898; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cd263423.tw1.ru/CelkemCVT32200/)"; flow:established,to_server; http.uri; content:"/CelkemCVT32200/"; startswith; fast_pattern; http.host; content:"cd263423.tw1.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012899; classtype:social-engineering; sid:6012899; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dexscreener.com.dex-app.co.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dexscreener.com.dex-app.co.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012900; classtype:social-engineering; sid:6012900; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.emtgigdats.space/scpage/Sign%20in%20_%20Scotiabank.htm)"; flow:established,to_server; http.uri; content:"/scpage/Sign%20in%20_%20Scotiabank.htm"; startswith; fast_pattern; http.host; content:"www.emtgigdats.space"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012901; classtype:social-engineering; sid:6012901; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agua-assassina.com/cb/invoice.php)"; flow:established,to_server; http.uri; content:"/cb/invoice.php"; startswith; fast_pattern; http.host; content:"agua-assassina.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012902; classtype:social-engineering; sid:6012902; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (regularisation-cpam.info/pages/captcha.php)"; flow:established,to_server; http.uri; content:"/pages/captcha.php"; startswith; fast_pattern; http.host; content:"regularisation-cpam.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012903; classtype:social-engineering; sid:6012903; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6a2ae34262585f70c408567f--neon-flan-a84962.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6a2ae34262585f70c408567f--neon-flan-a84962.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012904; classtype:social-engineering; sid:6012904; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-badge-vip12.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"verify-badge-vip12.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012905; classtype:social-engineering; sid:6012905; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kkuccoinlogyn.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kkuccoinlogyn.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012906; classtype:social-engineering; sid:6012906; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zoom.allwellhealthcare.com/Mac/utility.php/)"; flow:established,to_server; http.uri; content:"/Mac/utility.php/"; startswith; fast_pattern; http.host; content:"zoom.allwellhealthcare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012907; classtype:social-engineering; sid:6012907; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (regul.rw/work.html)"; flow:established,to_server; http.uri; content:"/work.html"; startswith; fast_pattern; http.host; content:"regul.rw"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012908; classtype:social-engineering; sid:6012908; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.adobeasia.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.adobeasia.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012909; classtype:social-engineering; sid:6012909; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox-tools.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"roblox-tools.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012910; classtype:social-engineering; sid:6012910; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prajapatidhruv1206.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"prajapatidhruv1206.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012911; classtype:social-engineering; sid:6012911; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (naveenrajhari.github.io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"naveenrajhari.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012912; classtype:social-engineering; sid:6012912; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (946302365756.com/web/)"; flow:established,to_server; http.uri; content:"/web/"; startswith; fast_pattern; http.host; content:"946302365756.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012913; classtype:social-engineering; sid:6012913; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netcoins-help-logi--cdn.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netcoins-help-logi--cdn.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012914; classtype:social-engineering; sid:6012914; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.zcw520.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.zcw520.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012915; classtype:social-engineering; sid:6012915; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (im-sravan.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"im-sravan.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012916; classtype:social-engineering; sid:6012916; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (68-210-225-27.cprapid.com/de/update.php?oa9du76b90a8tvzs93aq)"; flow:established,to_server; http.uri; content:"/de/update.php?oa9du76b90a8tvzs93aq"; startswith; fast_pattern; http.host; content:"68-210-225-27.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012917; classtype:social-engineering; sid:6012917; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.pqq.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.pqq.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012918; classtype:social-engineering; sid:6012918; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meateemasklugn.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meateemasklugn.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012919; classtype:social-engineering; sid:6012919; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wy6073.craftum.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wy6073.craftum.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012920; classtype:social-engineering; sid:6012920; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ckramx.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ckramx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012921; classtype:social-engineering; sid:6012921; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-badge-vip30.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"verify-badge-vip30.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012922; classtype:social-engineering; sid:6012922; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tokenpcktoe.pro/security)"; flow:established,to_server; http.uri; content:"/security"; startswith; fast_pattern; http.host; content:"tokenpcktoe.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012923; classtype:social-engineering; sid:6012923; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galabet.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galabet.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012924; classtype:social-engineering; sid:6012924; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (access-ldgerdekstop.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"access-ldgerdekstop.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012925; classtype:social-engineering; sid:6012925; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bitmartlogiene.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bitmartlogiene.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012926; classtype:social-engineering; sid:6012926; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.microsoftonline.hmvegn.ie/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"login.microsoftonline.hmvegn.ie"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012927; classtype:social-engineering; sid:6012927; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pioneering-pomegranate-641565.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pioneering-pomegranate-641565.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012928; classtype:social-engineering; sid:6012928; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinityrefunds.com/token/1CFE8699CF2B4C0A98BA55B86C2611C1)"; flow:established,to_server; http.uri; content:"/token/1CFE8699CF2B4C0A98BA55B86C2611C1"; startswith; fast_pattern; http.host; content:"www.xfinityrefunds.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012929; classtype:social-engineering; sid:6012929; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shareonedrive.iceiy.com/indexupdted.html)"; flow:established,to_server; http.uri; content:"/indexupdted.html"; startswith; fast_pattern; http.host; content:"shareonedrive.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012930; classtype:social-engineering; sid:6012930; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (geaqmuinlogin.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"geaqmuinlogin.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012931; classtype:social-engineering; sid:6012931; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.365365k.app/chs/)"; flow:established,to_server; http.uri; content:"/chs/"; startswith; fast_pattern; http.host; content:"m.365365k.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012932; classtype:social-engineering; sid:6012932; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-badge-vip2.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"verify-badge-vip2.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012933; classtype:social-engineering; sid:6012933; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-badge-vip.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"verify-badge-vip.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012934; classtype:social-engineering; sid:6012934; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comprobar--servicios2026.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comprobar--servicios2026.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012935; classtype:social-engineering; sid:6012935; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kalpanab26.github.io/instagram_clone/)"; flow:established,to_server; http.uri; content:"/instagram_clone/"; startswith; fast_pattern; http.host; content:"kalpanab26.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012936; classtype:social-engineering; sid:6012936; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zn-prosucts-made-in-chinna.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zn-prosucts-made-in-chinna.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012937; classtype:social-engineering; sid:6012937; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (click.tenhoatitude.info/ga/click/2-10604126-10-10376-20272-11277-9a09917b77-786ced0816)"; flow:established,to_server; http.uri; content:"/ga/click/2-10604126-10-10376-20272-11277-9a09917b77-786ced0816"; startswith; fast_pattern; http.host; content:"click.tenhoatitude.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012938; classtype:social-engineering; sid:6012938; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ledger-com-start.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ledger-com-start.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012939; classtype:social-engineering; sid:6012939; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booking-com-dubai-shoppingg.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"booking-com-dubai-shoppingg.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012940; classtype:social-engineering; sid:6012940; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopeejkt789.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopeejkt789.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012941; classtype:social-engineering; sid:6012941; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tyccsyw.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tyccsyw.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012942; classtype:social-engineering; sid:6012942; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kilpad.com/pr/)"; flow:established,to_server; http.uri; content:"/pr/"; startswith; fast_pattern; http.host; content:"kilpad.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012943; classtype:social-engineering; sid:6012943; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (seemvertcertified.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"seemvertcertified.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012944; classtype:social-engineering; sid:6012944; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hcvnk.drxye.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hcvnk.drxye.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012945; classtype:social-engineering; sid:6012945; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.msnservicesecuritym.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.msnservicesecuritym.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012946; classtype:social-engineering; sid:6012946; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kucoreinslogn.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kucoreinslogn.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012947; classtype:social-engineering; sid:6012947; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.luxuryreplicass.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.luxuryreplicass.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012948; classtype:social-engineering; sid:6012948; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-qurnor-biz-slatem-vroltex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-qurnor-biz-slatem-vroltex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012949; classtype:social-engineering; sid:6012949; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (keplrwallet.to/fr-fr/app/)"; flow:established,to_server; http.uri; content:"/fr-fr/app/"; startswith; fast_pattern; http.host; content:"keplrwallet.to"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012950; classtype:social-engineering; sid:6012950; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booking-com-dubai-things-to-doo.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"booking-com-dubai-things-to-doo.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012951; classtype:social-engineering; sid:6012951; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sim-app.info/WhS)"; flow:established,to_server; http.uri; content:"/WhS"; startswith; fast_pattern; http.host; content:"sim-app.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012952; classtype:social-engineering; sid:6012952; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pusatshopee79.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pusatshopee79.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012953; classtype:social-engineering; sid:6012953; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shaw-webmail-109704.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shaw-webmail-109704.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012954; classtype:social-engineering; sid:6012954; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bradwagonergmail.direct.quickconnect.to/cgi-bin/home.ha)"; flow:established,to_server; http.uri; content:"/cgi-bin/home.ha"; startswith; fast_pattern; http.host; content:"www.bradwagonergmail.direct.quickconnect.to"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012955; classtype:social-engineering; sid:6012955; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (proxy-discord.jeemoo.com/category/safety)"; flow:established,to_server; http.uri; content:"/category/safety"; startswith; fast_pattern; http.host; content:"proxy-discord.jeemoo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012956; classtype:social-engineering; sid:6012956; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hwsrv-1330147.hostwindsdns.com/here/sup/login)"; flow:established,to_server; http.uri; content:"/here/sup/login"; startswith; fast_pattern; http.host; content:"hwsrv-1330147.hostwindsdns.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012957; classtype:social-engineering; sid:6012957; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.poijngh.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.poijngh.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012958; classtype:social-engineering; sid:6012958; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (134tyesy.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"134tyesy.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012959; classtype:social-engineering; sid:6012959; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (proxy-discord.jeemoo.com/careers)"; flow:established,to_server; http.uri; content:"/careers"; startswith; fast_pattern; http.host; content:"proxy-discord.jeemoo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012960; classtype:social-engineering; sid:6012960; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortinventary.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortinventary.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012961; classtype:social-engineering; sid:6012961; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adfccc.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"adfccc.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012962; classtype:social-engineering; sid:6012962; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.treziostart.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.treziostart.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012963; classtype:social-engineering; sid:6012963; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tastefuldelights.com.au/docusign/docusignaccess/Windows/utility.php)"; flow:established,to_server; http.uri; content:"/docusign/docusignaccess/Windows/utility.php"; startswith; fast_pattern; http.host; content:"tastefuldelights.com.au"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012964; classtype:social-engineering; sid:6012964; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dardsaaz.com/docusign/Mac/utility.php/)"; flow:established,to_server; http.uri; content:"/docusign/Mac/utility.php/"; startswith; fast_pattern; http.host; content:"dardsaaz.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012965; classtype:social-engineering; sid:6012965; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (traditional-habits-801750.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"traditional-habits-801750.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012966; classtype:social-engineering; sid:6012966; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booking-com-dubai-flight-ticketstour.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"booking-com-dubai-flight-ticketstour.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012967; classtype:social-engineering; sid:6012967; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kumariritu21.github.io/netflix_homepage_clone/)"; flow:established,to_server; http.uri; content:"/netflix_homepage_clone/"; startswith; fast_pattern; http.host; content:"kumariritu21.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012968; classtype:social-engineering; sid:6012968; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.b3550.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.b3550.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012969; classtype:social-engineering; sid:6012969; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-shivang02.vercel.app/pages/browse.html)"; flow:established,to_server; http.uri; content:"/pages/browse.html"; startswith; fast_pattern; http.host; content:"netflix-clone-shivang02.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012970; classtype:social-engineering; sid:6012970; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (absolutecaninepa.com/DocuSign/Mac/utility.php/)"; flow:established,to_server; http.uri; content:"/DocuSign/Mac/utility.php/"; startswith; fast_pattern; http.host; content:"absolutecaninepa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012971; classtype:social-engineering; sid:6012971; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gembualoginm.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gembualoginm.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012972; classtype:social-engineering; sid:6012972; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gala-bet.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gala-bet.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012973; classtype:social-engineering; sid:6012973; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (learn-bridge-trezor-sso-autth.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"learn-bridge-trezor-sso-autth.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012974; classtype:social-engineering; sid:6012974; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shivnandan20070102-tech.github.io/instagram-)"; flow:established,to_server; http.uri; content:"/instagram-"; startswith; fast_pattern; http.host; content:"shivnandan20070102-tech.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012975; classtype:social-engineering; sid:6012975; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rodrigues361.github.io/lovelyweb/)"; flow:established,to_server; http.uri; content:"/lovelyweb/"; startswith; fast_pattern; http.host; content:"rodrigues361.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012976; classtype:social-engineering; sid:6012976; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.linn-eska.de/tuxk1yh/zgil1jk/ordhig1/jloda/0utFix/4c02b195e8d01ff716575ec99299087d/index2.php)"; flow:established,to_server; http.uri; content:"/tuxk1yh/zgil1jk/ordhig1/jloda/0utFix/4c02b195e8d01ff716575ec99299087d/index2.php"; startswith; fast_pattern; http.host; content:"www.linn-eska.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012977; classtype:social-engineering; sid:6012977; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-badge-vip32.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"verify-badge-vip32.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012978; classtype:social-engineering; sid:6012978; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-badge-vip1.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"verify-badge-vip1.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012979; classtype:social-engineering; sid:6012979; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortnitelocker.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortnitelocker.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012980; classtype:social-engineering; sid:6012980; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (discord.365jpshop.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"discord.365jpshop.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012981; classtype:social-engineering; sid:6012981; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booking-comaraab-dubai-packages.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"booking-comaraab-dubai-packages.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012982; classtype:social-engineering; sid:6012982; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bloodravenzone.web.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bloodravenzone.web.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012983; classtype:social-engineering; sid:6012983; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-badge-vip3.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"verify-badge-vip3.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012984; classtype:social-engineering; sid:6012984; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgerrecover.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledgerrecover.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012985; classtype:social-engineering; sid:6012985; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (marketbuffalo.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"marketbuffalo.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012986; classtype:social-engineering; sid:6012986; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dubai-bookingcomdubai.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dubai-bookingcomdubai.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012987; classtype:social-engineering; sid:6012987; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (juno189-vip.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"juno189-vip.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012988; classtype:social-engineering; sid:6012988; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booking-com-dubaii-flights-tickets.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"booking-com-dubaii-flights-tickets.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012989; classtype:social-engineering; sid:6012989; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my-jcb-safe-japanmikuilo.icu/pages/login/index.php)"; flow:established,to_server; http.uri; content:"/pages/login/index.php"; startswith; fast_pattern; http.host; content:"my-jcb-safe-japanmikuilo.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012990; classtype:social-engineering; sid:6012990; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booking-ceom-dubaei-thinges-todeo.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"booking-ceom-dubaei-thinges-todeo.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012991; classtype:social-engineering; sid:6012991; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dubai---booking-com.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dubai---booking-com.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012992; classtype:social-engineering; sid:6012992; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.66xingji.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.66xingji.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012993; classtype:social-engineering; sid:6012993; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fast-mobile-kaiyun.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fast-mobile-kaiyun.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012994; classtype:social-engineering; sid:6012994; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (walletconnect---webapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"walletconnect---webapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012995; classtype:social-engineering; sid:6012995; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (geminulogin.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"geminulogin.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012996; classtype:social-engineering; sid:6012996; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shirim.co.il/marl/)"; flow:established,to_server; http.uri; content:"/marl/"; startswith; fast_pattern; http.host; content:"shirim.co.il"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012997; classtype:social-engineering; sid:6012997; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.greatlakestiles.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.greatlakestiles.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012998; classtype:social-engineering; sid:6012998; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (santander.dispositivoseguranca.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"santander.dispositivoseguranca.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6012999; classtype:social-engineering; sid:6012999; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docsonlineshare.shorepowersolution.net/docusign/d0cs/Windows/utility.php/download/index.php)"; flow:established,to_server; http.uri; content:"/docusign/d0cs/Windows/utility.php/download/index.php"; startswith; fast_pattern; http.host; content:"docsonlineshare.shorepowersolution.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013000; classtype:social-engineering; sid:6013000; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booking-online-dubai.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"booking-online-dubai.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013001; classtype:social-engineering; sid:6013001; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.trezorio-start.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.trezorio-start.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013002; classtype:social-engineering; sid:6013002; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booki-ng-com-dubai-p-acka-ges.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"booki-ng-com-dubai-p-acka-ges.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013003; classtype:social-engineering; sid:6013003; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tyido.azzuk.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tyido.azzuk.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013004; classtype:social-engineering; sid:6013004; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gc-controles.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.gc-controles.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013005; classtype:social-engineering; sid:6013005; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.trezrrsuite.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.trezrrsuite.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013006; classtype:social-engineering; sid:6013006; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (premio.services/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"premio.services"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013007; classtype:social-engineering; sid:6013007; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-i---trustcapital-com---help.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sso-i---trustcapital-com---help.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013008; classtype:social-engineering; sid:6013008; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-badge-vip9.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"verify-badge-vip9.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013009; classtype:social-engineering; sid:6013009; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rpcdebugdapp.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rpcdebugdapp.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013010; classtype:social-engineering; sid:6013010; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chatgpt0005.eu.org/category/product)"; flow:established,to_server; http.uri; content:"/category/product"; startswith; fast_pattern; http.host; content:"chatgpt0005.eu.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013011; classtype:social-engineering; sid:6013011; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (msnservicesecuritym.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"msnservicesecuritym.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013012; classtype:social-engineering; sid:6013012; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help-live-lebbger.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"help-live-lebbger.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013013; classtype:social-engineering; sid:6013013; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (resourceful-season-703701.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"resourceful-season-703701.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013014; classtype:social-engineering; sid:6013014; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chatgpt0005.eu.org/privacy)"; flow:established,to_server; http.uri; content:"/privacy"; startswith; fast_pattern; http.host; content:"chatgpt0005.eu.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013015; classtype:social-engineering; sid:6013015; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.uktzhm.shop/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.uktzhm.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013016; classtype:social-engineering; sid:6013016; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bet365k01.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bet365k01.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013017; classtype:social-engineering; sid:6013017; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chatgpt0005.eu.org/guidelines)"; flow:established,to_server; http.uri; content:"/guidelines"; startswith; fast_pattern; http.host; content:"chatgpt0005.eu.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013018; classtype:social-engineering; sid:6013018; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kwaancs.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kwaancs.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013019; classtype:social-engineering; sid:6013019; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xecloud.duckdns.org/cgi-bin/home.ha)"; flow:established,to_server; http.uri; content:"/cgi-bin/home.ha"; startswith; fast_pattern; http.host; content:"www.xecloud.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013020; classtype:social-engineering; sid:6013020; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wtl.sell.agenuinesaate.com/r.php)"; flow:established,to_server; http.uri; content:"/r.php"; startswith; fast_pattern; http.host; content:"wtl.sell.agenuinesaate.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013021; classtype:social-engineering; sid:6013021; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (profil-facebook-saya.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"profil-facebook-saya.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013022; classtype:social-engineering; sid:6013022; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en-exod-us.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"en-exod-us.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013023; classtype:social-engineering; sid:6013023; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (10cb28b6.76a8277347f52530e1cf979175a178980b3a180d176165c985d85f7e14.pages.dev/?Sverik@f002ffc7bc24891514124ea4a6d8ba6061fe.org)"; flow:established,to_server; http.uri; content:"/?Sverik@f002ffc7bc24891514124ea4a6d8ba6061fe.org"; startswith; fast_pattern; http.host; content:"10cb28b6.76a8277347f52530e1cf979175a178980b3a180d176165c985d85f7e14.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013024; classtype:social-engineering; sid:6013024; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinityorgltd.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinityorgltd.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013025; classtype:social-engineering; sid:6013025; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-harshdeep.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-harshdeep.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013026; classtype:social-engineering; sid:6013026; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (markoonit-g4frhshggrfxbzfz.canadaeast-01.azurewebsites.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"markoonit-g4frhshggrfxbzfz.canadaeast-01.azurewebsites.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013027; classtype:social-engineering; sid:6013027; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinty.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinty.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013028; classtype:social-engineering; sid:6013028; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ladger-com-start.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ladger-com-start.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013029; classtype:social-engineering; sid:6013029; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.amkhni.shop/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.amkhni.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013030; classtype:social-engineering; sid:6013030; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (524446913.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"524446913.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013031; classtype:social-engineering; sid:6013031; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopeejkt678.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopeejkt678.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013032; classtype:social-engineering; sid:6013032; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support-css.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"support-css.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013033; classtype:social-engineering; sid:6013033; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (infomark.lk/s/A.html)"; flow:established,to_server; http.uri; content:"/s/A.html"; startswith; fast_pattern; http.host; content:"infomark.lk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013034; classtype:social-engineering; sid:6013034; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lihi2.me/k5ia1)"; flow:established,to_server; http.uri; content:"/k5ia1"; startswith; fast_pattern; http.host; content:"lihi2.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013035; classtype:social-engineering; sid:6013035; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.click-hostopoint-ch-redirect1221531.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.click-hostopoint-ch-redirect1221531.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013036; classtype:social-engineering; sid:6013036; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (itrusstcapitallogen.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"itrusstcapitallogen.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013037; classtype:social-engineering; sid:6013037; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fortflow.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fortflow.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013038; classtype:social-engineering; sid:6013038; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.profil-facebook-saya.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.profil-facebook-saya.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013039; classtype:social-engineering; sid:6013039; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fnzona.lol/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fnzona.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013040; classtype:social-engineering; sid:6013040; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shingishagafukushi.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shingishagafukushi.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013041; classtype:social-engineering; sid:6013041; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.galabet-yeni-guncel-resmigiris.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.galabet-yeni-guncel-resmigiris.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013042; classtype:social-engineering; sid:6013042; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.134tyesy.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.134tyesy.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013043; classtype:social-engineering; sid:6013043; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xecloud.duckdns.org/cgi-bin/index.ha/)"; flow:established,to_server; http.uri; content:"/cgi-bin/index.ha/"; startswith; fast_pattern; http.host; content:"www.xecloud.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013044; classtype:social-engineering; sid:6013044; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (happy-ice-990137.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"happy-ice-990137.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013045; classtype:social-engineering; sid:6013045; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (regularisation-cpam.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"regularisation-cpam.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013046; classtype:social-engineering; sid:6013046; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiahghyf2d37szl2h3mjae4aqbymgz7wsfv7wyn4aawr5ivlzqptzi.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiahghyf2d37szl2h3mjae4aqbymgz7wsfv7wyn4aawr5ivlzqptzi.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013047; classtype:social-engineering; sid:6013047; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xecloud.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xecloud.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013048; classtype:social-engineering; sid:6013048; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ndaxlogn.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ndaxlogn.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013049; classtype:social-engineering; sid:6013049; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.evvietnam.com/tuhbjgp/ok/t7yh.html)"; flow:established,to_server; http.uri; content:"/tuhbjgp/ok/t7yh.html"; startswith; fast_pattern; http.host; content:"www.evvietnam.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013050; classtype:social-engineering; sid:6013050; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cu684624.tw1.ru/departement/)"; flow:established,to_server; http.uri; content:"/departement/"; startswith; fast_pattern; http.host; content:"cu684624.tw1.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013051; classtype:social-engineering; sid:6013051; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-badge-vip30.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"verify-badge-vip30.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013052; classtype:social-engineering; sid:6013052; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xecloud.duckdns.org/cgi-bin/index.ha)"; flow:established,to_server; http.uri; content:"/cgi-bin/index.ha"; startswith; fast_pattern; http.host; content:"xecloud.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013053; classtype:social-engineering; sid:6013053; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (come.ac/ZE2Ts)"; flow:established,to_server; http.uri; content:"/ZE2Ts"; startswith; fast_pattern; http.host; content:"come.ac"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013054; classtype:social-engineering; sid:6013054; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-fratem-biz-plurnor-qolvik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-fratem-biz-plurnor-qolvik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013055; classtype:social-engineering; sid:6013055; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-badge-vip20.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"verify-badge-vip20.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013056; classtype:social-engineering; sid:6013056; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-profile-login.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-profile-login.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013057; classtype:social-engineering; sid:6013057; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.adfccc.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.adfccc.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013058; classtype:social-engineering; sid:6013058; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth--app--kucoin--sso--cdnn.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auth--app--kucoin--sso--cdnn.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013059; classtype:social-engineering; sid:6013059; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wordpress-212477-0.cloudclusters.net/JseXMvTnViM/swisspass-sbb/s/payment.php)"; flow:established,to_server; http.uri; content:"/JseXMvTnViM/swisspass-sbb/s/payment.php"; startswith; fast_pattern; http.host; content:"wordpress-212477-0.cloudclusters.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013060; classtype:social-engineering; sid:6013060; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abgctid.wpenginepowered.com/trma/)"; flow:established,to_server; http.uri; content:"/trma/"; startswith; fast_pattern; http.host; content:"abgctid.wpenginepowered.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013061; classtype:social-engineering; sid:6013061; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accessinvite.abrdns.com/K/comps.php)"; flow:established,to_server; http.uri; content:"/K/comps.php"; startswith; fast_pattern; http.host; content:"accessinvite.abrdns.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013062; classtype:social-engineering; sid:6013062; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ledgerlive-downld.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ledgerlive-downld.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013063; classtype:social-engineering; sid:6013063; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (carprimp.info/CH41-N1515-D090606/?u=83C1515&e=nelanz@c9c3f8bbfcc22b0ca53f46e042fad9be0fc5.net&s3=&s4=&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/CH41-N1515-D090606/?u=83C1515&e=nelanz@c9c3f8bbfcc22b0ca53f46e042fad9be0fc5.net&s3=&s4=&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"carprimp.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013064; classtype:social-engineering; sid:6013064; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gsantos-ob.github.io/instagram)"; flow:established,to_server; http.uri; content:"/instagram"; startswith; fast_pattern; http.host; content:"gsantos-ob.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013065; classtype:social-engineering; sid:6013065; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-badge-vip19.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"verify-badge-vip19.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013066; classtype:social-engineering; sid:6013066; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.emtgigdats.space/scpage/RBC%20Royal%20Bank%20%E2%80%93%20Secure%20Sign%20In.htm)"; flow:established,to_server; http.uri; content:"/scpage/RBC%20Royal%20Bank%20%E2%80%93%20Secure%20Sign%20In.htm"; startswith; fast_pattern; http.host; content:"www.emtgigdats.space"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013067; classtype:social-engineering; sid:6013067; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-badge-vip121.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"verify-badge-vip121.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013068; classtype:social-engineering; sid:6013068; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (santander.dispositivoseguranca.com/inicio)"; flow:established,to_server; http.uri; content:"/inicio"; startswith; fast_pattern; http.host; content:"santander.dispositivoseguranca.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013069; classtype:social-engineering; sid:6013069; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cryptowalleet.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cryptowalleet.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013070; classtype:social-engineering; sid:6013070; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galabetgiris.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galabetgiris.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013071; classtype:social-engineering; sid:6013071; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (guide-ledgr-en.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"guide-ledgr-en.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013072; classtype:social-engineering; sid:6013072; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d259p54wqxi9ep.cloudfront.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d259p54wqxi9ep.cloudfront.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013073; classtype:social-engineering; sid:6013073; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-profile-login.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-profile-login.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013074; classtype:social-engineering; sid:6013074; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (star1-fedtgke2bkdfhzdz.z02.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"star1-fedtgke2bkdfhzdz.z02.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013075; classtype:social-engineering; sid:6013075; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreibym46z7vd4aovjmufkopyilxkmhu2nm4iucykhgvplzo5pmnw52i.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreibym46z7vd4aovjmufkopyilxkmhu2nm4iucykhgvplzo5pmnw52i.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013076; classtype:social-engineering; sid:6013076; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (11-ese.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"11-ese.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013077; classtype:social-engineering; sid:6013077; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xn--metamasklogin-lobs.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xn--metamasklogin-lobs.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013078; classtype:social-engineering; sid:6013078; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tokeonpnaket.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.tokeonpnaket.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013079; classtype:social-engineering; sid:6013079; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kuionlogins.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kuionlogins.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013080; classtype:social-engineering; sid:6013080; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (misruleoflaw.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"misruleoflaw.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013081; classtype:social-engineering; sid:6013081; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.muxubshxy.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.muxubshxy.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013082; classtype:social-engineering; sid:6013082; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (profycom.rs/feisbuck-456756454645/)"; flow:established,to_server; http.uri; content:"/feisbuck-456756454645/"; startswith; fast_pattern; http.host; content:"profycom.rs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013083; classtype:social-engineering; sid:6013083; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-3f081ad7284d4ae088815e99acb1811a.r2.dev/zmb.html)"; flow:established,to_server; http.uri; content:"/zmb.html"; startswith; fast_pattern; http.host; content:"pub-3f081ad7284d4ae088815e99acb1811a.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013084; classtype:social-engineering; sid:6013084; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (poijngh.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"poijngh.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013085; classtype:social-engineering; sid:6013085; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kucoin_loiigin.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kucoin_loiigin.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013086; classtype:social-engineering; sid:6013086; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoja74.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoja74.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013087; classtype:social-engineering; sid:6013087; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xecloud.duckdns.org/cgi-bin/home.ha)"; flow:established,to_server; http.uri; content:"/cgi-bin/home.ha"; startswith; fast_pattern; http.host; content:"xecloud.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013088; classtype:social-engineering; sid:6013088; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-com-start.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-com-start.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013089; classtype:social-engineering; sid:6013089; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xecloud.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xecloud.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013090; classtype:social-engineering; sid:6013090; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tiktoksecurity.github.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tiktoksecurity.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013091; classtype:social-engineering; sid:6013091; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bybit8.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bybit8.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013092; classtype:social-engineering; sid:6013092; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (seemvertcertified.wasmer.app/southwestwater)"; flow:established,to_server; http.uri; content:"/southwestwater"; startswith; fast_pattern; http.host; content:"seemvertcertified.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013093; classtype:social-engineering; sid:6013093; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pesta-shopee3777.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pesta-shopee3777.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013094; classtype:social-engineering; sid:6013094; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booking-com-dubai-flight-ticke-a.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"booking-com-dubai-flight-ticke-a.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013095; classtype:social-engineering; sid:6013095; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (guide-bridge-en.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"guide-bridge-en.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013096; classtype:social-engineering; sid:6013096; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (santander.dispositivoseguranca.com/baser)"; flow:established,to_server; http.uri; content:"/baser"; startswith; fast_pattern; http.host; content:"santander.dispositivoseguranca.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013097; classtype:social-engineering; sid:6013097; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (perfilexclusivo.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"perfilexclusivo.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013098; classtype:social-engineering; sid:6013098; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ups.hqrmvpkt.cfd/en/)"; flow:established,to_server; http.uri; content:"/en/"; startswith; fast_pattern; http.host; content:"ups.hqrmvpkt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013099; classtype:social-engineering; sid:6013099; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (arabbooking-com-dubai-desert-safari.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"arabbooking-com-dubai-desert-safari.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013100; classtype:social-engineering; sid:6013100; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-badge-vip22.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"verify-badge-vip22.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013101; classtype:social-engineering; sid:6013101; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pafoved.net/noblefs)"; flow:established,to_server; http.uri; content:"/noblefs"; startswith; fast_pattern; http.host; content:"pafoved.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013102; classtype:social-engineering; sid:6013102; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tracking.sellandsell.com/dashboard/images/.jakH/)"; flow:established,to_server; http.uri; content:"/dashboard/images/.jakH/"; startswith; fast_pattern; http.host; content:"tracking.sellandsell.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013103; classtype:social-engineering; sid:6013103; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booking---comsdubai.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"booking---comsdubai.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013104; classtype:social-engineering; sid:6013104; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fortno.lol/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fortno.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013105; classtype:social-engineering; sid:6013105; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yosimasa.co.jp/wp-content/online-fb-ads/login/)"; flow:established,to_server; http.uri; content:"/wp-content/online-fb-ads/login/"; startswith; fast_pattern; http.host; content:"yosimasa.co.jp"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013106; classtype:social-engineering; sid:6013106; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bet365k01.com/__verify?next=/)"; flow:established,to_server; http.uri; content:"/__verify?next=/"; startswith; fast_pattern; http.host; content:"www.bet365k01.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013107; classtype:social-engineering; sid:6013107; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.galasongirisler.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.galasongirisler.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013108; classtype:social-engineering; sid:6013108; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (beneficioexclusivo.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"beneficioexclusivo.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013109; classtype:social-engineering; sid:6013109; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vjalenn.github.io/yeadiscord)"; flow:established,to_server; http.uri; content:"/yeadiscord"; startswith; fast_pattern; http.host; content:"vjalenn.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013110; classtype:social-engineering; sid:6013110; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klelnanzeigen-deutch.austinsecurityservice.com/receive/order/gA0COPvVJvW?r=0x22&__cf_chl_rt_tk=ElU.RyyWB_QLPng3vYhF4qTjhzlu1X2s2Zz5gE4VeV8-1781450646-1.0.1.1-iMWjXrsEKTjr2F9AWGW8oMXEjFpVdwJBMsOHjcLDqwE)"; flow:established,to_server; http.uri; content:"/receive/order/gA0COPvVJvW?r=0x22&__cf_chl_rt_tk=ElU.RyyWB_QLPng3vYhF4qTjhzlu1X2s2Zz5gE4VeV8-1781450646-1.0.1.1-iMWjXrsEKTjr2F9AWGW8oMXEjFpVdwJBMsOHjcLDqwE"; startswith; fast_pattern; http.host; content:"klelnanzeigen-deutch.austinsecurityservice.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013111; classtype:social-engineering; sid:6013111; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klelnanzeigen-deutch.austinsecurityservice.com/receive/order/gA0COPvVJvW?r=0x22)"; flow:established,to_server; http.uri; content:"/receive/order/gA0COPvVJvW?r=0x22"; startswith; fast_pattern; http.host; content:"klelnanzeigen-deutch.austinsecurityservice.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013112; classtype:social-engineering; sid:6013112; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dc.crsorgi.gov.in.codezfree.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dc.crsorgi.gov.in.codezfree.online"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013113; classtype:social-engineering; sid:6013113; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yahoojkj.github.io/hxxp-yahoomailsignin/)"; flow:established,to_server; http.uri; content:"/hxxp-yahoomailsignin/"; startswith; fast_pattern; http.host; content:"yahoojkj.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013114; classtype:social-engineering; sid:6013114; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dc.crsorgi.gov.in.index.dc-p.xyz/crs/)"; flow:established,to_server; http.uri; content:"/crs/"; startswith; fast_pattern; http.host; content:"dc.crsorgi.gov.in.index.dc-p.xyz"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013115; classtype:social-engineering; sid:6013115; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (titanprint.co.in/dashboard/login.php)"; flow:established,to_server; http.uri; content:"/dashboard/login.php"; startswith; fast_pattern; http.host; content:"titanprint.co.in"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013116; classtype:social-engineering; sid:6013116; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klelnanzeigen-deutch.austinsecurityservice.com/receive/order/oKWkvFG4Bwd?r=0x21&__cf_chl_rt_tk=om7tEshAqlfrgiiISSoXMPdJZLThU1PIqd0WXwURtmw-1781452876-1.0.1.1-95vnakRTA9c9JS.cN2SR5gJVRlzTOM79Xaq6T7zqr68)"; flow:established,to_server; http.uri; content:"/receive/order/oKWkvFG4Bwd?r=0x21&__cf_chl_rt_tk=om7tEshAqlfrgiiISSoXMPdJZLThU1PIqd0WXwURtmw-1781452876-1.0.1.1-95vnakRTA9c9JS.cN2SR5gJVRlzTOM79Xaq6T7zqr68"; startswith; fast_pattern; http.host; content:"klelnanzeigen-deutch.austinsecurityservice.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013117; classtype:social-engineering; sid:6013117; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dc.crsorgi.gov.in.verifyy.in/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dc.crsorgi.gov.in.verifyy.in"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013118; classtype:social-engineering; sid:6013118; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my-avrfct.icu/?secure_connect=2f2*f*&_subid=1sd8jpm.50.1ai0p&_token=1r9o4m7ck07iu.1781461379.20.19801685e0b4df0e40e430325c7aa553)"; flow:established,to_server; http.uri; content:"/?secure_connect=2f2*f*&_subid=1sd8jpm.50.1ai0p&_token=1r9o4m7ck07iu.1781461379.20.19801685e0b4df0e40e430325c7aa553"; startswith; fast_pattern; http.host; content:"my-avrfct.icu"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013119; classtype:social-engineering; sid:6013119; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (markatuna.com/docusign/docusign/Windows/utility.php)"; flow:established,to_server; http.uri; content:"/docusign/docusign/Windows/utility.php"; startswith; fast_pattern; http.host; content:"markatuna.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013120; classtype:social-engineering; sid:6013120; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (debak.ciamlogin.com/b4d386f9-19ed-4665-8274-643f6e094e6d/oauth2/v2.0/authorize?client_id=bf4983a9-1136-48b8-9304-04b416971e04&redirect_uri=https%3A%2F%2Fbitvavo.debak.nl%2Fsignin-oidc&response_type=id_token&scope=openid%20profile&response_mode=form_post&nonce=638855017811426730.YWQ5NWUwODUtYWZiNS00NDUyLTk0MjEtOWY1NjQzMmMzNzcwOTQwNDkzZDEtOGY0My00ZjI5LWFlMmMtYjNmNzBhZmNiMDg1&client_info=1&x-client-brkrver=IDWeb.3.9.1.0&state=CfDJ8Ktd8h2MRhdAsLHpuml4G8M9-fMPpYYDLACij6bjW8A5azvuDsRWtg39-FDopxWtyvlKM7sPmKNCwkwOhRdvtR1JZlxTyS0iSWq7wO7JTPGpstE_Xi_yJQoX81eH0cRaOI_mHe8tbyQTuCtNUfS1rCtZZf758oBdJpkyVUY4PXRzhYIGC1YiQzNg_xh8ZrcWL4xjTzKsiWSPpy3cHv-D05ExVfUTkGRdnVwWp0IV35kR-KpvcGfWmbDCGHFbJFBY5Nioy0akpReudnzqfOZfVmJo2tz74Wzk81HyO5PpRpXi&x-client-SKU=ID_NET9_0&x-client-ver=8.10.0.0)"; flow:established,to_server; http.uri; content:"/b4d386f9-19ed-4665-8274-643f6e094e6d/oauth2/v2.0/authorize?client_id=bf4983a9-1136-48b8-9304-04b416971e04&redirect_uri=https%3A%2F%2Fbitvavo.debak.nl%2Fsignin-oidc&response_type=id_token&scope=openid%20profile&response_mode=form_post&nonce=638855017811426730.YWQ5NWUwODUtYWZiNS00NDUyLTk0MjEtOWY1NjQzMmMzNzcwOTQwNDkzZDEtOGY0My00ZjI5LWFlMmMtYjNmNzBhZmNiMDg1&client_info=1&x-client-brkrver=IDWeb.3.9.1.0&state=CfDJ8Ktd8h2MRhdAsLHpuml4G8M9-fMPpYYDLACij6bjW8A5azvuDsRWtg39-FDopxWtyvlKM7sPmKNCwkwOhRdvtR1JZlxTyS0iSWq7wO7JTPGpstE_Xi_yJQoX81eH0cRaOI_mHe8tbyQTuCtNUfS1rCtZZf758oBdJpkyVUY4PXRzhYIGC1YiQzNg_xh8ZrcWL4xjTzKsiWSPpy3cHv-D05ExVfUTkGRdnVwWp0IV35kR-KpvcGfWmbDCGHFbJFBY5Nioy0akpReudnzqfOZfVmJo2tz74Wzk81HyO5PpRpXi&x-client-SKU=ID_NET9_0&x-client-ver=8.10.0.0"; startswith; fast_pattern; http.host; content:"debak.ciamlogin.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013121; classtype:social-engineering; sid:6013121; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (user-support.online/api/agent/download/6a22e84654ddf3633644d077?type=exe)"; flow:established,to_server; http.uri; content:"/api/agent/download/6a22e84654ddf3633644d077?type=exe"; startswith; fast_pattern; http.host; content:"user-support.online"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013122; classtype:social-engineering; sid:6013122; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dc.crsorgi.gov.ec.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dc.crsorgi.gov.ec.cc"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013123; classtype:social-engineering; sid:6013123; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (user-support.online/api/agent/download/6a22e84654ddf3633644d077?type=vbs)"; flow:established,to_server; http.uri; content:"/api/agent/download/6a22e84654ddf3633644d077?type=vbs"; startswith; fast_pattern; http.host; content:"user-support.online"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013124; classtype:social-engineering; sid:6013124; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klelnanzeigen-deutch.austinsecurityservice.com/receive/order/EWYbgtQxmkR?r=0x22&__cf_chl_rt_tk=_5A46duec8NLLZOAOAkA9e1YEHPdw0VZ4CH35LOpjF8-1781452778-1.0.1.1-ChXAXl3StbBQayGpAX6Fi_S3YYPySb0RcHTe56AZNCg)"; flow:established,to_server; http.uri; content:"/receive/order/EWYbgtQxmkR?r=0x22&__cf_chl_rt_tk=_5A46duec8NLLZOAOAkA9e1YEHPdw0VZ4CH35LOpjF8-1781452778-1.0.1.1-ChXAXl3StbBQayGpAX6Fi_S3YYPySb0RcHTe56AZNCg"; startswith; fast_pattern; http.host; content:"klelnanzeigen-deutch.austinsecurityservice.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013125; classtype:social-engineering; sid:6013125; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (padisahbet1102.com/auth/giris?next=%2F)"; flow:established,to_server; http.uri; content:"/auth/giris?next=%2F"; startswith; fast_pattern; http.host; content:"padisahbet1102.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013126; classtype:social-engineering; sid:6013126; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rshicz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rshicz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013127; classtype:social-engineering; sid:6013127; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-bebidasgelada-ze.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-bebidasgelada-ze.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013128; classtype:social-engineering; sid:6013128; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myjcb-safecjeckpor.icu/pages/login/index.php/)"; flow:established,to_server; http.uri; content:"/pages/login/index.php/"; startswith; fast_pattern; http.host; content:"myjcb-safecjeckpor.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013129; classtype:social-engineering; sid:6013129; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kucoinloginstation.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kucoinloginstation.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013130; classtype:social-engineering; sid:6013130; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ssl.zoi9.pro/h5/)"; flow:established,to_server; http.uri; content:"/h5/"; startswith; fast_pattern; http.host; content:"ssl.zoi9.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013131; classtype:social-engineering; sid:6013131; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usmanmani147.github.io/My-First-Clone-/)"; flow:established,to_server; http.uri; content:"/My-First-Clone-/"; startswith; fast_pattern; http.host; content:"usmanmani147.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013132; classtype:social-engineering; sid:6013132; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accepted-lime-odw5xh6e-dpk7y3dsrvmv.edgeone.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"accepted-lime-odw5xh6e-dpk7y3dsrvmv.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013133; classtype:social-engineering; sid:6013133; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (indoorscout.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"indoorscout.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013134; classtype:social-engineering; sid:6013134; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bank-of-america.directhr.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bank-of-america.directhr.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013135; classtype:social-engineering; sid:6013135; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pensilvania.club/personal/sander/)"; flow:established,to_server; http.uri; content:"/personal/sander/"; startswith; fast_pattern; http.host; content:"pensilvania.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013136; classtype:social-engineering; sid:6013136; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dhsingh735222.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"dhsingh735222.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013137; classtype:social-engineering; sid:6013137; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (program-resmi789.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"program-resmi789.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013138; classtype:social-engineering; sid:6013138; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (areeba-noor-ui.github.io/Amazon_Clone)"; flow:established,to_server; http.uri; content:"/Amazon_Clone"; startswith; fast_pattern; http.host; content:"areeba-noor-ui.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013139; classtype:social-engineering; sid:6013139; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (creatingfinanopportunitie.free.nf/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"creatingfinanopportunitie.free.nf"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013140; classtype:social-engineering; sid:6013140; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.zoi9.pro/h5/)"; flow:established,to_server; http.uri; content:"/h5/"; startswith; fast_pattern; http.host; content:"www.zoi9.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013141; classtype:social-engineering; sid:6013141; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.zff.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.zff.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013142; classtype:social-engineering; sid:6013142; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verificarcuenta365.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"verificarcuenta365.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013143; classtype:social-engineering; sid:6013143; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tioshxnsu.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.tioshxnsu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013144; classtype:social-engineering; sid:6013144; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tonken.cc/download/)"; flow:established,to_server; http.uri; content:"/download/"; startswith; fast_pattern; http.host; content:"www.tonken.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013145; classtype:social-engineering; sid:6013145; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-entregass24h-ze.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-entregass24h-ze.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013146; classtype:social-engineering; sid:6013146; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-bebidasdoze.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-bebidasdoze.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013147; classtype:social-engineering; sid:6013147; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (followcheck.account-info.email/6197094-oH1faBZb-PKS9Q)"; flow:established,to_server; http.uri; content:"/6197094-oH1faBZb-PKS9Q"; startswith; fast_pattern; http.host; content:"followcheck.account-info.email"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013148; classtype:social-engineering; sid:6013148; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.hmvegn.ie/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"login.hmvegn.ie"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013149; classtype:social-engineering; sid:6013149; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (down-token.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"down-token.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013150; classtype:social-engineering; sid:6013150; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atikfoysal-web.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"atikfoysal-web.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013151; classtype:social-engineering; sid:6013151; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pusatshopee99.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pusatshopee99.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013152; classtype:social-engineering; sid:6013152; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-clone-beta-gules.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-clone-beta-gules.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013153; classtype:social-engineering; sid:6013153; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee9499.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopee9499.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013154; classtype:social-engineering; sid:6013154; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-deliveryss24h-ze.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-deliveryss24h-ze.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013155; classtype:social-engineering; sid:6013155; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezoapp-page.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezoapp-page.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013156; classtype:social-engineering; sid:6013156; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (interactive-checklist-656460.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"interactive-checklist-656460.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013157; classtype:social-engineering; sid:6013157; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (llwhgcj58w.zoi9.pro/h5/)"; flow:established,to_server; http.uri; content:"/h5/"; startswith; fast_pattern; http.host; content:"llwhgcj58w.zoi9.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013158; classtype:social-engineering; sid:6013158; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (markatuna.com/docusign/docusign/Windows/utility.php)"; flow:established,to_server; http.uri; content:"/docusign/docusign/Windows/utility.php"; startswith; fast_pattern; http.host; content:"markatuna.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013159; classtype:social-engineering; sid:6013159; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (studio3-st3.com/document.php)"; flow:established,to_server; http.uri; content:"/document.php"; startswith; fast_pattern; http.host; content:"studio3-st3.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013160; classtype:social-engineering; sid:6013160; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jj7765.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jj7765.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013161; classtype:social-engineering; sid:6013161; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.adb-secure.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.adb-secure.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013162; classtype:social-engineering; sid:6013162; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mckinseyandcompany.uk/mymts/mtsmail/)"; flow:established,to_server; http.uri; content:"/mymts/mtsmail/"; startswith; fast_pattern; http.host; content:"mckinseyandcompany.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013163; classtype:social-engineering; sid:6013163; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pcswap.dev/portfolio)"; flow:established,to_server; http.uri; content:"/portfolio"; startswith; fast_pattern; http.host; content:"pcswap.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013164; classtype:social-engineering; sid:6013164; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gemanelogin.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gemanelogin.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013165; classtype:social-engineering; sid:6013165; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (steamcomimunity.com/tradeoffer/new/partner=783662133token=l4hhebGA21835)"; flow:established,to_server; http.uri; content:"/tradeoffer/new/partner=783662133token=l4hhebGA21835"; startswith; fast_pattern; http.host; content:"steamcomimunity.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013166; classtype:social-engineering; sid:6013166; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store.citiretailservices.citibankonlline.com/?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTc4MTM4OTQ0NywiaWF0IjoxNzgxMzgyMjQ3LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIzMnNicmRwcG04Y3FudDlvbW8ybDRxOGUiLCJuYmYiOjE3ODEzODIyNDcsInRzIjoxNzgxMzgyMjQ3MjY5NjQyfQ.vlmmHjvnIhRPygyjHLRUd9ITIWYQij9D1wDqJV9rFlI&sid=d414d827-6765-11f1-9ecd-d8df52ce385d)"; flow:established,to_server; http.uri; content:"/?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTc4MTM4OTQ0NywiaWF0IjoxNzgxMzgyMjQ3LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIzMnNicmRwcG04Y3FudDlvbW8ybDRxOGUiLCJuYmYiOjE3ODEzODIyNDcsInRzIjoxNzgxMzgyMjQ3MjY5NjQyfQ.vlmmHjvnIhRPygyjHLRUd9ITIWYQij9D1wDqJV9rFlI&sid=d414d827-6765-11f1-9ecd-d8df52ce385d"; startswith; fast_pattern; http.host; content:"store.citiretailservices.citibankonlline.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013167; classtype:social-engineering; sid:6013167; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docusign-firmar.github.io/mexico)"; flow:established,to_server; http.uri; content:"/mexico"; startswith; fast_pattern; http.host; content:"docusign-firmar.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013168; classtype:social-engineering; sid:6013168; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.verificarcuenta365.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.verificarcuenta365.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013169; classtype:social-engineering; sid:6013169; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dlxlggrotlioconk3riv.zoi9.pro/h5/)"; flow:established,to_server; http.uri; content:"/h5/"; startswith; fast_pattern; http.host; content:"dlxlggrotlioconk3riv.zoi9.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013170; classtype:social-engineering; sid:6013170; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kishan814.github.io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"kishan814.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013171; classtype:social-engineering; sid:6013171; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.amshopoo.com/mobile/)"; flow:established,to_server; http.uri; content:"/mobile/"; startswith; fast_pattern; http.host; content:"m.amshopoo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013172; classtype:social-engineering; sid:6013172; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tkiltokdownload.com/h5/)"; flow:established,to_server; http.uri; content:"/h5/"; startswith; fast_pattern; http.host; content:"tkiltokdownload.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013173; classtype:social-engineering; sid:6013173; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (santandervidaygenerales.actions-online.com/?rid=1R9cXF3)"; flow:established,to_server; http.uri; content:"/?rid=1R9cXF3"; startswith; fast_pattern; http.host; content:"santandervidaygenerales.actions-online.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013174; classtype:social-engineering; sid:6013174; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (godisgreat1000x-hub.github.io/admin.html/)"; flow:established,to_server; http.uri; content:"/admin.html/"; startswith; fast_pattern; http.host; content:"godisgreat1000x-hub.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013175; classtype:social-engineering; sid:6013175; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kiroamen.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"kiroamen.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013176; classtype:social-engineering; sid:6013176; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-deliverysze-24h.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-deliverysze-24h.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013177; classtype:social-engineering; sid:6013177; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-git-06-09-fixwebtdpallnetworksoptionupdatest-619c96-uniswap.vercel.app/sell)"; flow:established,to_server; http.uri; content:"/sell"; startswith; fast_pattern; http.host; content:"web-git-06-09-fixwebtdpallnetworksoptionupdatest-619c96-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013178; classtype:social-engineering; sid:6013178; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (teams-jk.com/p/fjbd-cbcr/ypixvvaa/)"; flow:established,to_server; http.uri; content:"/p/fjbd-cbcr/ypixvvaa/"; startswith; fast_pattern; http.host; content:"teams-jk.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013179; classtype:social-engineering; sid:6013179; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.matesanto.com/choiceandcontrol/choiceandcontrol.htm)"; flow:established,to_server; http.uri; content:"/choiceandcontrol/choiceandcontrol.htm"; startswith; fast_pattern; http.host; content:"www.matesanto.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013180; classtype:social-engineering; sid:6013180; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.365bet332.com/eng/home/index/)"; flow:established,to_server; http.uri; content:"/eng/home/index/"; startswith; fast_pattern; http.host; content:"m.365bet332.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013181; classtype:social-engineering; sid:6013181; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (22001775.com:5569/m/)"; flow:established,to_server; http.uri; content:"/m/"; startswith; fast_pattern; http.host; content:"22001775.com:5569"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013182; classtype:social-engineering; sid:6013182; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-clone-beta-gules.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-clone-beta-gules.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013183; classtype:social-engineering; sid:6013183; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pcswap.dev/stocks)"; flow:established,to_server; http.uri; content:"/stocks"; startswith; fast_pattern; http.host; content:"pcswap.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013184; classtype:social-engineering; sid:6013184; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.34567yh.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.34567yh.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013185; classtype:social-engineering; sid:6013185; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (padisahbet1102.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"padisahbet1102.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013186; classtype:social-engineering; sid:6013186; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (device-iso.com/script/2026_passcode6_login)"; flow:established,to_server; http.uri; content:"/script/2026_passcode6_login"; startswith; fast_pattern; http.host; content:"device-iso.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013187; classtype:social-engineering; sid:6013187; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (impactsolutionsecuador.free.nf/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"impactsolutionsecuador.free.nf"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013188; classtype:social-engineering; sid:6013188; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee7389.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopee7389.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013189; classtype:social-engineering; sid:6013189; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.us.usps-stampstore.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.us.usps-stampstore.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013190; classtype:social-engineering; sid:6013190; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.support-css.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.support-css.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013191; classtype:social-engineering; sid:6013191; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cloudflare-workers-pages-vless.lixian2000.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cloudflare-workers-pages-vless.lixian2000.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013192; classtype:social-engineering; sid:6013192; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (akhilesh-m8.github.io/Netflix-UI-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-UI-clone/"; startswith; fast_pattern; http.host; content:"akhilesh-m8.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013193; classtype:social-engineering; sid:6013193; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (slgnahrefs.com/k1/discord)"; flow:established,to_server; http.uri; content:"/k1/discord"; startswith; fast_pattern; http.host; content:"slgnahrefs.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013194; classtype:social-engineering; sid:6013194; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en-ledger-com-cdn.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"en-ledger-com-cdn.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013195; classtype:social-engineering; sid:6013195; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fishing-app.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fishing-app.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013196; classtype:social-engineering; sid:6013196; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.program-resmi789.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.program-resmi789.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013197; classtype:social-engineering; sid:6013197; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app3-1q9.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app3-1q9.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013198; classtype:social-engineering; sid:6013198; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (madamabistrot.hostel.town/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"madamabistrot.hostel.town"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013199; classtype:social-engineering; sid:6013199; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-badge-vip4.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"verify-badge-vip4.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013200; classtype:social-engineering; sid:6013200; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.aloi-0a8j.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.aloi-0a8j.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013201; classtype:social-engineering; sid:6013201; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365bet355.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.365bet355.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013202; classtype:social-engineering; sid:6013202; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brilliant-sherbet-6f0a46.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"brilliant-sherbet-6f0a46.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013203; classtype:social-engineering; sid:6013203; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.33771775.com:5569/m/)"; flow:established,to_server; http.uri; content:"/m/"; startswith; fast_pattern; http.host; content:"www.33771775.com:5569"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013204; classtype:social-engineering; sid:6013204; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pemenangshopee555.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"pemenangshopee555.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013205; classtype:social-engineering; sid:6013205; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (22111775.com:5569/m/)"; flow:established,to_server; http.uri; content:"/m/"; startswith; fast_pattern; http.host; content:"22111775.com:5569"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013206; classtype:social-engineering; sid:6013206; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fdis.api.lifesecretary.com/privacy)"; flow:established,to_server; http.uri; content:"/privacy"; startswith; fast_pattern; http.host; content:"fdis.api.lifesecretary.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013207; classtype:social-engineering; sid:6013207; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinityaccounthome.20-228-132-238.cpanel.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfinityaccounthome.20-228-132-238.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013208; classtype:social-engineering; sid:6013208; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (disabled-lavender-ub5w238e-dph3hbjr1l94.edgeone.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"disabled-lavender-ub5w238e-dph3hbjr1l94.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013209; classtype:social-engineering; sid:6013209; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ocidente-virtua.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ocidente-virtua.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013210; classtype:social-engineering; sid:6013210; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (colegioluren.edu.pe/pa/pr/)"; flow:established,to_server; http.uri; content:"/pa/pr/"; startswith; fast_pattern; http.host; content:"colegioluren.edu.pe"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013211; classtype:social-engineering; sid:6013211; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfin1tysupp0rtmail.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfin1tysupp0rtmail.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013212; classtype:social-engineering; sid:6013212; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kriisshhnnaa.github.io/netflix-clone/demo-login.html)"; flow:established,to_server; http.uri; content:"/netflix-clone/demo-login.html"; startswith; fast_pattern; http.host; content:"kriisshhnnaa.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013213; classtype:social-engineering; sid:6013213; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.xpj33884.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.xpj33884.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013214; classtype:social-engineering; sid:6013214; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fdis.api.lifesecretary.com/category/product)"; flow:established,to_server; http.uri; content:"/category/product"; startswith; fast_pattern; http.host; content:"fdis.api.lifesecretary.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013215; classtype:social-engineering; sid:6013215; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ogfizwptvwizrdfxe-opv8tnjbjirlmiem7rwdle.vercel.app/gnhjw4jyteje4trhseh5dg)"; flow:established,to_server; http.uri; content:"/gnhjw4jyteje4trhseh5dg"; startswith; fast_pattern; http.host; content:"ogfizwptvwizrdfxe-opv8tnjbjirlmiem7rwdle.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013216; classtype:social-engineering; sid:6013216; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (noisy-gray-lecne856.edgeone.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"noisy-gray-lecne856.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013217; classtype:social-engineering; sid:6013217; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafybeiaws4pqenzmeqsuoufsgcyhgtxc5azas2dsnh6i25xpe75b3rybti.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafybeiaws4pqenzmeqsuoufsgcyhgtxc5azas2dsnh6i25xpe75b3rybti.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013218; classtype:social-engineering; sid:6013218; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (costmerznpaylteridnx.sufisme.web.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"costmerznpaylteridnx.sufisme.web.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013219; classtype:social-engineering; sid:6013219; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (68-210-200-182.cprapid.com/de/kasse.php)"; flow:established,to_server; http.uri; content:"/de/kasse.php"; startswith; fast_pattern; http.host; content:"68-210-200-182.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013220; classtype:social-engineering; sid:6013220; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tlc8829.net:8989/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"tlc8829.net:8989"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013221; classtype:social-engineering; sid:6013221; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cityinnparis.hostel.town/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cityinnparis.hostel.town"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013222; classtype:social-engineering; sid:6013222; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinty.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfinty.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013223; classtype:social-engineering; sid:6013223; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebookaccountrecovery.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebookaccountrecovery.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013224; classtype:social-engineering; sid:6013224; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (taughdia.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"taughdia.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013225; classtype:social-engineering; sid:6013225; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pawsandfurs.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pawsandfurs.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013226; classtype:social-engineering; sid:6013226; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (l.gotourl.es/l/bab7d40aeeb5279424cc07b9970fded782d7474b?u=14125938)"; flow:established,to_server; http.uri; content:"/l/bab7d40aeeb5279424cc07b9970fded782d7474b?u=14125938"; startswith; fast_pattern; http.host; content:"l.gotourl.es"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013227; classtype:social-engineering; sid:6013227; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maira-castro.github.io/netflix/)"; flow:established,to_server; http.uri; content:"/netflix/"; startswith; fast_pattern; http.host; content:"maira-castro.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013228; classtype:social-engineering; sid:6013228; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedidosexpress-zedelivery.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pedidosexpress-zedelivery.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013229; classtype:social-engineering; sid:6013229; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail-earthlink-net-newmessage.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webmail-earthlink-net-newmessage.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013230; classtype:social-engineering; sid:6013230; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinityaccounthome.20-228-132-238.cpanel.site/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"xfinityaccounthome.20-228-132-238.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013231; classtype:social-engineering; sid:6013231; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fishing-app.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fishing-app.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013232; classtype:social-engineering; sid:6013232; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.365bet332.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.365bet332.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013233; classtype:social-engineering; sid:6013233; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (divyanshu07112001.github.io/Apple_Clone/)"; flow:established,to_server; http.uri; content:"/Apple_Clone/"; startswith; fast_pattern; http.host; content:"divyanshu07112001.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013234; classtype:social-engineering; sid:6013234; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lastdropvillage.spahotel.guru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lastdropvillage.spahotel.guru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013235; classtype:social-engineering; sid:6013235; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (taughdia.click/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&dsh=S1042181928%3A1781389269123170&followup=https%3A%2F%2Faccounts.google.com%2F&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AcDsRvyGEZeWbPg9UIa-SEKqiOnfkWC-5BxNpZaUsgJ7wXz8rWBFTONQegfZei9CLii-aS2kZH4N3Q)"; flow:established,to_server; http.uri; content:"/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&dsh=S1042181928%3A1781389269123170&followup=https%3A%2F%2Faccounts.google.com%2F&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AcDsRvyGEZeWbPg9UIa-SEKqiOnfkWC-5BxNpZaUsgJ7wXz8rWBFTONQegfZei9CLii-aS2kZH4N3Q"; startswith; fast_pattern; http.host; content:"taughdia.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013236; classtype:social-engineering; sid:6013236; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fdis.api.lifesecretary.com/terms)"; flow:established,to_server; http.uri; content:"/terms"; startswith; fast_pattern; http.host; content:"fdis.api.lifesecretary.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013237; classtype:social-engineering; sid:6013237; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (arhumnasir.github.io/smit-assignment-Amazon-Clone)"; flow:established,to_server; http.uri; content:"/smit-assignment-Amazon-Clone"; startswith; fast_pattern; http.host; content:"arhumnasir.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013238; classtype:social-engineering; sid:6013238; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (debugmann.github.io/diskord)"; flow:established,to_server; http.uri; content:"/diskord"; startswith; fast_pattern; http.host; content:"debugmann.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013239; classtype:social-engineering; sid:6013239; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-git-06-09-fixwebtdpallnetworksoptionupdatest-619c96-uniswap.vercel.app/limit)"; flow:established,to_server; http.uri; content:"/limit"; startswith; fast_pattern; http.host; content:"web-git-06-09-fixwebtdpallnetworksoptionupdatest-619c96-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013240; classtype:social-engineering; sid:6013240; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (studio3-st3.com/document.php/)"; flow:established,to_server; http.uri; content:"/document.php/"; startswith; fast_pattern; http.host; content:"studio3-st3.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013241; classtype:social-engineering; sid:6013241; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bhavanamuneppa.github.io/amazon-cone/)"; flow:established,to_server; http.uri; content:"/amazon-cone/"; startswith; fast_pattern; http.host; content:"bhavanamuneppa.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013242; classtype:social-engineering; sid:6013242; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (poetic-bubblegum-e26dd8.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"poetic-bubblegum-e26dd8.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013243; classtype:social-engineering; sid:6013243; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gamane-login.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gamane-login.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013244; classtype:social-engineering; sid:6013244; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebookaccountrecovery.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebookaccountrecovery.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013245; classtype:social-engineering; sid:6013245; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (garbagebagpromotion.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"garbagebagpromotion.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013246; classtype:social-engineering; sid:6013246; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.8868605.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.8868605.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013247; classtype:social-engineering; sid:6013247; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (use-live-docs.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"use-live-docs.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013248; classtype:social-engineering; sid:6013248; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tp.tptokenapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tp.tptokenapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013249; classtype:social-engineering; sid:6013249; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (poetic-bubblegum-e26dd8.netlify.app/home.html)"; flow:established,to_server; http.uri; content:"/home.html"; startswith; fast_pattern; http.host; content:"poetic-bubblegum-e26dd8.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013250; classtype:social-engineering; sid:6013250; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (97b52e9e-b4e4-5e94-b2ab-docviewer3.reynoldsjace5.workers.dev/as6htt5w0ik/hotydhcvk)"; flow:established,to_server; http.uri; content:"/as6htt5w0ik/hotydhcvk"; startswith; fast_pattern; http.host; content:"97b52e9e-b4e4-5e94-b2ab-docviewer3.reynoldsjace5.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013251; classtype:social-engineering; sid:6013251; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (byrlek3riv.zoi9.pro/h5/)"; flow:established,to_server; http.uri; content:"/h5/"; startswith; fast_pattern; http.host; content:"byrlek3riv.zoi9.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013252; classtype:social-engineering; sid:6013252; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (showsix.digital/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"showsix.digital"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013253; classtype:social-engineering; sid:6013253; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sparkasse-bayreuth.de/de/home/login-online-banking.html)"; flow:established,to_server; http.uri; content:"/de/home/login-online-banking.html"; startswith; fast_pattern; http.host; content:"www.sparkasse-bayreuth.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013254; classtype:social-engineering; sid:6013254; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deeparastogi07.github.io/Spotify-Clone/)"; flow:established,to_server; http.uri; content:"/Spotify-Clone/"; startswith; fast_pattern; http.host; content:"deeparastogi07.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013255; classtype:social-engineering; sid:6013255; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (godisgreat1000x-hub.github.io/admin.html)"; flow:established,to_server; http.uri; content:"/admin.html"; startswith; fast_pattern; http.host; content:"godisgreat1000x-hub.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013256; classtype:social-engineering; sid:6013256; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-badge-vip8.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"verify-badge-vip8.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013257; classtype:social-engineering; sid:6013257; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jvr-nvzwq.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jvr-nvzwq.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013258; classtype:social-engineering; sid:6013258; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (logloop721-wgna.blogspot.com/2026/06/zerosignal-lost-connection.html)"; flow:established,to_server; http.uri; content:"/2026/06/zerosignal-lost-connection.html"; startswith; fast_pattern; http.host; content:"logloop721-wgna.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013259; classtype:social-engineering; sid:6013259; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anwarkhan5.github.io/Project/)"; flow:established,to_server; http.uri; content:"/Project/"; startswith; fast_pattern; http.host; content:"anwarkhan5.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013260; classtype:social-engineering; sid:6013260; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinityaccounthome.20-228-132-238.cpanel.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinityaccounthome.20-228-132-238.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013261; classtype:social-engineering; sid:6013261; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tdjreiqwwi.zoi9.pro/h5/)"; flow:established,to_server; http.uri; content:"/h5/"; startswith; fast_pattern; http.host; content:"tdjreiqwwi.zoi9.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013262; classtype:social-engineering; sid:6013262; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ruddycruzc.github.io/clon-spotify/)"; flow:established,to_server; http.uri; content:"/clon-spotify/"; startswith; fast_pattern; http.host; content:"ruddycruzc.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013263; classtype:social-engineering; sid:6013263; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee7890.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopee7890.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013264; classtype:social-engineering; sid:6013264; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (renmaintenance.dyezz.name/cgi-bin/index.ha/)"; flow:established,to_server; http.uri; content:"/cgi-bin/index.ha/"; startswith; fast_pattern; http.host; content:"renmaintenance.dyezz.name"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013265; classtype:social-engineering; sid:6013265; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (globalterdaftar.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"globalterdaftar.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013266; classtype:social-engineering; sid:6013266; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tioshxouy.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.tioshxouy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013267; classtype:social-engineering; sid:6013267; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klelnanzeigen-deutsch.id90117.info/getpaymentm/180308201/m9)"; flow:established,to_server; http.uri; content:"/getpaymentm/180308201/m9"; startswith; fast_pattern; http.host; content:"klelnanzeigen-deutsch.id90117.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013268; classtype:social-engineering; sid:6013268; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1cef02.site.tb-hosting.com/wp/wp-content/plugins/MADE/files/top.html)"; flow:established,to_server; http.uri; content:"/wp/wp-content/plugins/MADE/files/top.html"; startswith; fast_pattern; http.host; content:"1cef02.site.tb-hosting.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013269; classtype:social-engineering; sid:6013269; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kucoinlogginn.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kucoinlogginn.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013270; classtype:social-engineering; sid:6013270; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kucoinlogginn.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kucoinlogginn.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013271; classtype:social-engineering; sid:6013271; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (profycom.co.rs/feisbuck-456756454645)"; flow:established,to_server; http.uri; content:"/feisbuck-456756454645"; startswith; fast_pattern; http.host; content:"profycom.co.rs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013272; classtype:social-engineering; sid:6013272; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t888868.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"t888868.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013273; classtype:social-engineering; sid:6013273; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hadiahshopee333.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hadiahshopee333.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013274; classtype:social-engineering; sid:6013274; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee9499.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopee9499.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013275; classtype:social-engineering; sid:6013275; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abbas.mohammadzadeh-abbas65.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"abbas.mohammadzadeh-abbas65.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013276; classtype:social-engineering; sid:6013276; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (markatuna.com/docusign/docusign/Windows/utility.php/)"; flow:established,to_server; http.uri; content:"/docusign/docusign/Windows/utility.php/"; startswith; fast_pattern; http.host; content:"markatuna.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013277; classtype:social-engineering; sid:6013277; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (silent-voice-8321.eb791hq3.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"silent-voice-8321.eb791hq3.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013278; classtype:social-engineering; sid:6013278; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (betk365k16.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"betk365k16.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013279; classtype:social-engineering; sid:6013279; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fdjghfjdks-dp7840u77wuw.edgeone.dev/livebird.html)"; flow:established,to_server; http.uri; content:"/livebird.html"; startswith; fast_pattern; http.host; content:"fdjghfjdks-dp7840u77wuw.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013280; classtype:social-engineering; sid:6013280; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.educationpolicy.eu.keelingsobotka.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.educationpolicy.eu.keelingsobotka.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013281; classtype:social-engineering; sid:6013281; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mapsupport-iphones.help/pPlr)"; flow:established,to_server; http.uri; content:"/pPlr"; startswith; fast_pattern; http.host; content:"mapsupport-iphones.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013282; classtype:social-engineering; sid:6013282; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (parasag1310.github.io/spotify-clone/)"; flow:established,to_server; http.uri; content:"/spotify-clone/"; startswith; fast_pattern; http.host; content:"parasag1310.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013283; classtype:social-engineering; sid:6013283; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blog-your1425.blogspot.com/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"blog-your1425.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013284; classtype:social-engineering; sid:6013284; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smtp.romtelecom.net/?horde=ms5vufpvj5q02q1n45rot11mp7)"; flow:established,to_server; http.uri; content:"/?horde=ms5vufpvj5q02q1n45rot11mp7"; startswith; fast_pattern; http.host; content:"smtp.romtelecom.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013285; classtype:social-engineering; sid:6013285; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee7389.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopee7389.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013286; classtype:social-engineering; sid:6013286; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ananyab-262005.github.io/Amazon_Homepage_Clone_Frontend/)"; flow:established,to_server; http.uri; content:"/Amazon_Homepage_Clone_Frontend/"; startswith; fast_pattern; http.host; content:"ananyab-262005.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013287; classtype:social-engineering; sid:6013287; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e43hciingepfdx74bsmy3z537tkumjvkzk2lpp6ixvsblwdgnsda.arweave.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e43hciingepfdx74bsmy3z537tkumjvkzk2lpp6ixvsblwdgnsda.arweave.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013288; classtype:social-engineering; sid:6013288; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moondoteth.github.io/wemail-login-xf0auth/)"; flow:established,to_server; http.uri; content:"/wemail-login-xf0auth/"; startswith; fast_pattern; http.host; content:"moondoteth.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013289; classtype:social-engineering; sid:6013289; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adb-secure.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"adb-secure.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013290; classtype:social-engineering; sid:6013290; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yzab1c.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yzab1c.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013291; classtype:social-engineering; sid:6013291; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tetarwalsachinkumar.github.io/amazonclone/)"; flow:established,to_server; http.uri; content:"/amazonclone/"; startswith; fast_pattern; http.host; content:"tetarwalsachinkumar.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013292; classtype:social-engineering; sid:6013292; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (poetic-bubblegum-e26dd8.netlify.app/home)"; flow:established,to_server; http.uri; content:"/home"; startswith; fast_pattern; http.host; content:"poetic-bubblegum-e26dd8.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013293; classtype:social-engineering; sid:6013293; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auspost.customerserviceqe.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auspost.customerserviceqe.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013294; classtype:social-engineering; sid:6013294; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stblgame.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"stblgame.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013295; classtype:social-engineering; sid:6013295; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fortab.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fortab.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013296; classtype:social-engineering; sid:6013296; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vigneshgandla11.github.io/Clone-UI/)"; flow:established,to_server; http.uri; content:"/Clone-UI/"; startswith; fast_pattern; http.host; content:"vigneshgandla11.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013297; classtype:social-engineering; sid:6013297; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f.digitalmailpath.com/igit/4/5jlrppuFyeurq27hxrFn9dFbpcrzerFbsyFdslF4hFxFq)"; flow:established,to_server; http.uri; content:"/igit/4/5jlrppuFyeurq27hxrFn9dFbpcrzerFbsyFdslF4hFxFq"; startswith; fast_pattern; http.host; content:"f.digitalmailpath.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013298; classtype:social-engineering; sid:6013298; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.365bet332.com:443/chs/)"; flow:established,to_server; http.uri; content:"/chs/"; startswith; fast_pattern; http.host; content:"m.365bet332.com:443"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013299; classtype:social-engineering; sid:6013299; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (learn-start--trezur.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"learn-start--trezur.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013300; classtype:social-engineering; sid:6013300; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fortsun.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fortsun.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013301; classtype:social-engineering; sid:6013301; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hadiahshopee333.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hadiahshopee333.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013302; classtype:social-engineering; sid:6013302; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zedeliverys-24h.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zedeliverys-24h.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013303; classtype:social-engineering; sid:6013303; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.57365h.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.57365h.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013304; classtype:social-engineering; sid:6013304; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee7890.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopee7890.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013305; classtype:social-engineering; sid:6013305; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login-metsahelp.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"login-metsahelp.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013306; classtype:social-engineering; sid:6013306; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (axfuehpruurx.objectstorage.ap-kulai-2.oci.customer-oci.com/n/axfuehpruurx/b/voicemail-mic12062026vm73078voice5625879mail2840protected036734mic/o/core.html)"; flow:established,to_server; http.uri; content:"/n/axfuehpruurx/b/voicemail-mic12062026vm73078voice5625879mail2840protected036734mic/o/core.html"; startswith; fast_pattern; http.host; content:"axfuehpruurx.objectstorage.ap-kulai-2.oci.customer-oci.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013307; classtype:social-engineering; sid:6013307; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinityaccounthome.20-228-132-238.cpanel.site/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"www.xfinityaccounthome.20-228-132-238.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013308; classtype:social-engineering; sid:6013308; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kucoeneleuiogin.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kucoeneleuiogin.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013309; classtype:social-engineering; sid:6013309; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bet4069.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bet4069.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013310; classtype:social-engineering; sid:6013310; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kucoin.xyzbuy.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kucoin.xyzbuy.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013311; classtype:social-engineering; sid:6013311; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (offf-1-c-365-seg--assesortcn365.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"offf-1-c-365-seg--assesortcn365.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013312; classtype:social-engineering; sid:6013312; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booking-com-dubai-desert--safarii.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"booking-com-dubai-desert--safarii.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013313; classtype:social-engineering; sid:6013313; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.230yabo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.230yabo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013314; classtype:social-engineering; sid:6013314; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamask-restoreserver-page.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metamask-restoreserver-page.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013315; classtype:social-engineering; sid:6013315; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (08913659.com:8989/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"08913659.com:8989"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013316; classtype:social-engineering; sid:6013316; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brainy-core-176300.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"brainy-core-176300.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013317; classtype:social-engineering; sid:6013317; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ewabsturz.com/Update-new/index.php)"; flow:established,to_server; http.uri; content:"/Update-new/index.php"; startswith; fast_pattern; http.host; content:"ewabsturz.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013318; classtype:social-engineering; sid:6013318; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.131yabo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.131yabo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013319; classtype:social-engineering; sid:6013319; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (40nqr.zoi9.pro/h5/)"; flow:established,to_server; http.uri; content:"/h5/"; startswith; fast_pattern; http.host; content:"40nqr.zoi9.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013320; classtype:social-engineering; sid:6013320; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (device-iso.com/app/webroot/script/2026_passcode6_login/)"; flow:established,to_server; http.uri; content:"/app/webroot/script/2026_passcode6_login/"; startswith; fast_pattern; http.host; content:"device-iso.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013321; classtype:social-engineering; sid:6013321; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon500.dealsclick123.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon500.dealsclick123.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013322; classtype:social-engineering; sid:6013322; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sign-in-to-xfinity-876.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.sign-in-to-xfinity-876.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013323; classtype:social-engineering; sid:6013323; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myjcb-safecjeckpor.icu/pages/login/index.php)"; flow:established,to_server; http.uri; content:"/pages/login/index.php"; startswith; fast_pattern; http.host; content:"myjcb-safecjeckpor.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013324; classtype:social-engineering; sid:6013324; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (plasmaringa.com/archive/outh.html)"; flow:established,to_server; http.uri; content:"/archive/outh.html"; startswith; fast_pattern; http.host; content:"plasmaringa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013325; classtype:social-engineering; sid:6013325; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amz43.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amz43.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013326; classtype:social-engineering; sid:6013326; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (padisahbettggiris.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"padisahbettggiris.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013327; classtype:social-engineering; sid:6013327; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bookings-com-dubai-flights-tickets.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bookings-com-dubai-flights-tickets.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013328; classtype:social-engineering; sid:6013328; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (magento.citiretailservices.citibankonlline.com/?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTc4MTQwMTY2NSwiaWF0IjoxNzgxMzk0NDY1LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIzMnNjaGwwb3FydGpuNjZ1MmcwdDQxOG8iLCJuYmYiOjE3ODEzOTQ0NjUsInRzIjoxNzgxMzk0NDY1OTAwMzI2fQ.4fYqANSgWUeBsX-QA82nVdImxbH9Q5Pk8U5BJjzSsP8&sid=46f3d3b2-6782-11f1-ac47-d8df95e8526e)"; flow:established,to_server; http.uri; content:"/?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTc4MTQwMTY2NSwiaWF0IjoxNzgxMzk0NDY1LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIzMnNjaGwwb3FydGpuNjZ1MmcwdDQxOG8iLCJuYmYiOjE3ODEzOTQ0NjUsInRzIjoxNzgxMzk0NDY1OTAwMzI2fQ.4fYqANSgWUeBsX-QA82nVdImxbH9Q5Pk8U5BJjzSsP8&sid=46f3d3b2-6782-11f1-ac47-d8df95e8526e"; startswith; fast_pattern; http.host; content:"magento.citiretailservices.citibankonlline.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013329; classtype:social-engineering; sid:6013329; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qrqrqr.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qrqrqr.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013330; classtype:social-engineering; sid:6013330; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (indoopaylterxz.hurokei.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"indoopaylterxz.hurokei.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013331; classtype:social-engineering; sid:6013331; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kucoin_loiigin.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kucoin_loiigin.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013332; classtype:social-engineering; sid:6013332; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pemenangshopee555.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.pemenangshopee555.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013333; classtype:social-engineering; sid:6013333; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (renmaintenance.dyezz.name/cgi-bin/home.ha)"; flow:established,to_server; http.uri; content:"/cgi-bin/home.ha"; startswith; fast_pattern; http.host; content:"renmaintenance.dyezz.name"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013334; classtype:social-engineering; sid:6013334; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roopansh123.github.io/apple-clone/)"; flow:established,to_server; http.uri; content:"/apple-clone/"; startswith; fast_pattern; http.host; content:"roopansh123.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013335; classtype:social-engineering; sid:6013335; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamzklogoo.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metamzklogoo.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013336; classtype:social-engineering; sid:6013336; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pravodopomoga24.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pravodopomoga24.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013337; classtype:social-engineering; sid:6013337; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeeid4888.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopeeid4888.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013338; classtype:social-engineering; sid:6013338; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.chekad.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.chekad.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013339; classtype:social-engineering; sid:6013339; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nfxclonee.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nfxclonee.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013340; classtype:social-engineering; sid:6013340; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-netlfix12.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-netlfix12.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013341; classtype:social-engineering; sid:6013341; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gurl.pro/wwwrobloxcom-users-774278901-profile/)"; flow:established,to_server; http.uri; content:"/wwwrobloxcom-users-774278901-profile/"; startswith; fast_pattern; http.host; content:"www.gurl.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013342; classtype:social-engineering; sid:6013342; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (crsia1db1x.zoi9.pro/h5/)"; flow:established,to_server; http.uri; content:"/h5/"; startswith; fast_pattern; http.host; content:"crsia1db1x.zoi9.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013343; classtype:social-engineering; sid:6013343; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (empresarialcaixa06-06.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"empresarialcaixa06-06.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013344; classtype:social-engineering; sid:6013344; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pusatshopee99.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pusatshopee99.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013345; classtype:social-engineering; sid:6013345; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (138wq.zoi9.pro/h5/)"; flow:established,to_server; http.uri; content:"/h5/"; startswith; fast_pattern; http.host; content:"138wq.zoi9.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013346; classtype:social-engineering; sid:6013346; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.wh0027.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.wh0027.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013347; classtype:social-engineering; sid:6013347; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (poetic-bubblegum-e26dd8.netlify.app/home.html/)"; flow:established,to_server; http.uri; content:"/home.html/"; startswith; fast_pattern; http.host; content:"poetic-bubblegum-e26dd8.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013348; classtype:social-engineering; sid:6013348; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-badge-vip125.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"verify-badge-vip125.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013349; classtype:social-engineering; sid:6013349; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (taking-document-cotton-foam.trycloudflare.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"taking-document-cotton-foam.trycloudflare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013350; classtype:social-engineering; sid:6013350; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-git-06-09-fixwebtdpallnetworksoptionupdatest-619c96-uniswap.vercel.app/buy)"; flow:established,to_server; http.uri; content:"/buy"; startswith; fast_pattern; http.host; content:"web-git-06-09-fixwebtdpallnetworksoptionupdatest-619c96-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013351; classtype:social-engineering; sid:6013351; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (friendly-indigo-f946zusu.edgeone.app/?eta=veren8@86d9ac664f32b3117fef6b80c85afdd31edd.net)"; flow:established,to_server; http.uri; content:"/?eta=veren8@86d9ac664f32b3117fef6b80c85afdd31edd.net"; startswith; fast_pattern; http.host; content:"friendly-indigo-f946zusu.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013352; classtype:social-engineering; sid:6013352; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-l2pxkyyme.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-l2pxkyyme.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013353; classtype:social-engineering; sid:6013353; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lw-att-main.hopto.org/cgi-bin/home.ha/)"; flow:established,to_server; http.uri; content:"/cgi-bin/home.ha/"; startswith; fast_pattern; http.host; content:"lw-att-main.hopto.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013354; classtype:social-engineering; sid:6013354; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spotify-songs1.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spotify-songs1.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013355; classtype:social-engineering; sid:6013355; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.spf-amende.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.spf-amende.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013356; classtype:social-engineering; sid:6013356; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bradesco.atualizacaopj.net/login.php?hash=12721881866a30d8239daf15.53280986)"; flow:established,to_server; http.uri; content:"/login.php?hash=12721881866a30d8239daf15.53280986"; startswith; fast_pattern; http.host; content:"bradesco.atualizacaopj.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013357; classtype:social-engineering; sid:6013357; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-jade-ten.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-jade-ten.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013358; classtype:social-engineering; sid:6013358; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (utensil-steep-dk.s3.ap-southeast-1.amazonaws.com/VSPt3S5ZdJKeeK?email=redacted@abuse.ionos.com)"; flow:established,to_server; http.uri; content:"/VSPt3S5ZdJKeeK?email=redacted@abuse.ionos.com"; startswith; fast_pattern; http.host; content:"utensil-steep-dk.s3.ap-southeast-1.amazonaws.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013359; classtype:social-engineering; sid:6013359; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spf-amende.com/main)"; flow:established,to_server; http.uri; content:"/main"; startswith; fast_pattern; http.host; content:"spf-amende.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013360; classtype:social-engineering; sid:6013360; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mcaavoli.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mcaavoli.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013361; classtype:social-engineering; sid:6013361; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cancelrtucmprahdlins.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cancelrtucmprahdlins.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013362; classtype:social-engineering; sid:6013362; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (creditagricole-reactivation.bolt.host/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"creditagricole-reactivation.bolt.host"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013363; classtype:social-engineering; sid:6013363; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (solicitudesbhdrdprincipal.liveblog365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"solicitudesbhdrdprincipal.liveblog365.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013364; classtype:social-engineering; sid:6013364; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spf-amende.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spf-amende.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013365; classtype:social-engineering; sid:6013365; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netempresas.lojaefata.com.br/pj)"; flow:established,to_server; http.uri; content:"/pj"; startswith; fast_pattern; http.host; content:"netempresas.lojaefata.com.br"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013366; classtype:social-engineering; sid:6013366; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bacsigad.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bacsigad.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013367; classtype:social-engineering; sid:6013367; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meusbonus.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meusbonus.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013368; classtype:social-engineering; sid:6013368; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.smart93281277.bond/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.smart93281277.bond"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013369; classtype:social-engineering; sid:6013369; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amuse-73035.bechshistory.com/challenge.php?t=MTc4MTU3Mjk5MHwxNzgxNTczMjkwfDBlZmQ1MzZjMjA0MGJhMzJ8NHxmZDA5ZDRlOTk0N2VjYmM4NjIxNjM1YzM2NjJiYjMyMHw2ODk1MGEyNDk0Y2I4YzVkOTZkNThkNDIyNmI4MmQ5OGRhOWFlYjVhOTlhNjU1YmI2YTQyZGFkNjQyMjVlODRj&r=Lz91MjkxND1hVzVtYjNKdFlXTnFaVUJ3YTI5aWNDNXdiQT09)"; flow:established,to_server; http.uri; content:"/challenge.php?t=MTc4MTU3Mjk5MHwxNzgxNTczMjkwfDBlZmQ1MzZjMjA0MGJhMzJ8NHxmZDA5ZDRlOTk0N2VjYmM4NjIxNjM1YzM2NjJiYjMyMHw2ODk1MGEyNDk0Y2I4YzVkOTZkNThkNDIyNmI4MmQ5OGRhOWFlYjVhOTlhNjU1YmI2YTQyZGFkNjQyMjVlODRj&r=Lz91MjkxND1hVzVtYjNKdFlXTnFaVUJ3YTI5aWNDNXdiQT09"; startswith; fast_pattern; http.host; content:"amuse-73035.bechshistory.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013370; classtype:social-engineering; sid:6013370; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ubiquitous-gingersnap-809853.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ubiquitous-gingersnap-809853.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013371; classtype:social-engineering; sid:6013371; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezor-login-x-us.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezor-login-x-us.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013372; classtype:social-engineering; sid:6013372; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (azirksa.com/Prestige_Law/)"; flow:established,to_server; http.uri; content:"/Prestige_Law/"; startswith; fast_pattern; http.host; content:"azirksa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013373; classtype:social-engineering; sid:6013373; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (consulta-prestamos-leon.iceiy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"consulta-prestamos-leon.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013374; classtype:social-engineering; sid:6013374; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prestamoalinstantebhddo.liveblog365.com/index2.html)"; flow:established,to_server; http.uri; content:"/index2.html"; startswith; fast_pattern; http.host; content:"prestamoalinstantebhddo.liveblog365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013375; classtype:social-engineering; sid:6013375; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (validar-liver365.webcindario.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"validar-liver365.webcindario.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013376; classtype:social-engineering; sid:6013376; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedagiofflowbrasil.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pedagiofflowbrasil.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013377; classtype:social-engineering; sid:6013377; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bnparibas-reactivation.bolt.host/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bnparibas-reactivation.bolt.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013378; classtype:social-engineering; sid:6013378; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robinhiodlogmx.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"robinhiodlogmx.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013379; classtype:social-engineering; sid:6013379; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f.digital-pathway.com/igit/4/6ehopj7Nk3nay05fvpNv9bNv4i8miN9qwNxqjN2fNvNo)"; flow:established,to_server; http.uri; content:"/igit/4/6ehopj7Nk3nay05fvpNv9bNv4i8miN9qwNxqjN2fNvNo"; startswith; fast_pattern; http.host; content:"f.digital-pathway.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013380; classtype:social-engineering; sid:6013380; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ac156ollnno01010101010101010101.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ac156ollnno01010101010101010101.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013381; classtype:social-engineering; sid:6013381; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopeetbk855.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopeetbk855.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013382; classtype:social-engineering; sid:6013382; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mayurkoli6311-ui.github.io/Amazon_clone)"; flow:established,to_server; http.uri; content:"/Amazon_clone"; startswith; fast_pattern; http.host; content:"mayurkoli6311-ui.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013383; classtype:social-engineering; sid:6013383; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nokaieoasptokies.com/Last/ch)"; flow:established,to_server; http.uri; content:"/Last/ch"; startswith; fast_pattern; http.host; content:"nokaieoasptokies.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013384; classtype:social-engineering; sid:6013384; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (girope.hu/doc/)"; flow:established,to_server; http.uri; content:"/doc/"; startswith; fast_pattern; http.host; content:"girope.hu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013385; classtype:social-engineering; sid:6013385; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (piyush-bytes.github.io/AMAZON_CLONE/)"; flow:established,to_server; http.uri; content:"/AMAZON_CLONE/"; startswith; fast_pattern; http.host; content:"piyush-bytes.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013386; classtype:social-engineering; sid:6013386; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chloewnavalcert.wasmer.app/billandmelindagatesfoundation)"; flow:established,to_server; http.uri; content:"/billandmelindagatesfoundation"; startswith; fast_pattern; http.host; content:"chloewnavalcert.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013387; classtype:social-engineering; sid:6013387; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiverr-orders-payment.pro/work/new-orders)"; flow:established,to_server; http.uri; content:"/work/new-orders"; startswith; fast_pattern; http.host; content:"fiverr-orders-payment.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013388; classtype:social-engineering; sid:6013388; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ofertassemanais.vercel.app/ofertas/)"; flow:established,to_server; http.uri; content:"/ofertas/"; startswith; fast_pattern; http.host; content:"ofertassemanais.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013389; classtype:social-engineering; sid:6013389; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (customeraccountservice.themosthauntedforum.com/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"customeraccountservice.themosthauntedforum.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013390; classtype:social-engineering; sid:6013390; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (johnw833.sg-host.com/moon/mom/aldomain.html)"; flow:established,to_server; http.uri; content:"/moon/mom/aldomain.html"; startswith; fast_pattern; http.host; content:"johnw833.sg-host.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013391; classtype:social-engineering; sid:6013391; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f.digital-sending.com/igit/4/79iei6yLen46eglvb5LdprLpuaj9w5Lp6cL46zLivLbL4)"; flow:established,to_server; http.uri; content:"/igit/4/79iei6yLen46eglvb5LdprLpuaj9w5Lp6cL46zLivLbL4"; startswith; fast_pattern; http.host; content:"f.digital-sending.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013392; classtype:social-engineering; sid:6013392; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kucouinlogie.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kucouinlogie.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013393; classtype:social-engineering; sid:6013393; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ww-brasilrodovias.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ww-brasilrodovias.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013394; classtype:social-engineering; sid:6013394; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.lootcentral.com.br/voice/)"; flow:established,to_server; http.uri; content:"/voice/"; startswith; fast_pattern; http.host; content:"www.lootcentral.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013395; classtype:social-engineering; sid:6013395; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (on-pedagiobrasil.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"on-pedagiobrasil.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013396; classtype:social-engineering; sid:6013396; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pemenangshopee389.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pemenangshopee389.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013397; classtype:social-engineering; sid:6013397; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pabmos.com/dcs/)"; flow:established,to_server; http.uri; content:"/dcs/"; startswith; fast_pattern; http.host; content:"pabmos.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013398; classtype:social-engineering; sid:6013398; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ar-enel.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ar-enel.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013399; classtype:social-engineering; sid:6013399; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (starting-trezo-docs.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"starting-trezo-docs.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013400; classtype:social-engineering; sid:6013400; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nithiksathyan.github.io/NetFlix)"; flow:established,to_server; http.uri; content:"/NetFlix"; startswith; fast_pattern; http.host; content:"nithiksathyan.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013401; classtype:social-engineering; sid:6013401; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (saishankar1430.github.io/amazonproject/)"; flow:established,to_server; http.uri; content:"/amazonproject/"; startswith; fast_pattern; http.host; content:"saishankar1430.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013402; classtype:social-engineering; sid:6013402; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4jw.d29.mytemp.website/mijnabnaa/app-vernieuwen/)"; flow:established,to_server; http.uri; content:"/mijnabnaa/app-vernieuwen/"; startswith; fast_pattern; http.host; content:"4jw.d29.mytemp.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013403; classtype:social-engineering; sid:6013403; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moises.cl/feisbuc-234435564)"; flow:established,to_server; http.uri; content:"/feisbuc-234435564"; startswith; fast_pattern; http.host; content:"moises.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013404; classtype:social-engineering; sid:6013404; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedagioff.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pedagioff.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013405; classtype:social-engineering; sid:6013405; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fnlocker.one/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fnlocker.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013406; classtype:social-engineering; sid:6013406; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netfilx.co/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netfilx.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013407; classtype:social-engineering; sid:6013407; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.threswk.click/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&dsh=S640721563%3A1781562791646131&followup=https%3A%2F%2Faccounts.google.com%2F&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AcDsRvx0zuqaXzuunDzIxiI_253rfe1PrHVRjqYA5L4VoZ3Bis9ZVfEmWTI8EBOM5iaj3AhPGmU4)"; flow:established,to_server; http.uri; content:"/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&dsh=S640721563%3A1781562791646131&followup=https%3A%2F%2Faccounts.google.com%2F&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AcDsRvx0zuqaXzuunDzIxiI_253rfe1PrHVRjqYA5L4VoZ3Bis9ZVfEmWTI8EBOM5iaj3AhPGmU4"; startswith; fast_pattern; http.host; content:"www.threswk.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013408; classtype:social-engineering; sid:6013408; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6a305c5c175de3338b2a1ff0--gleaming-pastelito-3dbfc9.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6a305c5c175de3338b2a1ff0--gleaming-pastelito-3dbfc9.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013409; classtype:social-engineering; sid:6013409; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezrrsuite.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezrrsuite.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013410; classtype:social-engineering; sid:6013410; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgerlikeapp.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledgerlikeapp.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013411; classtype:social-engineering; sid:6013411; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gacancersupport.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gacancersupport.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013412; classtype:social-engineering; sid:6013412; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (heractiveren-nu.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"heractiveren-nu.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013413; classtype:social-engineering; sid:6013413; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wages-report.davwb3wp74z35.amplifyapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wages-report.davwb3wp74z35.amplifyapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013414; classtype:social-engineering; sid:6013414; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (freeflowrodovia.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"freeflowrodovia.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013415; classtype:social-engineering; sid:6013415; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lkoer7h8tg6h8j-dpjxu5uljddr.edgeone.dev/english.html)"; flow:established,to_server; http.uri; content:"/english.html"; startswith; fast_pattern; http.host; content:"lkoer7h8tg6h8j-dpjxu5uljddr.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013416; classtype:social-engineering; sid:6013416; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezor-suite-apps.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezor-suite-apps.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013417; classtype:social-engineering; sid:6013417; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7tcc4p.cn/mmixosct)"; flow:established,to_server; http.uri; content:"/mmixosct"; startswith; fast_pattern; http.host; content:"7tcc4p.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013418; classtype:social-engineering; sid:6013418; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ae931d5e52d9476320283ea0826e47471027dd293b3f5419564d29178d.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ae931d5e52d9476320283ea0826e47471027dd293b3f5419564d29178d.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013419; classtype:social-engineering; sid:6013419; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (81zppv.cn/mmixosct/)"; flow:established,to_server; http.uri; content:"/mmixosct/"; startswith; fast_pattern; http.host; content:"81zppv.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013420; classtype:social-engineering; sid:6013420; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedagiofreeflow-online.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pedagiofreeflow-online.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013421; classtype:social-engineering; sid:6013421; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vasusinghal0607.github.io/AmazonClone)"; flow:established,to_server; http.uri; content:"/AmazonClone"; startswith; fast_pattern; http.host; content:"vasusinghal0607.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013422; classtype:social-engineering; sid:6013422; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrr.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingrr.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013423; classtype:social-engineering; sid:6013423; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m2kxenskpr33cczh422ztadivhtnpi5rm5yd3s4enftckstngfya.legacy.datasprite-cdn.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m2kxenskpr33cczh422ztadivhtnpi5rm5yd3s4enftckstngfya.legacy.datasprite-cdn.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013424; classtype:social-engineering; sid:6013424; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appleb488b246b21446ed81078ceffa057666.3bozft.cn/Apple9f66ebcbca32436aa9bf433ac42d0365)"; flow:established,to_server; http.uri; content:"/Apple9f66ebcbca32436aa9bf433ac42d0365"; startswith; fast_pattern; http.host; content:"appleb488b246b21446ed81078ceffa057666.3bozft.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013425; classtype:social-engineering; sid:6013425; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tryugwyigiuqyugfq-tyieghoirurgqh.pages.dev/?e=aran@7998e30432222a0842c9980c5cd10770824a.com)"; flow:established,to_server; http.uri; content:"/?e=aran@7998e30432222a0842c9980c5cd10770824a.com"; startswith; fast_pattern; http.host; content:"tryugwyigiuqyugfq-tyieghoirurgqh.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013426; classtype:social-engineering; sid:6013426; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.askmeforsure.info/ad/i/)"; flow:established,to_server; http.uri; content:"/ad/i/"; startswith; fast_pattern; http.host; content:"www.askmeforsure.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013427; classtype:social-engineering; sid:6013427; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rm9977hj.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rm9977hj.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013428; classtype:social-engineering; sid:6013428; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coombsconstructions.com.au/ZBcS2026/)"; flow:established,to_server; http.uri; content:"/ZBcS2026/"; startswith; fast_pattern; http.host; content:"coombsconstructions.com.au"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013429; classtype:social-engineering; sid:6013429; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.r365kvip.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.r365kvip.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013430; classtype:social-engineering; sid:6013430; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (httpp-www-roblox.co/users/1789978322/profile)"; flow:established,to_server; http.uri; content:"/users/1789978322/profile"; startswith; fast_pattern; http.host; content:"httpp-www-roblox.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013431; classtype:social-engineering; sid:6013431; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xt42qzg4cfw3nlbrlpiuuudgvhtwkvsjqmannuqhhkysjehjjy4q.legacy.datasprite-cdn.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xt42qzg4cfw3nlbrlpiuuudgvhtwkvsjqmannuqhhkysjehjjy4q.legacy.datasprite-cdn.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013432; classtype:social-engineering; sid:6013432; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sincronizar-itau.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sincronizar-itau.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013433; classtype:social-engineering; sid:6013433; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tkibscvr.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tkibscvr.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013434; classtype:social-engineering; sid:6013434; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reactiveren-nu.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"reactiveren-nu.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013435; classtype:social-engineering; sid:6013435; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (movieflix-netflx-clone.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"movieflix-netflx-clone.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013436; classtype:social-engineering; sid:6013436; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nithiksathyan.github.io/Amazone)"; flow:established,to_server; http.uri; content:"/Amazone"; startswith; fast_pattern; http.host; content:"nithiksathyan.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013437; classtype:social-engineering; sid:6013437; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.api-wsource1-epc78300000000000152669tfn-homesolution.educacaosobredrogas.com.br/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.api-wsource1-epc78300000000000152669tfn-homesolution.educacaosobredrogas.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013438; classtype:social-engineering; sid:6013438; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zj.kvmzoe.com/Make/Latest2025.html?eta=a.b@c)"; flow:established,to_server; http.uri; content:"/Make/Latest2025.html?eta=a.b@c"; startswith; fast_pattern; http.host; content:"zj.kvmzoe.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013439; classtype:social-engineering; sid:6013439; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-portal-kuoin.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"info-portal-kuoin.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013440; classtype:social-engineering; sid:6013440; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (layanan-dana-bantuan.github.io/dana-pemulihan/)"; flow:established,to_server; http.uri; content:"/dana-pemulihan/"; startswith; fast_pattern; http.host; content:"layanan-dana-bantuan.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013441; classtype:social-engineering; sid:6013441; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en-io--trezore-login.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"en-io--trezore-login.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013442; classtype:social-engineering; sid:6013442; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klausfhepp.com/ino)"; flow:established,to_server; http.uri; content:"/ino"; startswith; fast_pattern; http.host; content:"klausfhepp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013443; classtype:social-engineering; sid:6013443; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bnp-cledigitale.bolt.host/index.html/)"; flow:established,to_server; http.uri; content:"/index.html/"; startswith; fast_pattern; http.host; content:"bnp-cledigitale.bolt.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013444; classtype:social-engineering; sid:6013444; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrq.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingrq.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013445; classtype:social-engineering; sid:6013445; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (review-and-sign-esign-document-pdf.pages.dev/?error=login_required&error_description=AADSTS50058:+A+silent+sign-in+request+was+sent+but+no+user+is+signed+in.+The+cookies+used+to+represent+the+user's+session+were+not+sent+in+the+request+to+Azure+AD.+This+can+happen+if+the+user+is+using+Internet+Explorer+or+Edge)"; flow:established,to_server; http.uri; content:"/?error=login_required&error_description=AADSTS50058:+A+silent+sign-in+request+was+sent+but+no+user+is+signed+in.+The+cookies+used+to+represent+the+user's+session+were+not+sent+in+the+request+to+Azure+AD.+This+can+happen+if+the+user+is+using+Internet+Explorer+or+Edge"; startswith; fast_pattern; http.host; content:"review-and-sign-esign-document-pdf.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013446; classtype:social-engineering; sid:6013446; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (student-yuvraj2008.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"student-yuvraj2008.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013447; classtype:social-engineering; sid:6013447; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pauloherriqueggg259-bot.github.io/gov.c/)"; flow:established,to_server; http.uri; content:"/gov.c/"; startswith; fast_pattern; http.host; content:"pauloherriqueggg259-bot.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013448; classtype:social-engineering; sid:6013448; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gestaodeprojetos.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"gestaodeprojetos.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013449; classtype:social-engineering; sid:6013449; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (797jyr.cn/mmixosct)"; flow:established,to_server; http.uri; content:"/mmixosct"; startswith; fast_pattern; http.host; content:"797jyr.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013450; classtype:social-engineering; sid:6013450; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dg.mntbell.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dg.mntbell.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013451; classtype:social-engineering; sid:6013451; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (twpkfbbcwuqrlttc.deuthme.info/leds/)"; flow:established,to_server; http.uri; content:"/leds/"; startswith; fast_pattern; http.host; content:"twpkfbbcwuqrlttc.deuthme.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013452; classtype:social-engineering; sid:6013452; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (freeflow-rodovia.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"freeflow-rodovia.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013453; classtype:social-engineering; sid:6013453; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ucpasportstationparis.hostel.town/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ucpasportstationparis.hostel.town"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013454; classtype:social-engineering; sid:6013454; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (io-trezer-en-us.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"io-trezer-en-us.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013455; classtype:social-engineering; sid:6013455; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dh00566nnvh04.cloudfront.net/?cid=8458657)"; flow:established,to_server; http.uri; content:"/?cid=8458657"; startswith; fast_pattern; http.host; content:"dh00566nnvh04.cloudfront.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013456; classtype:social-engineering; sid:6013456; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedagiofflow.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pedagiofflow.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013457; classtype:social-engineering; sid:6013457; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (quick-cloud-444.allcompredirectportalshare.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"quick-cloud-444.allcompredirectportalshare.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013458; classtype:social-engineering; sid:6013458; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bloki-logn.zapier.app/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"bloki-logn.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013459; classtype:social-engineering; sid:6013459; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mh89922.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mh89922.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013460; classtype:social-engineering; sid:6013460; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.r365kvip.com:8989/auto-verify/index.html)"; flow:established,to_server; http.uri; content:"/auto-verify/index.html"; startswith; fast_pattern; http.host; content:"www.r365kvip.com:8989"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013461; classtype:social-engineering; sid:6013461; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gvaridioll.s3.eu-north-1.amazonaws.com/tmv.html)"; flow:established,to_server; http.uri; content:"/tmv.html"; startswith; fast_pattern; http.host; content:"gvaridioll.s3.eu-north-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013462; classtype:social-engineering; sid:6013462; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4jw.d29.mytemp.website/mijnabnaa/app-vernieuwen/card.html)"; flow:established,to_server; http.uri; content:"/mijnabnaa/app-vernieuwen/card.html"; startswith; fast_pattern; http.host; content:"4jw.d29.mytemp.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013463; classtype:social-engineering; sid:6013463; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (desktop-enn.framer.media/en/)"; flow:established,to_server; http.uri; content:"/en/"; startswith; fast_pattern; http.host; content:"desktop-enn.framer.media"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013464; classtype:social-engineering; sid:6013464; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.it-admincenter.com/5d5666/65f70345-c9d5-4fce-9b5e-b21dba23e077)"; flow:established,to_server; http.uri; content:"/5d5666/65f70345-c9d5-4fce-9b5e-b21dba23e077"; startswith; fast_pattern; http.host; content:"login.it-admincenter.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013465; classtype:social-engineering; sid:6013465; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bas.a9177395466.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bas.a9177395466.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013466; classtype:social-engineering; sid:6013466; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (azirksa.com/PNW_Home_LLC)"; flow:established,to_server; http.uri; content:"/PNW_Home_LLC"; startswith; fast_pattern; http.host; content:"azirksa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013467; classtype:social-engineering; sid:6013467; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sbc-verifier-sign-in-84bfcd.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sbc-verifier-sign-in-84bfcd.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013468; classtype:social-engineering; sid:6013468; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shinzo23.github.io/Amazon-Clone)"; flow:established,to_server; http.uri; content:"/Amazon-Clone"; startswith; fast_pattern; http.host; content:"shinzo23.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013469; classtype:social-engineering; sid:6013469; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (office-fredo.webhop.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"office-fredo.webhop.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013470; classtype:social-engineering; sid:6013470; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (azizullah-fedev.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"azizullah-fedev.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013471; classtype:social-engineering; sid:6013471; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (destek-edev1et.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"destek-edev1et.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013472; classtype:social-engineering; sid:6013472; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gleaming-pastelito-3dbfc9.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gleaming-pastelito-3dbfc9.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013473; classtype:social-engineering; sid:6013473; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kavitachaudhary16.github.io/Amazon-Clone-/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone-/"; startswith; fast_pattern; http.host; content:"kavitachaudhary16.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013474; classtype:social-engineering; sid:6013474; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrt.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingrt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013475; classtype:social-engineering; sid:6013475; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6a2d92a9d242d7b5e453154c--sweet-tarsier-be1a2a.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6a2d92a9d242d7b5e453154c--sweet-tarsier-be1a2a.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013476; classtype:social-engineering; sid:6013476; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sameerniku.github.io/Amazon-Clone)"; flow:established,to_server; http.uri; content:"/Amazon-Clone"; startswith; fast_pattern; http.host; content:"sameerniku.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013477; classtype:social-engineering; sid:6013477; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inhouseplumbingcompany-sewer.pages.dev/dp/B0C2RXN77R?ref=MarsFS_AUCC_es/)"; flow:established,to_server; http.uri; content:"/dp/B0C2RXN77R?ref=MarsFS_AUCC_es/"; startswith; fast_pattern; http.host; content:"inhouseplumbingcompany-sewer.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013478; classtype:social-engineering; sid:6013478; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.api-wsource1-epc78300000000000152669tfn-homesolution.educacaosobredrogas.com.br/auth/login.php)"; flow:established,to_server; http.uri; content:"/auth/login.php"; startswith; fast_pattern; http.host; content:"www.api-wsource1-epc78300000000000152669tfn-homesolution.educacaosobredrogas.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013479; classtype:social-engineering; sid:6013479; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.99re99777mq.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.99re99777mq.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013480; classtype:social-engineering; sid:6013480; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-page-creator--wolfwise.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-page-creator--wolfwise.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013481; classtype:social-engineering; sid:6013481; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrq.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingrq.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013482; classtype:social-engineering; sid:6013482; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (testes-esdicao.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"testes-esdicao.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013483; classtype:social-engineering; sid:6013483; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hafizikrashue.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"hafizikrashue.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013484; classtype:social-engineering; sid:6013484; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedagiofreeflowoficial.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pedagiofreeflowoficial.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013485; classtype:social-engineering; sid:6013485; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (singhknpharsh.github.io/Amazon-Homepage-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Homepage-Clone/"; startswith; fast_pattern; http.host; content:"singhknpharsh.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013486; classtype:social-engineering; sid:6013486; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta66245-cmyk.github.io/Pusat-bantuan-/)"; flow:established,to_server; http.uri; content:"/Pusat-bantuan-/"; startswith; fast_pattern; http.host; content:"meta66245-cmyk.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013487; classtype:social-engineering; sid:6013487; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwv-roblox.com/games/5233782396/Creatures-of-Sonaria-Survive-Kaiju-Animals?privateServerLinkCode=863746617703768301)"; flow:established,to_server; http.uri; content:"/games/5233782396/Creatures-of-Sonaria-Survive-Kaiju-Animals?privateServerLinkCode=863746617703768301"; startswith; fast_pattern; http.host; content:"wwv-roblox.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013488; classtype:social-engineering; sid:6013488; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (johnw833.sg-host.com/mon/jss/aldomain.html)"; flow:established,to_server; http.uri; content:"/mon/jss/aldomain.html"; startswith; fast_pattern; http.host; content:"johnw833.sg-host.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013489; classtype:social-engineering; sid:6013489; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xyl8.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xyl8.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013490; classtype:social-engineering; sid:6013490; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.wnsr3696.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.wnsr3696.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013491; classtype:social-engineering; sid:6013491; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ae3d0dd541417a13b17cb41393242588e82aa8b2dbbecdbd53121cf30f.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ae3d0dd541417a13b17cb41393242588e82aa8b2dbbecdbd53121cf30f.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013492; classtype:social-engineering; sid:6013492; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thefarmhouserent.com/choiceandcontrol/choiceandcontrol.htm)"; flow:established,to_server; http.uri; content:"/choiceandcontrol/choiceandcontrol.htm"; startswith; fast_pattern; http.host; content:"thefarmhouserent.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013493; classtype:social-engineering; sid:6013493; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafybeicktlze5dqdqm3teumr5roddw3rehhjg7pl7yanrvd53yx26v5244.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafybeicktlze5dqdqm3teumr5roddw3rehhjg7pl7yanrvd53yx26v5244.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013494; classtype:social-engineering; sid:6013494; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (connexion-ar24.userlc.com/userscm/)"; flow:established,to_server; http.uri; content:"/userscm/"; startswith; fast_pattern; http.host; content:"connexion-ar24.userlc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013495; classtype:social-engineering; sid:6013495; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (federalnewsmagazine.com/2513501.doc/18a80a/fad0f483-81b2-45c6-ad47-7272058d9cb6)"; flow:established,to_server; http.uri; content:"/2513501.doc/18a80a/fad0f483-81b2-45c6-ad47-7272058d9cb6"; startswith; fast_pattern; http.host; content:"federalnewsmagazine.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013496; classtype:social-engineering; sid:6013496; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedagiofreeflow-brasil.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pedagiofreeflow-brasil.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013497; classtype:social-engineering; sid:6013497; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (creditagricole-activation.bolt.host/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"creditagricole-activation.bolt.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013498; classtype:social-engineering; sid:6013498; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prestamoenlineabhddrd.liveblog365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"prestamoenlineabhddrd.liveblog365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013499; classtype:social-engineering; sid:6013499; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.freeflow-rodovias.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.freeflow-rodovias.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013500; classtype:social-engineering; sid:6013500; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-jade-ten.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-jade-ten.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013501; classtype:social-engineering; sid:6013501; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (traditional-championship-945162.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"traditional-championship-945162.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013502; classtype:social-engineering; sid:6013502; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f.digital-sending.com/igit/4/bcmrv68Qkjv0hjoye8QgsuQwku9ic8Qs9fQ582QlyQeQ7)"; flow:established,to_server; http.uri; content:"/igit/4/bcmrv68Qkjv0hjoye8QgsuQwku9ic8Qs9fQ582QlyQeQ7"; startswith; fast_pattern; http.host; content:"f.digital-sending.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013503; classtype:social-engineering; sid:6013503; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrw.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingrw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013504; classtype:social-engineering; sid:6013504; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kuoxmiologen.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kuoxmiologen.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013505; classtype:social-engineering; sid:6013505; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imagorad.com.br/prot/)"; flow:established,to_server; http.uri; content:"/prot/"; startswith; fast_pattern; http.host; content:"imagorad.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013506; classtype:social-engineering; sid:6013506; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trzrstart.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trzrstart.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013507; classtype:social-engineering; sid:6013507; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bnp-cledigitale.bolt.host/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bnp-cledigitale.bolt.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013508; classtype:social-engineering; sid:6013508; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hqrieta.s3.eu-north-1.amazonaws.com/tmv.html)"; flow:established,to_server; http.uri; content:"/tmv.html"; startswith; fast_pattern; http.host; content:"hqrieta.s3.eu-north-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013509; classtype:social-engineering; sid:6013509; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365bet211.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.365bet211.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013510; classtype:social-engineering; sid:6013510; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (privacy-services-division.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"privacy-services-division.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013511; classtype:social-engineering; sid:6013511; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cse23r01a05cq.github.io/Amazon-project/)"; flow:established,to_server; http.uri; content:"/Amazon-project/"; startswith; fast_pattern; http.host; content:"cse23r01a05cq.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013512; classtype:social-engineering; sid:6013512; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ac-oll-15060101010101010101.vercel.app/Ma010chelpAbh1041/index.html?ph0nq=null)"; flow:established,to_server; http.uri; content:"/Ma010chelpAbh1041/index.html?ph0nq=null"; startswith; fast_pattern; http.host; content:"ac-oll-15060101010101010101.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013513; classtype:social-engineering; sid:6013513; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (camparyxseces.wasmer.app/sbadisaster)"; flow:established,to_server; http.uri; content:"/sbadisaster"; startswith; fast_pattern; http.host; content:"camparyxseces.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013514; classtype:social-engineering; sid:6013514; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (unreal-closet-604598.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"unreal-closet-604598.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013515; classtype:social-engineering; sid:6013515; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jdcarnes.davidsabido.com/wp-content/2026/)"; flow:established,to_server; http.uri; content:"/wp-content/2026/"; startswith; fast_pattern; http.host; content:"jdcarnes.davidsabido.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013516; classtype:social-engineering; sid:6013516; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.threswk.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.threswk.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013517; classtype:social-engineering; sid:6013517; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vivek.howtowpguide.info/48-1576-050626/?u=83C1576&e=galenhub@e9eabe75fd949e4bcb8da576a6e7f838a7d7.org&s3=Wojciech&s4=Kulas&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/48-1576-050626/?u=83C1576&e=galenhub@e9eabe75fd949e4bcb8da576a6e7f838a7d7.org&s3=Wojciech&s4=Kulas&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"vivek.howtowpguide.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013518; classtype:social-engineering; sid:6013518; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.105633222.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.105633222.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013519; classtype:social-engineering; sid:6013519; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ubs.cx/customers/signin)"; flow:established,to_server; http.uri; content:"/customers/signin"; startswith; fast_pattern; http.host; content:"ubs.cx"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013520; classtype:social-engineering; sid:6013520; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agricole-espace.bolt.host/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"agricole-espace.bolt.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013521; classtype:social-engineering; sid:6013521; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verific-page.shop/project/Flverr)"; flow:established,to_server; http.uri; content:"/project/Flverr"; startswith; fast_pattern; http.host; content:"verific-page.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013522; classtype:social-engineering; sid:6013522; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (buildan.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"buildan.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013523; classtype:social-engineering; sid:6013523; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedagio-online.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pedagio-online.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013524; classtype:social-engineering; sid:6013524; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6a305e2813dfbd3fb78810c4--ubiquitous-gingersnap-809853.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6a305e2813dfbd3fb78810c4--ubiquitous-gingersnap-809853.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013525; classtype:social-engineering; sid:6013525; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingry.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingry.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013526; classtype:social-engineering; sid:6013526; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chloewnavalcert.wasmer.app/lhava-technologies)"; flow:established,to_server; http.uri; content:"/lhava-technologies"; startswith; fast_pattern; http.host; content:"chloewnavalcert.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013527; classtype:social-engineering; sid:6013527; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ww-brasilrodovias.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ww-brasilrodovias.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013528; classtype:social-engineering; sid:6013528; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iesjsfvengcsdntd.meganelxspt.info/leds/)"; flow:established,to_server; http.uri; content:"/leds/"; startswith; fast_pattern; http.host; content:"iesjsfvengcsdntd.meganelxspt.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013529; classtype:social-engineering; sid:6013529; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rong1209.github.io/faecbook)"; flow:established,to_server; http.uri; content:"/faecbook"; startswith; fast_pattern; http.host; content:"rong1209.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013530; classtype:social-engineering; sid:6013530; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingre.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingre.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013531; classtype:social-engineering; sid:6013531; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brachunchun.com/js/made.in.china/membercenter.made-in-china.com/index.html)"; flow:established,to_server; http.uri; content:"/js/made.in.china/membercenter.made-in-china.com/index.html"; startswith; fast_pattern; http.host; content:"brachunchun.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013532; classtype:social-engineering; sid:6013532; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f.digital-pathway.com/igit/4/dfb4fj8Bk9zefinxd7BdrtB3awjf47Br8eBc81BkxBdB6)"; flow:established,to_server; http.uri; content:"/igit/4/dfb4fj8Bk9zefinxd7BdrtB3awjf47Br8eBc81BkxBdB6"; startswith; fast_pattern; http.host; content:"f.digital-pathway.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013533; classtype:social-engineering; sid:6013533; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (topicguides.info/CH41-N1515-D090606/?u=12C1515&e=loronz@6f8f9751bf2f7641fa38e1584d18b293653e.net&s3=&s4=&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/CH41-N1515-D090606/?u=12C1515&e=loronz@6f8f9751bf2f7641fa38e1584d18b293653e.net&s3=&s4=&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"topicguides.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013534; classtype:social-engineering; sid:6013534; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (service-trezor.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"service-trezor.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013535; classtype:social-engineering; sid:6013535; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (michealbolaji024-web.github.io/Netflix)"; flow:established,to_server; http.uri; content:"/Netflix"; startswith; fast_pattern; http.host; content:"michealbolaji024-web.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013536; classtype:social-engineering; sid:6013536; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.thegmfinancial.com/Mac/utility.php)"; flow:established,to_server; http.uri; content:"/Mac/utility.php"; startswith; fast_pattern; http.host; content:"www.thegmfinancial.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013537; classtype:social-engineering; sid:6013537; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ar245.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ar245.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013538; classtype:social-engineering; sid:6013538; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (worker-ancient-cherry-d115.cumphlw-ilip-hr.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"worker-ancient-cherry-d115.cumphlw-ilip-hr.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013539; classtype:social-engineering; sid:6013539; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gaamsinilogon.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gaamsinilogon.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013540; classtype:social-engineering; sid:6013540; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s0luc10n-4mar1ll4.gamer.gd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"s0luc10n-4mar1ll4.gamer.gd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013541; classtype:social-engineering; sid:6013541; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7hhbh8.cn/mmixosct)"; flow:established,to_server; http.uri; content:"/mmixosct"; startswith; fast_pattern; http.host; content:"7hhbh8.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013542; classtype:social-engineering; sid:6013542; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cm280896.tw1.ru/emn/gomn/)"; flow:established,to_server; http.uri; content:"/emn/gomn/"; startswith; fast_pattern; http.host; content:"cm280896.tw1.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013543; classtype:social-engineering; sid:6013543; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ac156ollnno01010101010101010101.vercel.app/Wi010nhelpAbh1041/index.html?ph0nq=null)"; flow:established,to_server; http.uri; content:"/Wi010nhelpAbh1041/index.html?ph0nq=null"; startswith; fast_pattern; http.host; content:"ac156ollnno01010101010101010101.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013544; classtype:social-engineering; sid:6013544; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (charter.itupdates.support/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/"; startswith; fast_pattern; http.host; content:"charter.itupdates.support"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013545; classtype:social-engineering; sid:6013545; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cn-imtoken.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cn-imtoken.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013546; classtype:social-engineering; sid:6013546; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (awesome-sapphire-coyote.31-22-7-7.cpanel.site/registrar/)"; flow:established,to_server; http.uri; content:"/registrar/"; startswith; fast_pattern; http.host; content:"awesome-sapphire-coyote.31-22-7-7.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013547; classtype:social-engineering; sid:6013547; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bnp-reactivatio.bolt.host/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bnp-reactivatio.bolt.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013548; classtype:social-engineering; sid:6013548; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enel-ba.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"enel-ba.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013549; classtype:social-engineering; sid:6013549; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (endive-iris-7232.squarespace.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"endive-iris-7232.squarespace.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013550; classtype:social-engineering; sid:6013550; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (discreet-mountain-005558.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"discreet-mountain-005558.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013551; classtype:social-engineering; sid:6013551; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (restaurantlayalina.ro/Adobe_Acrobat_Reader/)"; flow:established,to_server; http.uri; content:"/Adobe_Acrobat_Reader/"; startswith; fast_pattern; http.host; content:"restaurantlayalina.ro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013552; classtype:social-engineering; sid:6013552; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingry.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingry.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013553; classtype:social-engineering; sid:6013553; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4jw.d29.mytemp.website/mijnabnaa/app-vernieuwen/loading.html)"; flow:established,to_server; http.uri; content:"/mijnabnaa/app-vernieuwen/loading.html"; startswith; fast_pattern; http.host; content:"4jw.d29.mytemp.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013554; classtype:social-engineering; sid:6013554; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoja76.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoja76.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013555; classtype:social-engineering; sid:6013555; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thoughtful-years-447976.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"thoughtful-years-447976.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013556; classtype:social-engineering; sid:6013556; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (freeflow.com.kz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"freeflow.com.kz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013557; classtype:social-engineering; sid:6013557; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chloewnavalcert.wasmer.app/bytelight)"; flow:established,to_server; http.uri; content:"/bytelight"; startswith; fast_pattern; http.host; content:"chloewnavalcert.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013558; classtype:social-engineering; sid:6013558; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metododeliberacao.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"metododeliberacao.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013559; classtype:social-engineering; sid:6013559; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pauloherriqueggg259-bot.github.io/gov.c)"; flow:established,to_server; http.uri; content:"/gov.c"; startswith; fast_pattern; http.host; content:"pauloherriqueggg259-bot.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013560; classtype:social-engineering; sid:6013560; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (consulta-aqui-rd.iceiy.com/index2.html)"; flow:established,to_server; http.uri; content:"/index2.html"; startswith; fast_pattern; http.host; content:"consulta-aqui-rd.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013561; classtype:social-engineering; sid:6013561; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cathoaixarles.fr/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cathoaixarles.fr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013562; classtype:social-engineering; sid:6013562; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f.digital-sending.com/igit/4/4qxm14fP6zb9bchr71P9lnPn75pewPl28P12vPerP7P0)"; flow:established,to_server; http.uri; content:"/igit/4/4qxm14fP6zb9bchr71P9lnPn75pewPl28P12vPerP7P0"; startswith; fast_pattern; http.host; content:"f.digital-sending.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013563; classtype:social-engineering; sid:6013563; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bhdprestamospersonal.infinityfree.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bhdprestamospersonal.infinityfree.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013564; classtype:social-engineering; sid:6013564; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-digital.click/pedagio/)"; flow:established,to_server; http.uri; content:"/pedagio/"; startswith; fast_pattern; http.host; content:"app-digital.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013565; classtype:social-engineering; sid:6013565; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (practical-lavender-lstlcjg0-dpj54c25wmbe.edgeone.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"practical-lavender-lstlcjg0-dpj54c25wmbe.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013566; classtype:social-engineering; sid:6013566; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (krishnatuwar.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"krishnatuwar.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013567; classtype:social-engineering; sid:6013567; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (delightful-halva-8272c8.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"delightful-halva-8272c8.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013568; classtype:social-engineering; sid:6013568; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingre.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingre.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013569; classtype:social-engineering; sid:6013569; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrt.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingrt.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013570; classtype:social-engineering; sid:6013570; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tyret-1-ya.028426.com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/"; startswith; fast_pattern; http.host; content:"tyret-1-ya.028426.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013571; classtype:social-engineering; sid:6013571; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (creditagricole-reactivation.bolt.host/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"creditagricole-reactivation.bolt.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013572; classtype:social-engineering; sid:6013572; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bo6iur2.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bo6iur2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013573; classtype:social-engineering; sid:6013573; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agricole-activation1.bolt.host/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"agricole-activation1.bolt.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013574; classtype:social-engineering; sid:6013574; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (engenhariaviolet.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"engenhariaviolet.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013575; classtype:social-engineering; sid:6013575; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.usbank-brc.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.usbank-brc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013576; classtype:social-engineering; sid:6013576; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.site-4hencvzd9.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.site-4hencvzd9.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013577; classtype:social-engineering; sid:6013577; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prestamos-bhdleon-2026.iceiy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"prestamos-bhdleon-2026.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013578; classtype:social-engineering; sid:6013578; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedagiofflowbr.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pedagiofflowbr.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013579; classtype:social-engineering; sid:6013579; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4jw.d29.mytemp.website/mijnabnaa/app-vernieuwen/reader.html)"; flow:established,to_server; http.uri; content:"/mijnabnaa/app-vernieuwen/reader.html"; startswith; fast_pattern; http.host; content:"4jw.d29.mytemp.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013580; classtype:social-engineering; sid:6013580; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.alncsc.fit/Adobe/Adobefile.html)"; flow:established,to_server; http.uri; content:"/Adobe/Adobefile.html"; startswith; fast_pattern; http.host; content:"www.alncsc.fit"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013581; classtype:social-engineering; sid:6013581; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anchousmanik.com/project/Flverr)"; flow:established,to_server; http.uri; content:"/project/Flverr"; startswith; fast_pattern; http.host; content:"anchousmanik.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013582; classtype:social-engineering; sid:6013582; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.jdcarnes.davidsabido.com/wp-content/2026/)"; flow:established,to_server; http.uri; content:"/wp-content/2026/"; startswith; fast_pattern; http.host; content:"www.jdcarnes.davidsabido.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013583; classtype:social-engineering; sid:6013583; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e03e0b58f0508f4c70296c7a04bec13d81dd03edb3f819f2b2e0c01ae4.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e03e0b58f0508f4c70296c7a04bec13d81dd03edb3f819f2b2e0c01ae4.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013584; classtype:social-engineering; sid:6013584; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d9.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d9.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013585; classtype:social-engineering; sid:6013585; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (privacy-authentication-desk.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"privacy-authentication-desk.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013586; classtype:social-engineering; sid:6013586; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secureloginonline.com/?rid=Hsk8TMX)"; flow:established,to_server; http.uri; content:"/?rid=Hsk8TMX"; startswith; fast_pattern; http.host; content:"secureloginonline.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013587; classtype:social-engineering; sid:6013587; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3inew-3y4.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3inew-3y4.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013588; classtype:social-engineering; sid:6013588; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-uphold-cdn.infinityfreeapp.com/?i=1/)"; flow:established,to_server; http.uri; content:"/?i=1/"; startswith; fast_pattern; http.host; content:"sso-uphold-cdn.infinityfreeapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013589; classtype:social-engineering; sid:6013589; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp-archive-view.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp-archive-view.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013590; classtype:social-engineering; sid:6013590; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.agzjis.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.agzjis.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013591; classtype:social-engineering; sid:6013591; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yashank-25.github.io/Amazon-Fronted-Project)"; flow:established,to_server; http.uri; content:"/Amazon-Fronted-Project"; startswith; fast_pattern; http.host; content:"yashank-25.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013592; classtype:social-engineering; sid:6013592; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedagiobrasil.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pedagiobrasil.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013593; classtype:social-engineering; sid:6013593; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moises.cl/feisbuc-234435564/)"; flow:established,to_server; http.uri; content:"/feisbuc-234435564/"; startswith; fast_pattern; http.host; content:"moises.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013594; classtype:social-engineering; sid:6013594; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qr.codes/hbiDUB)"; flow:established,to_server; http.uri; content:"/hbiDUB"; startswith; fast_pattern; http.host; content:"qr.codes"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013595; classtype:social-engineering; sid:6013595; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (unicorn.creditfacts.info/48-1576-050626/?u=81C1576&e=galus9@55e4ab42926fe8e3deb94d60df82eb62bb6b.net&s3=Wojciech&s4=Kulas&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/48-1576-050626/?u=81C1576&e=galus9@55e4ab42926fe8e3deb94d60df82eb62bb6b.net&s3=Wojciech&s4=Kulas&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"unicorn.creditfacts.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013596; classtype:social-engineering; sid:6013596; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.thegmfinancial.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.thegmfinancial.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013597; classtype:social-engineering; sid:6013597; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8a-coder.github.io/amazon_clone)"; flow:established,to_server; http.uri; content:"/amazon_clone"; startswith; fast_pattern; http.host; content:"8a-coder.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013598; classtype:social-engineering; sid:6013598; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bhdprestamospersonal.infinityfree.io/index2.html)"; flow:established,to_server; http.uri; content:"/index2.html"; startswith; fast_pattern; http.host; content:"bhdprestamospersonal.infinityfree.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013599; classtype:social-engineering; sid:6013599; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agritrader.net.ve/weblog/log.php)"; flow:established,to_server; http.uri; content:"/weblog/log.php"; startswith; fast_pattern; http.host; content:"agritrader.net.ve"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013600; classtype:social-engineering; sid:6013600; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cyoung-studio.com/jp)"; flow:established,to_server; http.uri; content:"/jp"; startswith; fast_pattern; http.host; content:"cyoung-studio.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013601; classtype:social-engineering; sid:6013601; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopeeid4888.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopeeid4888.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013602; classtype:social-engineering; sid:6013602; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f.digital-sending.com/igit/4/4l6u2dtM8fzbcdis82MamoMrbkkwj2Mm39M02wMfsM8M1)"; flow:established,to_server; http.uri; content:"/igit/4/4l6u2dtM8fzbcdis82MamoMrbkkwj2Mm39M02wMfsM8M1"; startswith; fast_pattern; http.host; content:"f.digital-sending.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013603; classtype:social-engineering; sid:6013603; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.reactiveren-nu.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.reactiveren-nu.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013604; classtype:social-engineering; sid:6013604; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verific-page.shop/view/es)"; flow:established,to_server; http.uri; content:"/view/es"; startswith; fast_pattern; http.host; content:"verific-page.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013605; classtype:social-engineering; sid:6013605; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (swisborg-logiapp.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"swisborg-logiapp.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013606; classtype:social-engineering; sid:6013606; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (organizacaometodo.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"organizacaometodo.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013607; classtype:social-engineering; sid:6013607; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xupdate-105039.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xupdate-105039.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013608; classtype:social-engineering; sid:6013608; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoja77.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoja77.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013609; classtype:social-engineering; sid:6013609; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uphlerrsojiero.azurewebsites.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uphlerrsojiero.azurewebsites.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013610; classtype:social-engineering; sid:6013610; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prasantdumre837-cell.github.io/Amazon-Website-Clone-HTML-CSS-/)"; flow:established,to_server; http.uri; content:"/Amazon-Website-Clone-HTML-CSS-/"; startswith; fast_pattern; http.host; content:"prasantdumre837-cell.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013611; classtype:social-engineering; sid:6013611; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (escovashopee.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"escovashopee.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013612; classtype:social-engineering; sid:6013612; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (andrawshaj.github.io/Amazon-Project)"; flow:established,to_server; http.uri; content:"/Amazon-Project"; startswith; fast_pattern; http.host; content:"andrawshaj.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013613; classtype:social-engineering; sid:6013613; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maurimedis.com/wp-content/languages/themes/dhl/dhl/3/4.php/)"; flow:established,to_server; http.uri; content:"/wp-content/languages/themes/dhl/dhl/3/4.php/"; startswith; fast_pattern; http.host; content:"maurimedis.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013614; classtype:social-engineering; sid:6013614; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (playgroundgame.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"playgroundgame.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013615; classtype:social-engineering; sid:6013615; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (74ze98.cn/mmixosct/)"; flow:established,to_server; http.uri; content:"/mmixosct/"; startswith; fast_pattern; http.host; content:"74ze98.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013616; classtype:social-engineering; sid:6013616; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smooth-copper-jcvlgeq4.edgeone.app/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"smooth-copper-jcvlgeq4.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013617; classtype:social-engineering; sid:6013617; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pinipenaveena.github.io/Netflix-Homepage-UI-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Homepage-UI-Clone/"; startswith; fast_pattern; http.host; content:"pinipenaveena.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013618; classtype:social-engineering; sid:6013618; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ac156ollnno01010101010101010101.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ac156ollnno01010101010101010101.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013619; classtype:social-engineering; sid:6013619; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4jw.d29.mytemp.website/mijnabnaa/app-vernieuwen/gate.php)"; flow:established,to_server; http.uri; content:"/mijnabnaa/app-vernieuwen/gate.php"; startswith; fast_pattern; http.host; content:"4jw.d29.mytemp.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013620; classtype:social-engineering; sid:6013620; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ar24-connexion181554462874ar24.jimdofree.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ar24-connexion181554462874ar24.jimdofree.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013621; classtype:social-engineering; sid:6013621; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trzr-io-start.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trzr-io-start.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013622; classtype:social-engineering; sid:6013622; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (audio92872.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"audio92872.icu"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013623; classtype:social-engineering; sid:6013623; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ww547.selectiondulocker.com/?19vnMT3S=tkn)"; flow:established,to_server; http.uri; content:"/?19vnMT3S=tkn"; startswith; fast_pattern; http.host; content:"ww547.selectiondulocker.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013624; classtype:social-engineering; sid:6013624; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (readfile.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"readfile.online"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013625; classtype:social-engineering; sid:6013625; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fresti.pt/mat/)"; flow:established,to_server; http.uri; content:"/mat/"; startswith; fast_pattern; http.host; content:"fresti.pt"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013626; classtype:social-engineering; sid:6013626; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zsjcaaq.cdyhmh.cn/optmer-prefere_html/)"; flow:established,to_server; http.uri; content:"/optmer-prefere_html/"; startswith; fast_pattern; http.host; content:"zsjcaaq.cdyhmh.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013627; classtype:social-engineering; sid:6013627; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mg.duclbhk.com/en-us.microsoft-teams/Windows/download.php)"; flow:established,to_server; http.uri; content:"/en-us.microsoft-teams/Windows/download.php"; startswith; fast_pattern; http.host; content:"mg.duclbhk.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013628; classtype:social-engineering; sid:6013628; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.letnie-okazje28437571.cyou/oferta/id-7wv05e5c8o-Zestaw-elektronarzedzi-Makita-Idealny-na-prezent)"; flow:established,to_server; http.uri; content:"/oferta/id-7wv05e5c8o-Zestaw-elektronarzedzi-Makita-Idealny-na-prezent"; startswith; fast_pattern; http.host; content:"allegrolokalnie.letnie-okazje28437571.cyou"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013629; classtype:social-engineering; sid:6013629; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (morg-234.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"morg-234.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013630; classtype:social-engineering; sid:6013630; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (litera-bavarica.de/suchen/d_person.php?person=%22%2F%3E%3Cimg%20src%3D%22https%3A%2F%2Fgoogle.com%2FUPs4z0e1QBo7C.jpg%22%20onerror%3D%22window.location%3DdecodeURIComponent%28atob%28%27Njg3NDc0NzA3MzNhMmYyZjZhNjU3NDdhNzQyZTcwNzU3MzY4MmQ3NDYxNmUyZDY1NzI2ZTY1NzU2NTcyNmUyZTY5NmU2NjZmMmY3Mzc0NjE3Mjc0MmU3MDY4NzAyMzcwNjE2MzUyNmI0NTcwNzY%3D%27%29.replace%28%2F%28..%29%2Fg%2C%20%27%25%241%27%29%29%3B%22%3E)"; flow:established,to_server; http.uri; content:"/suchen/d_person.php?person=%22%2F%3E%3Cimg%20src%3D%22https%3A%2F%2Fgoogle.com%2FUPs4z0e1QBo7C.jpg%22%20onerror%3D%22window.location%3DdecodeURIComponent%28atob%28%27Njg3NDc0NzA3MzNhMmYyZjZhNjU3NDdhNzQyZTcwNzU3MzY4MmQ3NDYxNmUyZDY1NzI2ZTY1NzU2NTcyNmUyZTY5NmU2NjZmMmY3Mzc0NjE3Mjc0MmU3MDY4NzAyMzcwNjE2MzUyNmI0NTcwNzY%3D%27%29.replace%28%2F%28..%29%2Fg%2C%20%27%25%241%27%29%29%3B%22%3E"; startswith; fast_pattern; http.host; content:"litera-bavarica.de"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013631; classtype:social-engineering; sid:6013631; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (perfect-amber-kmdbqzs7-dp7c02ls0f4p.edgeone.app/jujuj.html)"; flow:established,to_server; http.uri; content:"/jujuj.html"; startswith; fast_pattern; http.host; content:"perfect-amber-kmdbqzs7-dp7c02ls0f4p.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013632; classtype:social-engineering; sid:6013632; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dienstenmutualiteitendris.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.dienstenmutualiteitendris.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013633; classtype:social-engineering; sid:6013633; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (exodussupport.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"exodussupport.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013634; classtype:social-engineering; sid:6013634; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (logginldcloud-appmnx.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"logginldcloud-appmnx.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013635; classtype:social-engineering; sid:6013635; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (encontrar-i-cloud.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"encontrar-i-cloud.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013636; classtype:social-engineering; sid:6013636; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jwrlazkp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jwrlazkp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013637; classtype:social-engineering; sid:6013637; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (diamond177disini.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"diamond177disini.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013638; classtype:social-engineering; sid:6013638; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrs.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingrs.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013639; classtype:social-engineering; sid:6013639; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sanderunion.club/personal/)"; flow:established,to_server; http.uri; content:"/personal/"; startswith; fast_pattern; http.host; content:"sanderunion.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013640; classtype:social-engineering; sid:6013640; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lcloud-encontrarmaps.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"lcloud-encontrarmaps.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013641; classtype:social-engineering; sid:6013641; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aplle-activa-find.us/a.php/)"; flow:established,to_server; http.uri; content:"/a.php/"; startswith; fast_pattern; http.host; content:"aplle-activa-find.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013642; classtype:social-engineering; sid:6013642; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aauth---trazorr.gitbook.io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"aauth---trazorr.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013643; classtype:social-engineering; sid:6013643; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dispositivo-i-cloud.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"dispositivo-i-cloud.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013644; classtype:social-engineering; sid:6013644; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.861365.cc/?a=352698)"; flow:established,to_server; http.uri; content:"/?a=352698"; startswith; fast_pattern; http.host; content:"www.861365.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013645; classtype:social-engineering; sid:6013645; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hamad007691.github.io/Amazon)"; flow:established,to_server; http.uri; content:"/Amazon"; startswith; fast_pattern; http.host; content:"hamad007691.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013646; classtype:social-engineering; sid:6013646; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pemenangshopee389.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pemenangshopee389.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013647; classtype:social-engineering; sid:6013647; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (weekdaymealprep.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"weekdaymealprep.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013648; classtype:social-engineering; sid:6013648; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiifkanpaylater.xbb.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiifkanpaylater.xbb.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013649; classtype:social-engineering; sid:6013649; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cardlamp-bit.github.io/plan-iphone/)"; flow:established,to_server; http.uri; content:"/plan-iphone/"; startswith; fast_pattern; http.host; content:"cardlamp-bit.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013650; classtype:social-engineering; sid:6013650; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.h365756.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.h365756.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013651; classtype:social-engineering; sid:6013651; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ajaykumar124.github.io/Netflix)"; flow:established,to_server; http.uri; content:"/Netflix"; startswith; fast_pattern; http.host; content:"ajaykumar124.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013652; classtype:social-engineering; sid:6013652; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (l-iniciarseuatendimento.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"l-iniciarseuatendimento.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013653; classtype:social-engineering; sid:6013653; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezor-start-io-en.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezor-start-io-en.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013654; classtype:social-engineering; sid:6013654; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.11365app.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.11365app.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013655; classtype:social-engineering; sid:6013655; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.teams-rl.com/p/fjbd-cbch/capluzli/)"; flow:established,to_server; http.uri; content:"/p/fjbd-cbch/capluzli/"; startswith; fast_pattern; http.host; content:"s.teams-rl.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013656; classtype:social-engineering; sid:6013656; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bkde-ega0c5ffdkdyhfhj.z03.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bkde-ega0c5ffdkdyhfhj.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013657; classtype:social-engineering; sid:6013657; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeeprize339.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopeeprize339.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013658; classtype:social-engineering; sid:6013658; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365newschina.com/bhuposm/)"; flow:established,to_server; http.uri; content:"/bhuposm/"; startswith; fast_pattern; http.host; content:"365newschina.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013659; classtype:social-engineering; sid:6013659; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-security-account.help/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"info-security-account.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013660; classtype:social-engineering; sid:6013660; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.6399cv28.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.6399cv28.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013661; classtype:social-engineering; sid:6013661; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.authentication.ms/E.ueL_dUMl4LiHfg)"; flow:established,to_server; http.uri; content:"/E.ueL_dUMl4LiHfg"; startswith; fast_pattern; http.host; content:"www.authentication.ms"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013662; classtype:social-engineering; sid:6013662; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vinalenergy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vinalenergy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013663; classtype:social-engineering; sid:6013663; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bluewin_aqjy0_sign_on_2w59svaxeu_2gjmxsjrni.awaqe.net/OhnOVl664PLaUvxU0c9EIgk02Du4FvDXlZ1eSgzY3YI1XUJ6OJ/CtqcSr0XOHNHDMAp0sgtN9t/mMERsS7r669KXBYJMJRUHCFBGhMKPbVwvFQ0ducY3XnHJ7rlqV-/NUIBv8GMj1LAgwXOm4hStnkIBdffTvLXOQayYccHolCnuPUg9F?RNHME76VCVvgr0Cc9JDX=Ekj6ibwcBSHyMe48O0na&\;qs=miretlab@d2898a116b2f1f5bec4fd50bee7f55a2fe10.net&\;F8NChH6C6hYgQ374igLkh9JeK37Ot4jK0zONRQ25oyOGCB17hnT6Rp7IkITKuvlFMTXIwbLhldnDBVyWBxQcdIeSat5livApBRfN=RlNn&\;&refresh=mjmtjpnjlqmrkimpmikolmmsmkjimsnlksmtkumv)"; flow:established,to_server; http.uri; content:"/OhnOVl664PLaUvxU0c9EIgk02Du4FvDXlZ1eSgzY3YI1XUJ6OJ/CtqcSr0XOHNHDMAp0sgtN9t/mMERsS7r669KXBYJMJRUHCFBGhMKPbVwvFQ0ducY3XnHJ7rlqV-/NUIBv8GMj1LAgwXOm4hStnkIBdffTvLXOQayYccHolCnuPUg9F?RNHME76VCVvgr0Cc9JDX=Ekj6ibwcBSHyMe48O0na&|3b|qs=miretlab@d2898a116b2f1f5bec4fd50bee7f55a2fe10.net&|3b|F8NChH6C6hYgQ374igLkh9JeK37Ot4jK0zONRQ25oyOGCB17hnT6Rp7IkITKuvlFMTXIwbLhldnDBVyWBxQcdIeSat5livApBRfN=RlNn&|3b|&refresh=mjmtjpnjlqmrkimpmikolmmsmkjimsnlksmtkumv"; startswith; fast_pattern; http.host; content:"bluewin_aqjy0_sign_on_2w59svaxeu_2gjmxsjrni.awaqe.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013664; classtype:social-engineering; sid:6013664; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (api-wsource1-epc78300000000000152669tfn-homesolution.educacaosobredrogas.com.br/auth/login.php)"; flow:established,to_server; http.uri; content:"/auth/login.php"; startswith; fast_pattern; http.host; content:"api-wsource1-epc78300000000000152669tfn-homesolution.educacaosobredrogas.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013665; classtype:social-engineering; sid:6013665; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (busca-midisp.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"busca-midisp.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013666; classtype:social-engineering; sid:6013666; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (treezoarwalletis.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"treezoarwalletis.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013667; classtype:social-engineering; sid:6013667; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.zjj.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.zjj.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013668; classtype:social-engineering; sid:6013668; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galeri-pemenang-shopee2021.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galeri-pemenang-shopee2021.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013669; classtype:social-engineering; sid:6013669; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3659x.win/promo.html)"; flow:established,to_server; http.uri; content:"/promo.html"; startswith; fast_pattern; http.host; content:"3659x.win"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013670; classtype:social-engineering; sid:6013670; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www_jndzwy_com.guangtaiyuan.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www_jndzwy_com.guangtaiyuan.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013671; classtype:social-engineering; sid:6013671; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (security-info-account.help/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"security-info-account.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013672; classtype:social-engineering; sid:6013672; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.roblox.com.mu/users/1336597261/profile)"; flow:established,to_server; http.uri; content:"/users/1336597261/profile"; startswith; fast_pattern; http.host; content:"www.roblox.com.mu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013673; classtype:social-engineering; sid:6013673; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app534153.hasspetorleum.com/r/?auth=383ff0e5cea5eab4&u=aHR0cHM6Ly8xMDEtcGVyc29uYWwtcHJvamVjdHMtdGVzdGluZy5hcHB3cml0ZS5uZXR3b3JrLz9hdXRoPXRvdXJpc20ucnRAdGF0YXIucnU=)"; flow:established,to_server; http.uri; content:"/r/?auth=383ff0e5cea5eab4&u=aHR0cHM6Ly8xMDEtcGVyc29uYWwtcHJvamVjdHMtdGVzdGluZy5hcHB3cml0ZS5uZXR3b3JrLz9hdXRoPXRvdXJpc20ucnRAdGF0YXIucnU="; startswith; fast_pattern; http.host; content:"app534153.hasspetorleum.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013674; classtype:social-engineering; sid:6013674; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (workspacegatewayhub.com/ftx/page.html)"; flow:established,to_server; http.uri; content:"/ftx/page.html"; startswith; fast_pattern; http.host; content:"workspacegatewayhub.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013675; classtype:social-engineering; sid:6013675; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox.fo/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"roblox.fo"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013676; classtype:social-engineering; sid:6013676; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (your-lost-iphone-apple-suspended.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"your-lost-iphone-apple-suspended.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013677; classtype:social-engineering; sid:6013677; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cloud-aldm-poh.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"cloud-aldm-poh.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013678; classtype:social-engineering; sid:6013678; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (find-account.help/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"find-account.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013679; classtype:social-engineering; sid:6013679; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (undianresmishopee2022.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"undianresmishopee2022.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013680; classtype:social-engineering; sid:6013680; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jqfzxx.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jqfzxx.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013681; classtype:social-engineering; sid:6013681; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (program-resmi44.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"program-resmi44.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013682; classtype:social-engineering; sid:6013682; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6yod3a.lmax.xin/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6yod3a.lmax.xin"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013683; classtype:social-engineering; sid:6013683; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (logginapp-lcloudmx.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"logginapp-lcloudmx.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013684; classtype:social-engineering; sid:6013684; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (impactinfluxmedia.com/pages/?d=scotia&p=index)"; flow:established,to_server; http.uri; content:"/pages/?d=scotia&p=index"; startswith; fast_pattern; http.host; content:"impactinfluxmedia.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013685; classtype:social-engineering; sid:6013685; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sign-pple-maps.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"sign-pple-maps.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013686; classtype:social-engineering; sid:6013686; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingro.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingro.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013687; classtype:social-engineering; sid:6013687; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pdf.streamlinedweb.de/PgpGG/)"; flow:established,to_server; http.uri; content:"/PgpGG/"; startswith; fast_pattern; http.host; content:"pdf.streamlinedweb.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013688; classtype:social-engineering; sid:6013688; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suport.office365-update.org/?rid=ra8WGHO)"; flow:established,to_server; http.uri; content:"/?rid=ra8WGHO"; startswith; fast_pattern; http.host; content:"suport.office365-update.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013689; classtype:social-engineering; sid:6013689; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lcloud-iphonemaps.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"lcloud-iphonemaps.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013690; classtype:social-engineering; sid:6013690; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lflind-lcloud.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"lflind-lcloud.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013691; classtype:social-engineering; sid:6013691; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cambodiasustancert.wasmer.app/en/)"; flow:established,to_server; http.uri; content:"/en/"; startswith; fast_pattern; http.host; content:"cambodiasustancert.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013692; classtype:social-engineering; sid:6013692; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dispositivo-perdidomex.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"dispositivo-perdidomex.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013693; classtype:social-engineering; sid:6013693; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dycmch.com/xdnpwbin/)"; flow:established,to_server; http.uri; content:"/xdnpwbin/"; startswith; fast_pattern; http.host; content:"dycmch.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013694; classtype:social-engineering; sid:6013694; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (857365.cc/?a=352698)"; flow:established,to_server; http.uri; content:"/?a=352698"; startswith; fast_pattern; http.host; content:"857365.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013695; classtype:social-engineering; sid:6013695; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.862365.cc/?a=352698)"; flow:established,to_server; http.uri; content:"/?a=352698"; startswith; fast_pattern; http.host; content:"www.862365.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013696; classtype:social-engineering; sid:6013696; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (program-resmi559.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"program-resmi559.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013697; classtype:social-engineering; sid:6013697; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dispositivo-idcloud-ld.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"dispositivo-idcloud-ld.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013698; classtype:social-engineering; sid:6013698; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bonfires.hostel.town/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bonfires.hostel.town"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013699; classtype:social-engineering; sid:6013699; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (notifications-iqeq.com/hfv0wtghmm78uwbq)"; flow:established,to_server; http.uri; content:"/hfv0wtghmm78uwbq"; startswith; fast_pattern; http.host; content:"notifications-iqeq.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013700; classtype:social-engineering; sid:6013700; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gezondheidscentrum-klntnr34821.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gezondheidscentrum-klntnr34821.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013701; classtype:social-engineering; sid:6013701; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flnd-lcloud-devic.help/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"flnd-lcloud-devic.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013702; classtype:social-engineering; sid:6013702; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.galeri-pemenang-shopee2021.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.galeri-pemenang-shopee2021.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013703; classtype:social-engineering; sid:6013703; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (locmy-phone.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"locmy-phone.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013704; classtype:social-engineering; sid:6013704; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support.northstarresolution.help/user-support/)"; flow:established,to_server; http.uri; content:"/user-support/"; startswith; fast_pattern; http.host; content:"support.northstarresolution.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013705; classtype:social-engineering; sid:6013705; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-io-trezoo-r.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-io-trezoo-r.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013706; classtype:social-engineering; sid:6013706; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kjhgrtykbhj-dpnfz9dllbs3.edgeone.cool/?eo_token=f285a2333820a1d57d4c9d3ac0b8d37d)"; flow:established,to_server; http.uri; content:"/?eo_token=f285a2333820a1d57d4c9d3ac0b8d37d"; startswith; fast_pattern; http.host; content:"kjhgrtykbhj-dpnfz9dllbs3.edgeone.cool"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013707; classtype:social-engineering; sid:6013707; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (layanan-undian56.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"layanan-undian56.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013708; classtype:social-engineering; sid:6013708; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mrako.vip/promo.html)"; flow:established,to_server; http.uri; content:"/promo.html"; startswith; fast_pattern; http.host; content:"mrako.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013709; classtype:social-engineering; sid:6013709; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mysql.tchosting.net/cgi-bin/home.ha/)"; flow:established,to_server; http.uri; content:"/cgi-bin/home.ha/"; startswith; fast_pattern; http.host; content:"mysql.tchosting.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013710; classtype:social-engineering; sid:6013710; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (custermerservices-marketingbranding-aitechen.br-gru-1.linodeobjects.com/index24.html)"; flow:established,to_server; http.uri; content:"/index24.html"; startswith; fast_pattern; http.host; content:"custermerservices-marketingbranding-aitechen.br-gru-1.linodeobjects.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013711; classtype:social-engineering; sid:6013711; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wordpress-212591-0.cloudclusters.net/client10337/C90aGVt/CH/)"; flow:established,to_server; http.uri; content:"/client10337/C90aGVt/CH/"; startswith; fast_pattern; http.host; content:"wordpress-212591-0.cloudclusters.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013712; classtype:social-engineering; sid:6013712; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (upholdvip.im/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"upholdvip.im"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013713; classtype:social-engineering; sid:6013713; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vivacious-enthusiasm-422563.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vivacious-enthusiasm-422563.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013714; classtype:social-engineering; sid:6013714; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tech-liren.run/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"tech-liren.run"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013715; classtype:social-engineering; sid:6013715; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bridge--a-public-trezor.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bridge--a-public-trezor.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013716; classtype:social-engineering; sid:6013716; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (keyssoulcarebeautycar.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"keyssoulcarebeautycar.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013717; classtype:social-engineering; sid:6013717; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (20-215-49-139.cprapid.com/ch/kasse.php)"; flow:established,to_server; http.uri; content:"/ch/kasse.php"; startswith; fast_pattern; http.host; content:"20-215-49-139.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013718; classtype:social-engineering; sid:6013718; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ar245.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ar245.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013719; classtype:social-engineering; sid:6013719; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (api-wsource1-epc78300000000000152669tfn-homesolution.educacaosobredrogas.com.br/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"api-wsource1-epc78300000000000152669tfn-homesolution.educacaosobredrogas.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013720; classtype:social-engineering; sid:6013720; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-account-ios.help/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"info-account-ios.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013721; classtype:social-engineering; sid:6013721; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (home-faqs-trezr-io.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"home-faqs-trezr-io.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013722; classtype:social-engineering; sid:6013722; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-io-trezo-us.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-io-trezo-us.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013723; classtype:social-engineering; sid:6013723; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (securepdfdocsmanagementcloud.avl-ec.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"securepdfdocsmanagementcloud.avl-ec.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013724; classtype:social-engineering; sid:6013724; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (santunion.club/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"santunion.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013725; classtype:social-engineering; sid:6013725; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee2545.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopee2545.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013726; classtype:social-engineering; sid:6013726; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.roblox.com.mu/users/334929622/profile)"; flow:established,to_server; http.uri; content:"/users/334929622/profile"; startswith; fast_pattern; http.host; content:"www.roblox.com.mu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013727; classtype:social-engineering; sid:6013727; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wanko-base.com/Aeroplan/shaw/index.html?id=033)"; flow:established,to_server; http.uri; content:"/Aeroplan/shaw/index.html?id=033"; startswith; fast_pattern; http.host; content:"wanko-base.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013728; classtype:social-engineering; sid:6013728; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (findmappas-ldcloudmp.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"findmappas-ldcloudmp.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013729; classtype:social-engineering; sid:6013729; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lcloud-mex-loginmaps.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"lcloud-mex-loginmaps.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013730; classtype:social-engineering; sid:6013730; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sunillm2026.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"sunillm2026.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013731; classtype:social-engineering; sid:6013731; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pemenangshopee28.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pemenangshopee28.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013732; classtype:social-engineering; sid:6013732; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.program-resmi559.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.program-resmi559.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013733; classtype:social-engineering; sid:6013733; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (am.ydvxk.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"am.ydvxk.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013734; classtype:social-engineering; sid:6013734; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (project2-amazone-clone.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"project2-amazone-clone.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013735; classtype:social-engineering; sid:6013735; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hilfekunden.de/?r=b877e467-73a5-4134-a11e-e8e22b5353ac)"; flow:established,to_server; http.uri; content:"/?r=b877e467-73a5-4134-a11e-e8e22b5353ac"; startswith; fast_pattern; http.host; content:"hilfekunden.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013736; classtype:social-engineering; sid:6013736; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cyon-ch.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cyon-ch.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013737; classtype:social-engineering; sid:6013737; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cloud-icl-fml.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"cloud-icl-fml.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013738; classtype:social-engineering; sid:6013738; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faraz-khan-booking-com-clone-react-project-1-jza6qqtrfilv.vercel.app/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"faraz-khan-booking-com-clone-react-project-1-jza6qqtrfilv.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013739; classtype:social-engineering; sid:6013739; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (learn-trezo-io-web.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"learn-trezo-io-web.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013740; classtype:social-engineering; sid:6013740; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.play-kygame.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.play-kygame.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013741; classtype:social-engineering; sid:6013741; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.aa1998brazil.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.aa1998brazil.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013742; classtype:social-engineering; sid:6013742; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apple-info-account.help/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"apple-info-account.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013743; classtype:social-engineering; sid:6013743; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecuador-lcloudd.help/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"ecuador-lcloudd.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013744; classtype:social-engineering; sid:6013744; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (supportlogin.tredenece.com/?rid=6740508&f=1&key=aDTbPI)"; flow:established,to_server; http.uri; content:"/?rid=6740508&f=1&key=aDTbPI"; startswith; fast_pattern; http.host; content:"supportlogin.tredenece.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013745; classtype:social-engineering; sid:6013745; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.psand.sbs/ob53/)"; flow:established,to_server; http.uri; content:"/ob53/"; startswith; fast_pattern; http.host; content:"www.psand.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013746; classtype:social-engineering; sid:6013746; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7hjp8t.cn/mmixosct)"; flow:established,to_server; http.uri; content:"/mmixosct"; startswith; fast_pattern; http.host; content:"7hjp8t.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013747; classtype:social-engineering; sid:6013747; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mathentertianment.com/utl/)"; flow:established,to_server; http.uri; content:"/utl/"; startswith; fast_pattern; http.host; content:"mathentertianment.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013748; classtype:social-engineering; sid:6013748; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (encrypt-email.org/landing/form/540a12c8-6a32-4287-8fd5-a977aaf4451c)"; flow:established,to_server; http.uri; content:"/landing/form/540a12c8-6a32-4287-8fd5-a977aaf4451c"; startswith; fast_pattern; http.host; content:"encrypt-email.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013749; classtype:social-engineering; sid:6013749; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reservierung.dpdns.org/cash35658768)"; flow:established,to_server; http.uri; content:"/cash35658768"; startswith; fast_pattern; http.host; content:"reservierung.dpdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013750; classtype:social-engineering; sid:6013750; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-1cloud-find-1.com/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"app-1cloud-find-1.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013751; classtype:social-engineering; sid:6013751; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.zhs-kaiyungroup.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.zhs-kaiyungroup.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013752; classtype:social-engineering; sid:6013752; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (encontrar-i-phone.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"encontrar-i-phone.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013753; classtype:social-engineering; sid:6013753; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-drurnex-biz-fraltek-vrolnix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-drurnex-biz-fraltek-vrolnix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013754; classtype:social-engineering; sid:6013754; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9000-firebase-authenticate-1781494318542.cluster-c72u3gwiofapkvxrcwjq5zllcu.cloudworkstations.dev/?monospaceUid=88952)"; flow:established,to_server; http.uri; content:"/?monospaceUid=88952"; startswith; fast_pattern; http.host; content:"9000-firebase-authenticate-1781494318542.cluster-c72u3gwiofapkvxrcwjq5zllcu.cloudworkstations.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013755; classtype:social-engineering; sid:6013755; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maps-ubi-localizado.com/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"maps-ubi-localizado.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013756; classtype:social-engineering; sid:6013756; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fntools.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fntools.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013757; classtype:social-engineering; sid:6013757; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (findldmaps-asistenmxn.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"findldmaps-asistenmxn.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013758; classtype:social-engineering; sid:6013758; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (worker-shy-sky-e17b.kidic25665.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"worker-shy-sky-e17b.kidic25665.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013759; classtype:social-engineering; sid:6013759; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www_c-tlc_com.xc9888.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www_c-tlc_com.xc9888.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013760; classtype:social-engineering; sid:6013760; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (energetic-rose-pony.31-22-7-7.cpanel.site/bony/)"; flow:established,to_server; http.uri; content:"/bony/"; startswith; fast_pattern; http.host; content:"energetic-rose-pony.31-22-7-7.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013761; classtype:social-engineering; sid:6013761; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www-appid-buscar-phone.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"www-appid-buscar-phone.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013762; classtype:social-engineering; sid:6013762; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (encontrar-mixup.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"encontrar-mixup.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013763; classtype:social-engineering; sid:6013763; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (calendar-invites.com/landing/form/42b2f68d-7176-4b69-9ad3-1912810401ba)"; flow:established,to_server; http.uri; content:"/landing/form/42b2f68d-7176-4b69-9ad3-1912810401ba"; startswith; fast_pattern; http.host; content:"calendar-invites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013764; classtype:social-engineering; sid:6013764; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app649669.hasspetorleum.com/r/?auth=b11750fa7c8490e0&u=aHR0cHM6Ly8xMDEtcGVyc29uYWwtcHJvamVjdHMtdGVzdGluZy5hcHB3cml0ZS5uZXR3b3JrLz9hdXRoPXdlYm1hc3RlckByY2p5Lmdvdi5zYQ==)"; flow:established,to_server; http.uri; content:"/r/?auth=b11750fa7c8490e0&u=aHR0cHM6Ly8xMDEtcGVyc29uYWwtcHJvamVjdHMtdGVzdGluZy5hcHB3cml0ZS5uZXR3b3JrLz9hdXRoPXdlYm1hc3RlckByY2p5Lmdvdi5zYQ=="; startswith; fast_pattern; http.host; content:"app649669.hasspetorleum.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013765; classtype:social-engineering; sid:6013765; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (avijeet1912.github.io/Streamflix)"; flow:established,to_server; http.uri; content:"/Streamflix"; startswith; fast_pattern; http.host; content:"avijeet1912.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013766; classtype:social-engineering; sid:6013766; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www-applecol-support-encontrar.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"www-applecol-support-encontrar.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013767; classtype:social-engineering; sid:6013767; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (20-215-49-139.cprapid.com/ch/)"; flow:established,to_server; http.uri; content:"/ch/"; startswith; fast_pattern; http.host; content:"20-215-49-139.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013768; classtype:social-engineering; sid:6013768; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-account-ios26.help/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"info-account-ios26.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013769; classtype:social-engineering; sid:6013769; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store.workshopcommunityratemods.com/sharedfiles/filesdetails/id=35225482508/)"; flow:established,to_server; http.uri; content:"/sharedfiles/filesdetails/id=35225482508/"; startswith; fast_pattern; http.host; content:"store.workshopcommunityratemods.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013770; classtype:social-engineering; sid:6013770; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.lootscanner.one/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.lootscanner.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013771; classtype:social-engineering; sid:6013771; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pemenangshopee28.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pemenangshopee28.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013772; classtype:social-engineering; sid:6013772; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (passcode-apple-id-lost-phone.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"passcode-apple-id-lost-phone.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013773; classtype:social-engineering; sid:6013773; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (umegasortemusical.com.br/ap/index.html)"; flow:established,to_server; http.uri; content:"/ap/index.html"; startswith; fast_pattern; http.host; content:"umegasortemusical.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013774; classtype:social-engineering; sid:6013774; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auspost.customerservicez.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auspost.customerservicez.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013775; classtype:social-engineering; sid:6013775; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.89fcbr1.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.89fcbr1.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013776; classtype:social-engineering; sid:6013776; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lphone-i-cloudmaps.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"lphone-i-cloudmaps.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013777; classtype:social-engineering; sid:6013777; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adbesta-dp1kudlt0rsh.edgeone.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"adbesta-dp1kudlt0rsh.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013778; classtype:social-engineering; sid:6013778; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (welcome-trezorai-com.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"welcome-trezorai-com.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013779; classtype:social-engineering; sid:6013779; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (notifications-iqeq.com/rl6qg6ddpmf4mt8b)"; flow:established,to_server; http.uri; content:"/rl6qg6ddpmf4mt8b"; startswith; fast_pattern; http.host; content:"notifications-iqeq.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013780; classtype:social-engineering; sid:6013780; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kjhgrtykbhj-dpxqvlaupe9d.edgeone.cool/?eo_token=48787297ca6c107cd16b7bf4c3f31c79)"; flow:established,to_server; http.uri; content:"/?eo_token=48787297ca6c107cd16b7bf4c3f31c79"; startswith; fast_pattern; http.host; content:"kjhgrtykbhj-dpxqvlaupe9d.edgeone.cool"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013781; classtype:social-engineering; sid:6013781; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accesomex-lcloud.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"accesomex-lcloud.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013782; classtype:social-engineering; sid:6013782; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9000-firebase-ml-1781591956243.cluster-l2bgochoazbomqgfmlhuvdvgiy.cloudworkstations.dev/?monospaceUid=1412)"; flow:established,to_server; http.uri; content:"/?monospaceUid=1412"; startswith; fast_pattern; http.host; content:"9000-firebase-ml-1781591956243.cluster-l2bgochoazbomqgfmlhuvdvgiy.cloudworkstations.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013783; classtype:social-engineering; sid:6013783; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.h554tyc.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.h554tyc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013784; classtype:social-engineering; sid:6013784; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-gpt-fawn.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-gpt-fawn.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013785; classtype:social-engineering; sid:6013785; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloud-usa-mx.com/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"icloud-usa-mx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013786; classtype:social-engineering; sid:6013786; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.roblox.com.mu/users/6541002943/profile)"; flow:established,to_server; http.uri; content:"/users/6541002943/profile"; startswith; fast_pattern; http.host; content:"www.roblox.com.mu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013787; classtype:social-engineering; sid:6013787; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jrzwlxqp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jrzwlxqp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013788; classtype:social-engineering; sid:6013788; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (encontrar-mapps.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"encontrar-mapps.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013789; classtype:social-engineering; sid:6013789; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thrshopee227.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"thrshopee227.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013790; classtype:social-engineering; sid:6013790; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (col-ilogincloud.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"col-ilogincloud.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013791; classtype:social-engineering; sid:6013791; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ac-oll-15060101010101010101.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ac-oll-15060101010101010101.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013792; classtype:social-engineering; sid:6013792; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (passcode-apple-id-lost-phone.us/isignesp.php)"; flow:established,to_server; http.uri; content:"/isignesp.php"; startswith; fast_pattern; http.host; content:"passcode-apple-id-lost-phone.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013793; classtype:social-engineering; sid:6013793; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrp.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingrp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013794; classtype:social-engineering; sid:6013794; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (layanan-hadiah99.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"layanan-hadiah99.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013795; classtype:social-engineering; sid:6013795; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xljxx.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xljxx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013796; classtype:social-engineering; sid:6013796; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (impactinfluxmedia.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"impactinfluxmedia.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013797; classtype:social-engineering; sid:6013797; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (buscami-dispenlinea.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"buscami-dispenlinea.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013798; classtype:social-engineering; sid:6013798; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (doguru.co.il/night/)"; flow:established,to_server; http.uri; content:"/night/"; startswith; fast_pattern; http.host; content:"doguru.co.il"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013799; classtype:social-engineering; sid:6013799; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-8234218404-chainpayout-net.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-8234218404-chainpayout-net.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013800; classtype:social-engineering; sid:6013800; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aauth---trazorr.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aauth---trazorr.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013801; classtype:social-engineering; sid:6013801; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (finmy-phonesupport.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"finmy-phonesupport.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013802; classtype:social-engineering; sid:6013802; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dubai---bookingcom.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dubai---bookingcom.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013803; classtype:social-engineering; sid:6013803; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store-phon-net.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"store-phon-net.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013804; classtype:social-engineering; sid:6013804; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2355bet.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2355bet.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013805; classtype:social-engineering; sid:6013805; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flnd-locate-icl.com/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"flnd-locate-icl.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013806; classtype:social-engineering; sid:6013806; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deleted.securefanpagemeta.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"deleted.securefanpagemeta.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013807; classtype:social-engineering; sid:6013807; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (port10.govisibl.com/dlv/c.php?cca=273138&ccz=6740&cid=w0qoior66jk9dp5j31ojdcta&siteid=)"; flow:established,to_server; http.uri; content:"/dlv/c.php?cca=273138&ccz=6740&cid=w0qoior66jk9dp5j31ojdcta&siteid="; startswith; fast_pattern; http.host; content:"port10.govisibl.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013808; classtype:social-engineering; sid:6013808; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (personal-adm-inf-iniciarr.iceiy.com/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"personal-adm-inf-iniciarr.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013809; classtype:social-engineering; sid:6013809; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auspost.customerservicel.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auspost.customerservicel.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013810; classtype:social-engineering; sid:6013810; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (propocisionmandate-rolexsa.us-east-1.linodeobjects.com/checkers.html)"; flow:established,to_server; http.uri; content:"/checkers.html"; startswith; fast_pattern; http.host; content:"propocisionmandate-rolexsa.us-east-1.linodeobjects.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013811; classtype:social-engineering; sid:6013811; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support.vanguardresolution.help/user-support/)"; flow:established,to_server; http.uri; content:"/user-support/"; startswith; fast_pattern; http.host; content:"support.vanguardresolution.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013812; classtype:social-engineering; sid:6013812; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kys3l.xljxx.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kys3l.xljxx.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013813; classtype:social-engineering; sid:6013813; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lcloud-accesomex.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"lcloud-accesomex.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013814; classtype:social-engineering; sid:6013814; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trazer-ai-bridge.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trazer-ai-bridge.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013815; classtype:social-engineering; sid:6013815; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (find-my-phone-al-ldevices-offline.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"find-my-phone-al-ldevices-offline.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013816; classtype:social-engineering; sid:6013816; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-gpt-fawn.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-gpt-fawn.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013817; classtype:social-engineering; sid:6013817; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (three.laitiaozhan.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"three.laitiaozhan.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013818; classtype:social-engineering; sid:6013818; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (localizado-maps-mx.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"localizado-maps-mx.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013819; classtype:social-engineering; sid:6013819; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecuador-lcloud.com/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"ecuador-lcloud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013820; classtype:social-engineering; sid:6013820; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flnd-iph-fmi.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"flnd-iph-fmi.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013821; classtype:social-engineering; sid:6013821; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flnd-iph-icl.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"flnd-iph-icl.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013822; classtype:social-engineering; sid:6013822; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (swaeba-bilal.github.io/Amazon_clone)"; flow:established,to_server; http.uri; content:"/Amazon_clone"; startswith; fast_pattern; http.host; content:"swaeba-bilal.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013823; classtype:social-engineering; sid:6013823; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee2545.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopee2545.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013824; classtype:social-engineering; sid:6013824; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (notifications-iqeq.com/ao2phuaeswxtsfpx)"; flow:established,to_server; http.uri; content:"/ao2phuaeswxtsfpx"; startswith; fast_pattern; http.host; content:"notifications-iqeq.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013825; classtype:social-engineering; sid:6013825; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rahul-kumar-mahato.github.io/netflix)"; flow:established,to_server; http.uri; content:"/netflix"; startswith; fast_pattern; http.host; content:"rahul-kumar-mahato.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013826; classtype:social-engineering; sid:6013826; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.roblox.com.mu/users/7407726152/profile)"; flow:established,to_server; http.uri; content:"/users/7407726152/profile"; startswith; fast_pattern; http.host; content:"www.roblox.com.mu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013827; classtype:social-engineering; sid:6013827; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezur-feq-str.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezur-feq-str.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013828; classtype:social-engineering; sid:6013828; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.exodussupport.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.exodussupport.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013829; classtype:social-engineering; sid:6013829; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eat-co.com/wex/omo.html)"; flow:established,to_server; http.uri; content:"/wex/omo.html"; startswith; fast_pattern; http.host; content:"eat-co.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013830; classtype:social-engineering; sid:6013830; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (parafusacos.com.br/?id=arjuna189)"; flow:established,to_server; http.uri; content:"/?id=arjuna189"; startswith; fast_pattern; http.host; content:"parafusacos.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013831; classtype:social-engineering; sid:6013831; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.gnzrwplx.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.gnzrwplx.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013832; classtype:social-engineering; sid:6013832; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jrzwpxql.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jrzwpxql.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013833; classtype:social-engineering; sid:6013833; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iclodmx-help-me.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"iclodmx-help-me.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013834; classtype:social-engineering; sid:6013834; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clickitonce.com/ee71e6/xoxo/sms.php/)"; flow:established,to_server; http.uri; content:"/ee71e6/xoxo/sms.php/"; startswith; fast_pattern; http.host; content:"clickitonce.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013835; classtype:social-engineering; sid:6013835; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aplle-activa-find.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"aplle-activa-find.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013836; classtype:social-engineering; sid:6013836; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lcloud-maps26.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"lcloud-maps26.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013837; classtype:social-engineering; sid:6013837; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ios26-maps.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"ios26-maps.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013838; classtype:social-engineering; sid:6013838; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (learn-hardware_tezo-en.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"learn-hardware_tezo-en.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013839; classtype:social-engineering; sid:6013839; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lcloud-buscarmaps.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"lcloud-buscarmaps.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013840; classtype:social-engineering; sid:6013840; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (localmedicalmarijuana.com/e9fc99/gh/uop.html?email=oronpro@88d643cd7fbc42b89a3ad14918a81998d156.org)"; flow:established,to_server; http.uri; content:"/e9fc99/gh/uop.html?email=oronpro@88d643cd7fbc42b89a3ad14918a81998d156.org"; startswith; fast_pattern; http.host; content:"localmedicalmarijuana.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013841; classtype:social-engineering; sid:6013841; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (superfluous-deck-706256.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"superfluous-deck-706256.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013842; classtype:social-engineering; sid:6013842; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.allegg.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.allegg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013843; classtype:social-engineering; sid:6013843; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apple-maps.info/nbG)"; flow:established,to_server; http.uri; content:"/nbG"; startswith; fast_pattern; http.host; content:"apple-maps.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013844; classtype:social-engineering; sid:6013844; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app121624.hasspetorleum.com/r/?auth=69c1701f7cf79db6&u=aHR0cHM6Ly8xMDEtcGVyc29uYWwtcHJvamVjdHMtdGVzdGluZy5hcHB3cml0ZS5uZXR3b3JrLz9hdXRoPWxvbGl0YS5tYXRldUB2bnVrb3ZvLnJ1)"; flow:established,to_server; http.uri; content:"/r/?auth=69c1701f7cf79db6&u=aHR0cHM6Ly8xMDEtcGVyc29uYWwtcHJvamVjdHMtdGVzdGluZy5hcHB3cml0ZS5uZXR3b3JrLz9hdXRoPWxvbGl0YS5tYXRldUB2bnVrb3ZvLnJ1"; startswith; fast_pattern; http.host; content:"app121624.hasspetorleum.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013845; classtype:social-engineering; sid:6013845; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atleticacentrolario.it/se/ur/)"; flow:established,to_server; http.uri; content:"/se/ur/"; startswith; fast_pattern; http.host; content:"atleticacentrolario.it"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013846; classtype:social-engineering; sid:6013846; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klelnanzeigen-deutch.wc0759.com/Nhri3EaMBl?m=5)"; flow:established,to_server; http.uri; content:"/Nhri3EaMBl?m=5"; startswith; fast_pattern; http.host; content:"klelnanzeigen-deutch.wc0759.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013847; classtype:social-engineering; sid:6013847; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgr-start.zapier.app/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"ledgr-start.zapier.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013848; classtype:social-engineering; sid:6013848; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fifaworldcup-jobs.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fifaworldcup-jobs.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013849; classtype:social-engineering; sid:6013849; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2f5doi.share-eu1.hsforms.com/2gfPH58UaQFeTjWusWySvVg)"; flow:established,to_server; http.uri; content:"/2gfPH58UaQFeTjWusWySvVg"; startswith; fast_pattern; http.host; content:"2f5doi.share-eu1.hsforms.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013850; classtype:social-engineering; sid:6013850; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cl.s13.exct.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cl.s13.exct.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013851; classtype:social-engineering; sid:6013851; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (theresultsearch.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"theresultsearch.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013852; classtype:social-engineering; sid:6013852; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (leboncoin.vdhd.fr/pay/login.php)"; flow:established,to_server; http.uri; content:"/pay/login.php"; startswith; fast_pattern; http.host; content:"leboncoin.vdhd.fr"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013853; classtype:social-engineering; sid:6013853; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (casobancamiga.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"casobancamiga.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013854; classtype:social-engineering; sid:6013854; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (frgrgjfeijfegrfeifei.cfolks.pl/cr/fo/)"; flow:established,to_server; http.uri; content:"/cr/fo/"; startswith; fast_pattern; http.host; content:"frgrgjfeijfegrfeifei.cfolks.pl"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013855; classtype:social-engineering; sid:6013855; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.1020smart9381.baby/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.1020smart9381.baby"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013856; classtype:social-engineering; sid:6013856; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie.smart93818192.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.smart93818192.xyz"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013857; classtype:social-engineering; sid:6013857; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fifahiring.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fifahiring.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013858; classtype:social-engineering; sid:6013858; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shubhamvatsjha7.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"shubhamvatsjha7.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013859; classtype:social-engineering; sid:6013859; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ww547.terbaru-2023.com/?tkn=19vnMT3S)"; flow:established,to_server; http.uri; content:"/?tkn=19vnMT3S"; startswith; fast_pattern; http.host; content:"ww547.terbaru-2023.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013860; classtype:social-engineering; sid:6013860; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tematica.pt/recon/)"; flow:established,to_server; http.uri; content:"/recon/"; startswith; fast_pattern; http.host; content:"tematica.pt"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6013861; classtype:social-engineering; sid:6013861; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (drivkac.click/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&dsh=S-1892784165%3A1781648110060649&followup=https%3A%2F%2Faccounts.google.com%2F&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AcDsRvw8PExz_ljCTZXq-X3AGuhctgFBkOVRiY99zYNj0_j3GzpVDxd2QQZUHwXnowNAmlgtfYT_9w)"; flow:established,to_server; http.uri; content:"/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&dsh=S-1892784165%3A1781648110060649&followup=https%3A%2F%2Faccounts.google.com%2F&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AcDsRvw8PExz_ljCTZXq-X3AGuhctgFBkOVRiY99zYNj0_j3GzpVDxd2QQZUHwXnowNAmlgtfYT_9w"; startswith; fast_pattern; http.host; content:"drivkac.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013862; classtype:social-engineering; sid:6013862; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ptshopee445.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ptshopee445.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013863; classtype:social-engineering; sid:6013863; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.aceccessos2026.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.aceccessos2026.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013864; classtype:social-engineering; sid:6013864; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.lhh.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.lhh.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013865; classtype:social-engineering; sid:6013865; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auspost.customerservicem.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auspost.customerservicem.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013866; classtype:social-engineering; sid:6013866; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (microsoft-login.praetoria.fr/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"microsoft-login.praetoria.fr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013867; classtype:social-engineering; sid:6013867; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (expatgold.asia/law.php/)"; flow:established,to_server; http.uri; content:"/law.php/"; startswith; fast_pattern; http.host; content:"expatgold.asia"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013868; classtype:social-engineering; sid:6013868; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (truea1sdvbjhsdvbjhsdb-f4d7epekfteqbwcw.z02.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"truea1sdvbjhsdvbjhsdb-f4d7epekfteqbwcw.z02.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013869; classtype:social-engineering; sid:6013869; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (crsorgi-gov.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"crsorgi-gov.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013870; classtype:social-engineering; sid:6013870; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vdhd.fr/pay/login.php)"; flow:established,to_server; http.uri; content:"/pay/login.php"; startswith; fast_pattern; http.host; content:"vdhd.fr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013871; classtype:social-engineering; sid:6013871; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8yaz-k3zj-br05.cebsgroupsreceivables-ar-caesars-com-s-account.workers.dev/06846646a4b32744?email=renen1@33bc362c7d0244c23e91b0064ac18bee8a4a.com/)"; flow:established,to_server; http.uri; content:"/06846646a4b32744?email=renen1@33bc362c7d0244c23e91b0064ac18bee8a4a.com/"; startswith; fast_pattern; http.host; content:"8yaz-k3zj-br05.cebsgroupsreceivables-ar-caesars-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013872; classtype:social-engineering; sid:6013872; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumento86.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumento86.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013873; classtype:social-engineering; sid:6013873; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (office365.rricrosoft-offices.org/i/df3667320560f4a8a9918ef9f3f4c4383)"; flow:established,to_server; http.uri; content:"/i/df3667320560f4a8a9918ef9f3f4c4383"; startswith; fast_pattern; http.host; content:"office365.rricrosoft-offices.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013874; classtype:social-engineering; sid:6013874; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rohit-123-vii.github.io/project-1.html/)"; flow:established,to_server; http.uri; content:"/project-1.html/"; startswith; fast_pattern; http.host; content:"rohit-123-vii.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013875; classtype:social-engineering; sid:6013875; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.2017winplataforma1.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.2017winplataforma1.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013876; classtype:social-engineering; sid:6013876; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cpcodm.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cpcodm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013877; classtype:social-engineering; sid:6013877; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (soft-states-572702.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"soft-states-572702.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013878; classtype:social-engineering; sid:6013878; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dccertificate.in/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dccertificate.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013879; classtype:social-engineering; sid:6013879; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ri5-cbfga3eueneqa2g8.z02.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ri5-cbfga3eueneqa2g8.z02.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013880; classtype:social-engineering; sid:6013880; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (getvalued.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"getvalued.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013881; classtype:social-engineering; sid:6013881; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (leboncoin.vdhd.fr/pay/login.php)"; flow:established,to_server; http.uri; content:"/pay/login.php"; startswith; fast_pattern; http.host; content:"leboncoin.vdhd.fr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013882; classtype:social-engineering; sid:6013882; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (owa-production-26ca.up.railway.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"owa-production-26ca.up.railway.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013883; classtype:social-engineering; sid:6013883; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vivektiwari2006.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"vivektiwari2006.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013884; classtype:social-engineering; sid:6013884; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (admanagement.do/water)"; flow:established,to_server; http.uri; content:"/water"; startswith; fast_pattern; http.host; content:"admanagement.do"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013885; classtype:social-engineering; sid:6013885; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dc.crsorgi.gov.in.verfiys.in/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dc.crsorgi.gov.in.verfiys.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013886; classtype:social-engineering; sid:6013886; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bx55-a.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bx55-a.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013887; classtype:social-engineering; sid:6013887; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso---i-trustcapital-home-com.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sso---i-trustcapital-home-com.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013888; classtype:social-engineering; sid:6013888; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sejamaisfelizccomseunovolmt.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"sejamaisfelizccomseunovolmt.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013889; classtype:social-engineering; sid:6013889; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galabetin.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galabetin.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013890; classtype:social-engineering; sid:6013890; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.endive-iris-7232.squarespace.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.endive-iris-7232.squarespace.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013891; classtype:social-engineering; sid:6013891; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.perchemicals.com.tr/images/index.html)"; flow:established,to_server; http.uri; content:"/images/index.html"; startswith; fast_pattern; http.host; content:"www.perchemicals.com.tr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013892; classtype:social-engineering; sid:6013892; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a0lp34.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a0lp34.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013893; classtype:social-engineering; sid:6013893; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gaganvaishnav208.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"gaganvaishnav208.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013894; classtype:social-engineering; sid:6013894; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (leboncoin.vdhd.fr/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"leboncoin.vdhd.fr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013895; classtype:social-engineering; sid:6013895; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreidg7dhaupuit4wc2i7w22mphyqnlsp6cvp6gplvh7w4t25hmip24q.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreidg7dhaupuit4wc2i7w22mphyqnlsp6cvp6gplvh7w4t25hmip24q.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013896; classtype:social-engineering; sid:6013896; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoja83.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoja83.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013897; classtype:social-engineering; sid:6013897; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dc.crsorgi.gov.in.veriye.in/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dc.crsorgi.gov.in.veriye.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013898; classtype:social-engineering; sid:6013898; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help-trezorr-suit.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"help-trezorr-suit.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013899; classtype:social-engineering; sid:6013899; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365.pxsk123.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"365.pxsk123.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013900; classtype:social-engineering; sid:6013900; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gouvdgfesdavs.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.gouvdgfesdavs.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013901; classtype:social-engineering; sid:6013901; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gbwta.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gbwta.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013902; classtype:social-engineering; sid:6013902; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dc.crsorgi.gov.in.verfy.store/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dc.crsorgi.gov.in.verfy.store"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013903; classtype:social-engineering; sid:6013903; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (businees-verify-badge-vip-12363123xcv.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"businees-verify-badge-vip-12363123xcv.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013904; classtype:social-engineering; sid:6013904; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tanakabauer.info/41-1511-280526/?u=162C1515&e=haruschmi%2540gmail.com&s3=Hansruedi&s4=Schmidlin&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/41-1511-280526/?u=162C1515&e=haruschmi%2540gmail.com&s3=Hansruedi&s4=Schmidlin&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"tanakabauer.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013905; classtype:social-engineering; sid:6013905; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coxon8.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coxon8.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013906; classtype:social-engineering; sid:6013906; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vdhd.fr/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"vdhd.fr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013907; classtype:social-engineering; sid:6013907; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auspost.customerservicec.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auspost.customerservicec.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013908; classtype:social-engineering; sid:6013908; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrl.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingrl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013909; classtype:social-engineering; sid:6013909; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (author-start-trezor.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"author-start-trezor.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013910; classtype:social-engineering; sid:6013910; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docment.e-docssign.net/a6f4ab/5372b28b-1718-482e-afd8-5ae0571cba68)"; flow:established,to_server; http.uri; content:"/a6f4ab/5372b28b-1718-482e-afd8-5ae0571cba68"; startswith; fast_pattern; http.host; content:"docment.e-docssign.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013911; classtype:social-engineering; sid:6013911; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thrshopee16.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"thrshopee16.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013912; classtype:social-engineering; sid:6013912; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nithishjadhav-jn.github.io/netflix-homepage-clone/)"; flow:established,to_server; http.uri; content:"/netflix-homepage-clone/"; startswith; fast_pattern; http.host; content:"nithishjadhav-jn.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013913; classtype:social-engineering; sid:6013913; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gbwhata.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gbwhata.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013914; classtype:social-engineering; sid:6013914; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fruedenberg-filter.com/xlsx)"; flow:established,to_server; http.uri; content:"/xlsx"; startswith; fast_pattern; http.host; content:"fruedenberg-filter.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013915; classtype:social-engineering; sid:6013915; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (387f628c.privacy-compliance-authenticated.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"387f628c.privacy-compliance-authenticated.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013916; classtype:social-engineering; sid:6013916; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sorer.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sorer.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013917; classtype:social-engineering; sid:6013917; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ccyyz.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ccyyz.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013918; classtype:social-engineering; sid:6013918; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appdocsv13.argosconsultoria.com/b4638c9dccaab)"; flow:established,to_server; http.uri; content:"/b4638c9dccaab"; startswith; fast_pattern; http.host; content:"appdocsv13.argosconsultoria.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013919; classtype:social-engineering; sid:6013919; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (privacy-help-authority.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"privacy-help-authority.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013920; classtype:social-engineering; sid:6013920; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dmibgc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dmibgc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013921; classtype:social-engineering; sid:6013921; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cn-app-jrszhibo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cn-app-jrszhibo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013922; classtype:social-engineering; sid:6013922; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b7f1c8d4a6e23f9c5d1a7b0e4c8f6291.57e7egs.com/?email=zenorsys@b20ce3ad4f6988c88dd0d361a84d4a4627af.org)"; flow:established,to_server; http.uri; content:"/?email=zenorsys@b20ce3ad4f6988c88dd0d361a84d4a4627af.org"; startswith; fast_pattern; http.host; content:"b7f1c8d4a6e23f9c5d1a7b0e4c8f6291.57e7egs.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013923; classtype:social-engineering; sid:6013923; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instruction-upslux-2026.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instruction-upslux-2026.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013924; classtype:social-engineering; sid:6013924; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (drivkac.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"drivkac.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013925; classtype:social-engineering; sid:6013925; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (solucoesprahoje.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"solucoesprahoje.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013926; classtype:social-engineering; sid:6013926; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dc.crsorgi.gov.in.index.web-index.info/general-public)"; flow:established,to_server; http.uri; content:"/general-public"; startswith; fast_pattern; http.host; content:"dc.crsorgi.gov.in.index.web-index.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013927; classtype:social-engineering; sid:6013927; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auspost.customerserviceqt.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auspost.customerserviceqt.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013928; classtype:social-engineering; sid:6013928; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spacepotato08.neocities.org/iclanda/)"; flow:established,to_server; http.uri; content:"/iclanda/"; startswith; fast_pattern; http.host; content:"spacepotato08.neocities.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013929; classtype:social-engineering; sid:6013929; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nanigudivaka.github.io/Amazon-clone-with-JavaScript)"; flow:established,to_server; http.uri; content:"/Amazon-clone-with-JavaScript"; startswith; fast_pattern; http.host; content:"nanigudivaka.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013930; classtype:social-engineering; sid:6013930; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (efficacyheatficient.sbs/auth/)"; flow:established,to_server; http.uri; content:"/auth/"; startswith; fast_pattern; http.host; content:"efficacyheatficient.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013931; classtype:social-engineering; sid:6013931; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (418aoa.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"418aoa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013932; classtype:social-engineering; sid:6013932; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (organizacaotudo.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"organizacaotudo.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013933; classtype:social-engineering; sid:6013933; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ka.bjpglyg.com/cgi/)"; flow:established,to_server; http.uri; content:"/cgi/"; startswith; fast_pattern; http.host; content:"ka.bjpglyg.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013934; classtype:social-engineering; sid:6013934; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (office365.rricrosoft-offices.org/home/54f80b9d2ca445ce8bb46825c41b4636/df3667320560f4a8a9918ef9f3f4c4383)"; flow:established,to_server; http.uri; content:"/home/54f80b9d2ca445ce8bb46825c41b4636/df3667320560f4a8a9918ef9f3f4c4383"; startswith; fast_pattern; http.host; content:"office365.rricrosoft-offices.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013935; classtype:social-engineering; sid:6013935; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.trendymods.net/robux/index.html)"; flow:established,to_server; http.uri; content:"/robux/index.html"; startswith; fast_pattern; http.host; content:"www.trendymods.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013936; classtype:social-engineering; sid:6013936; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dc.crsorgi.gov.in.index.web-index.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dc.crsorgi.gov.in.index.web-index.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013937; classtype:social-engineering; sid:6013937; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dc.crsorgi.gov.in.ineu.eu.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dc.crsorgi.gov.in.ineu.eu.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013938; classtype:social-engineering; sid:6013938; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ggsgsgsgdjjczkjgjkggacggc-dpqt3wpkjdo9.edgeone.dev/english.html)"; flow:established,to_server; http.uri; content:"/english.html"; startswith; fast_pattern; http.host; content:"ggsgsgsgdjjczkjgjkggacggc-dpqt3wpkjdo9.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013939; classtype:social-engineering; sid:6013939; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (linkqr.id/s/pontun)"; flow:established,to_server; http.uri; content:"/s/pontun"; startswith; fast_pattern; http.host; content:"linkqr.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013940; classtype:social-engineering; sid:6013940; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (api-guide.orange-maroc.net/tableau-de-bord/login)"; flow:established,to_server; http.uri; content:"/tableau-de-bord/login"; startswith; fast_pattern; http.host; content:"api-guide.orange-maroc.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013941; classtype:social-engineering; sid:6013941; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ioannashellenichospitality.hostel.town/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ioannashellenichospitality.hostel.town"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013942; classtype:social-engineering; sid:6013942; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.smca.info/mwhips-invoice/)"; flow:established,to_server; http.uri; content:"/mwhips-invoice/"; startswith; fast_pattern; http.host; content:"www.smca.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013943; classtype:social-engineering; sid:6013943; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account.confirm-meta-badge.info/favicon.ico)"; flow:established,to_server; http.uri; content:"/favicon.ico"; startswith; fast_pattern; http.host; content:"account.confirm-meta-badge.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013944; classtype:social-engineering; sid:6013944; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox.com.mu/games/2753915549/Blox-Fruits?privateServerLinkCode=82226863540997344085517633552000)"; flow:established,to_server; http.uri; content:"/games/2753915549/Blox-Fruits?privateServerLinkCode=82226863540997344085517633552000"; startswith; fast_pattern; http.host; content:"roblox.com.mu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013945; classtype:social-engineering; sid:6013945; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (z8h9-bw89-fvck.css-sleepbetteraustin-com-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"z8h9-bw89-fvck.css-sleepbetteraustin-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013946; classtype:social-engineering; sid:6013946; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8yaz-k3zj-br05.cebsgroupsreceivables-ar-caesars-com-s-account.workers.dev/e29d28e7abc5b2ce?email=ravio@4aa190b0294aeb3f67750a25ff72193f69bf.net/)"; flow:established,to_server; http.uri; content:"/e29d28e7abc5b2ce?email=ravio@4aa190b0294aeb3f67750a25ff72193f69bf.net/"; startswith; fast_pattern; http.host; content:"8yaz-k3zj-br05.cebsgroupsreceivables-ar-caesars-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013947; classtype:social-engineering; sid:6013947; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gopal.business/ok/rogers)"; flow:established,to_server; http.uri; content:"/ok/rogers"; startswith; fast_pattern; http.host; content:"gopal.business"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013948; classtype:social-engineering; sid:6013948; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xj.flez.biz.id/ambill.sawerann)"; flow:established,to_server; http.uri; content:"/ambill.sawerann"; startswith; fast_pattern; http.host; content:"xj.flez.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013949; classtype:social-engineering; sid:6013949; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kritika963.github.io/Amazon-2.0/)"; flow:established,to_server; http.uri; content:"/Amazon-2.0/"; startswith; fast_pattern; http.host; content:"kritika963.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013950; classtype:social-engineering; sid:6013950; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ppyl.buzz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ppyl.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013951; classtype:social-engineering; sid:6013951; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (siteblasterco.productaccess.in/wp-includes/clone/flit/rab/hndawtw/ZXZhc3VAaGFydmF0ZWsuY29tLnR3)"; flow:established,to_server; http.uri; content:"/wp-includes/clone/flit/rab/hndawtw/ZXZhc3VAaGFydmF0ZWsuY29tLnR3"; startswith; fast_pattern; http.host; content:"siteblasterco.productaccess.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013952; classtype:social-engineering; sid:6013952; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fedxscan.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fedxscan.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013953; classtype:social-engineering; sid:6013953; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (freeflowbrasil.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"freeflowbrasil.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013954; classtype:social-engineering; sid:6013954; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auspost.customerservicev.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auspost.customerservicev.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013955; classtype:social-engineering; sid:6013955; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kritika963.github.io/Amazon-2.0)"; flow:established,to_server; http.uri; content:"/Amazon-2.0"; startswith; fast_pattern; http.host; content:"kritika963.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013956; classtype:social-engineering; sid:6013956; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mujakkir-maher.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"mujakkir-maher.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013957; classtype:social-engineering; sid:6013957; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qxlyhl.com/xdnpwbin/)"; flow:established,to_server; http.uri; content:"/xdnpwbin/"; startswith; fast_pattern; http.host; content:"qxlyhl.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013958; classtype:social-engineering; sid:6013958; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (presudeind3xsoff-dpr3nq7g30sv.edgeone.dev/indexs.html)"; flow:established,to_server; http.uri; content:"/indexs.html"; startswith; fast_pattern; http.host; content:"presudeind3xsoff-dpr3nq7g30sv.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013959; classtype:social-engineering; sid:6013959; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (index-zeo.nasser-kineticsgroup-ae-s-account.workers.dev/bf3bb6f1918f9e9f/)"; flow:established,to_server; http.uri; content:"/bf3bb6f1918f9e9f/"; startswith; fast_pattern; http.host; content:"index-zeo.nasser-kineticsgroup-ae-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013960; classtype:social-engineering; sid:6013960; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alexgalho.com.br/anodur)"; flow:established,to_server; http.uri; content:"/anodur"; startswith; fast_pattern; http.host; content:"alexgalho.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013961; classtype:social-engineering; sid:6013961; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cg6681.craftum.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cg6681.craftum.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013962; classtype:social-engineering; sid:6013962; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebookmessenger12.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"facebookmessenger12.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013963; classtype:social-engineering; sid:6013963; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instantformhdc.com/pages/captcha.php)"; flow:established,to_server; http.uri; content:"/pages/captcha.php"; startswith; fast_pattern; http.host; content:"instantformhdc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013964; classtype:social-engineering; sid:6013964; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jk-1914.github.io/Netflix-UI-Clone)"; flow:established,to_server; http.uri; content:"/Netflix-UI-Clone"; startswith; fast_pattern; http.host; content:"jk-1914.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013965; classtype:social-engineering; sid:6013965; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (freeflowoficial.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"freeflowoficial.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013966; classtype:social-engineering; sid:6013966; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fogdev.icecubestudio.com/wp-doc/fileshared/)"; flow:established,to_server; http.uri; content:"/wp-doc/fileshared/"; startswith; fast_pattern; http.host; content:"fogdev.icecubestudio.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013967; classtype:social-engineering; sid:6013967; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bptransport.ch/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bptransport.ch"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013968; classtype:social-engineering; sid:6013968; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dc.crsorgi.gov.in.web.dccertificate.in/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dc.crsorgi.gov.in.web.dccertificate.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013969; classtype:social-engineering; sid:6013969; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ffxko.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ffxko.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013970; classtype:social-engineering; sid:6013970; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreicjsieopcis332voy6xbzi2farum3qrvhqnxvykv3vulhw2wj6y7m.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreicjsieopcis332voy6xbzi2farum3qrvhqnxvykv3vulhw2wj6y7m.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013971; classtype:social-engineering; sid:6013971; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gopal.business/ok/rogers/login.html/)"; flow:established,to_server; http.uri; content:"/ok/rogers/login.html/"; startswith; fast_pattern; http.host; content:"gopal.business"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013972; classtype:social-engineering; sid:6013972; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instruction-upslux-2026.com/app/index.php?view=main&id=da55a61adfa44ac5b0c4e5080b19a95c)"; flow:established,to_server; http.uri; content:"/app/index.php?view=main&id=da55a61adfa44ac5b0c4e5080b19a95c"; startswith; fast_pattern; http.host; content:"instruction-upslux-2026.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013973; classtype:social-engineering; sid:6013973; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (takami-web.co.jp/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"takami-web.co.jp"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013974; classtype:social-engineering; sid:6013974; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (garakuta-ichi.net/wordpress/wp-content/plugins/made/membercenter.made-in-china.com/index.html)"; flow:established,to_server; http.uri; content:"/wordpress/wp-content/plugins/made/membercenter.made-in-china.com/index.html"; startswith; fast_pattern; http.host; content:"garakuta-ichi.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013975; classtype:social-engineering; sid:6013975; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gopal.business/ok/rogers/login.html)"; flow:established,to_server; http.uri; content:"/ok/rogers/login.html"; startswith; fast_pattern; http.host; content:"gopal.business"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013976; classtype:social-engineering; sid:6013976; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (68-210-101-96.cprapid.com/de/)"; flow:established,to_server; http.uri; content:"/de/"; startswith; fast_pattern; http.host; content:"68-210-101-96.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013977; classtype:social-engineering; sid:6013977; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aujhmv.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aujhmv.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013978; classtype:social-engineering; sid:6013978; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (knowledgeable-beige-turtle.31-22-7-7.cpanel.site/mini/)"; flow:established,to_server; http.uri; content:"/mini/"; startswith; fast_pattern; http.host; content:"knowledgeable-beige-turtle.31-22-7-7.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013979; classtype:social-engineering; sid:6013979; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.authsusngwd0c34748dhbdr673hndy73if5revssharepoint.cscllccmo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.authsusngwd0c34748dhbdr673hndy73if5revssharepoint.cscllccmo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013980; classtype:social-engineering; sid:6013980; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.seuabudcrx.yoga/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.seuabudcrx.yoga"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013981; classtype:social-engineering; sid:6013981; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9000-firebase-link-1781076144085.cluster-dccle54vc5d26v2fsixd2icgqi.cloudworkstations.dev/?monospaceUid=119697)"; flow:established,to_server; http.uri; content:"/?monospaceUid=119697"; startswith; fast_pattern; http.host; content:"9000-firebase-link-1781076144085.cluster-dccle54vc5d26v2fsixd2icgqi.cloudworkstations.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013982; classtype:social-engineering; sid:6013982; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bentrava.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bentrava.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013983; classtype:social-engineering; sid:6013983; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tiktokseller.aoyolo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tiktokseller.aoyolo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013984; classtype:social-engineering; sid:6013984; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dev3.ictusinitiative.net/app/)"; flow:established,to_server; http.uri; content:"/app/"; startswith; fast_pattern; http.host; content:"dev3.ictusinitiative.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013985; classtype:social-engineering; sid:6013985; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoja82.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoja82.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013986; classtype:social-engineering; sid:6013986; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thrshopee29.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"thrshopee29.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013987; classtype:social-engineering; sid:6013987; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spotify-modapk.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spotify-modapk.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013988; classtype:social-engineering; sid:6013988; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (khlaidcodestudent.github.io/Amazon-Clone)"; flow:established,to_server; http.uri; content:"/Amazon-Clone"; startswith; fast_pattern; http.host; content:"khlaidcodestudent.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013989; classtype:social-engineering; sid:6013989; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortval.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortval.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013990; classtype:social-engineering; sid:6013990; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jshfmy_com.zhukangwang.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jshfmy_com.zhukangwang.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013991; classtype:social-engineering; sid:6013991; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.teamwq.com/p/slt-cgj/jsrgrumy/)"; flow:established,to_server; http.uri; content:"/p/slt-cgj/jsrgrumy/"; startswith; fast_pattern; http.host; content:"s.teamwq.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013992; classtype:social-engineering; sid:6013992; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (descaro.com/wetransfer/)"; flow:established,to_server; http.uri; content:"/wetransfer/"; startswith; fast_pattern; http.host; content:"descaro.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013993; classtype:social-engineering; sid:6013993; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.puratonpothik.com/policy/)"; flow:established,to_server; http.uri; content:"/policy/"; startswith; fast_pattern; http.host; content:"www.puratonpothik.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013994; classtype:social-engineering; sid:6013994; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8yaz-k3zj-br05.cebsgroupsreceivables-ar-caesars-com-s-account.workers.dev/3fa9e1e412275e1f?email=valik@a64c2a88ecfe1e644a3761f2f73d4104ae26.org/)"; flow:established,to_server; http.uri; content:"/3fa9e1e412275e1f?email=valik@a64c2a88ecfe1e644a3761f2f73d4104ae26.org/"; startswith; fast_pattern; http.host; content:"8yaz-k3zj-br05.cebsgroupsreceivables-ar-caesars-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013995; classtype:social-engineering; sid:6013995; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hklogin.uat.mizuhoscfglobal.com/oauth2/authorize?response_type=code&client_id=bca4f495-a205-4cb4-8b0a-07f4d88a7584&scope=openid%20email%20profile&state=CeEiDbj5pJ71cSO2lzi7pvcGOXH7mmevbD7DFNqgeXo%3D&redirect_uri=https://hk.uat.mizuhoscfglobal.com/scf/login/oauth2/code/fusionauth&nonce=-f1ca21YpsZjdNfCQ4Svmqe-0XxilP2uxOGLJ32BGs8)"; flow:established,to_server; http.uri; content:"/oauth2/authorize?response_type=code&client_id=bca4f495-a205-4cb4-8b0a-07f4d88a7584&scope=openid%20email%20profile&state=CeEiDbj5pJ71cSO2lzi7pvcGOXH7mmevbD7DFNqgeXo%3D&redirect_uri=https://hk.uat.mizuhoscfglobal.com/scf/login/oauth2/code/fusionauth&nonce=-f1ca21YpsZjdNfCQ4Svmqe-0XxilP2uxOGLJ32BGs8"; startswith; fast_pattern; http.host; content:"hklogin.uat.mizuhoscfglobal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013996; classtype:social-engineering; sid:6013996; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docment.e-docssign.net/education_redirect_second?5372b28b-1718-482e-afd8-5ae0571cba68)"; flow:established,to_server; http.uri; content:"/education_redirect_second?5372b28b-1718-482e-afd8-5ae0571cba68"; startswith; fast_pattern; http.host; content:"docment.e-docssign.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013997; classtype:social-engineering; sid:6013997; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bdvappclientes.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bdvappclientes.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013998; classtype:social-engineering; sid:6013998; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (diannaoya.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"diannaoya.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013999; classtype:social-engineering; sid:6013999; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoja80.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoja80.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014000; classtype:social-engineering; sid:6014000; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docs.eu.itpatches.com/3/5ac856/239e406a-cc37-43b0-8942-f022375ca24c)"; flow:established,to_server; http.uri; content:"/3/5ac856/239e406a-cc37-43b0-8942-f022375ca24c"; startswith; fast_pattern; http.host; content:"docs.eu.itpatches.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014001; classtype:social-engineering; sid:6014001; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instantformhdc.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instantformhdc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014002; classtype:social-engineering; sid:6014002; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telllstraaadminnn.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"telllstraaadminnn.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014003; classtype:social-engineering; sid:6014003; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloudconect.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"icloudconect.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014004; classtype:social-engineering; sid:6014004; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebookmessenger12.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebookmessenger12.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014005; classtype:social-engineering; sid:6014005; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dc.crsorgi.gov.in.verifycertificate.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dc.crsorgi.gov.in.verifycertificate.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014006; classtype:social-engineering; sid:6014006; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.coxon8.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.coxon8.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014007; classtype:social-engineering; sid:6014007; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (snehagarasiya7-rgb.github.io/Amazon-clone)"; flow:established,to_server; http.uri; content:"/Amazon-clone"; startswith; fast_pattern; http.host; content:"snehagarasiya7-rgb.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014008; classtype:social-engineering; sid:6014008; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kucoinlogn.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kucoinlogn.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014009; classtype:social-engineering; sid:6014009; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apac.orbitor.dev/ipfs/bafkreicz4wawzt7jznunnkmaju3oqhe2vsokbca7jkc75tdo7w64ccedgy/)"; flow:established,to_server; http.uri; content:"/ipfs/bafkreicz4wawzt7jznunnkmaju3oqhe2vsokbca7jkc75tdo7w64ccedgy/"; startswith; fast_pattern; http.host; content:"apac.orbitor.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014010; classtype:social-engineering; sid:6014010; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.layanan-undian56.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.layanan-undian56.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014011; classtype:social-engineering; sid:6014011; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (businees-verify-badge-vip-12362345xcv.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"businees-verify-badge-vip-12362345xcv.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014012; classtype:social-engineering; sid:6014012; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (daanaindoonesiaz.resmi-exs.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"daanaindoonesiaz.resmi-exs.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014013; classtype:social-engineering; sid:6014013; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (withered-darkness-de12.eqfmevdlxnlojrqlxa.workers.dev/meta.help)"; flow:established,to_server; http.uri; content:"/meta.help"; startswith; fast_pattern; http.host; content:"withered-darkness-de12.eqfmevdlxnlojrqlxa.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014014; classtype:social-engineering; sid:6014014; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365asia.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.365asia.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014015; classtype:social-engineering; sid:6014015; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.crcsorgigov.co.in/admin/web/index.php/auth/crs/verifyCertificate.php)"; flow:established,to_server; http.uri; content:"/admin/web/index.php/auth/crs/verifyCertificate.php"; startswith; fast_pattern; http.host; content:"www.crcsorgigov.co.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014016; classtype:social-engineering; sid:6014016; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pay-paypaynejp87288i.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pay-paypaynejp87288i.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014017; classtype:social-engineering; sid:6014017; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.avocatsabrinaene.ro/wp/invoice/)"; flow:established,to_server; http.uri; content:"/wp/invoice/"; startswith; fast_pattern; http.host; content:"www.avocatsabrinaene.ro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014018; classtype:social-engineering; sid:6014018; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.telllstraaadminnn.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.telllstraaadminnn.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014019; classtype:social-engineering; sid:6014019; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (68-210-101-96.cprapid.com/de/update.php?msq1rengeih1xnlh0t2a)"; flow:established,to_server; http.uri; content:"/de/update.php?msq1rengeih1xnlh0t2a"; startswith; fast_pattern; http.host; content:"68-210-101-96.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014020; classtype:social-engineering; sid:6014020; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mergec.mntbell.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mergec.mntbell.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014021; classtype:social-engineering; sid:6014021; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auspost.customerserviceh.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auspost.customerserviceh.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014022; classtype:social-engineering; sid:6014022; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lnfww.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lnfww.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014023; classtype:social-engineering; sid:6014023; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clonebysadeq.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clonebysadeq.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014024; classtype:social-engineering; sid:6014024; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pagesystemsupportfor.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pagesystemsupportfor.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014025; classtype:social-engineering; sid:6014025; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (joli3dcrafts.com/xdnpwbin)"; flow:established,to_server; http.uri; content:"/xdnpwbin"; startswith; fast_pattern; http.host; content:"joli3dcrafts.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014026; classtype:social-engineering; sid:6014026; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zxcvbnmnbvcvbnmnmn-dpd500wql2ak.edgeone.dev/english.html)"; flow:established,to_server; http.uri; content:"/english.html"; startswith; fast_pattern; http.host; content:"zxcvbnmnbvcvbnmnmn-dpd500wql2ak.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014027; classtype:social-engineering; sid:6014027; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (im.nbpublic.com/loading_page/paypal/paypal_cf_11/index.html?lptoken=17046900585411739193)"; flow:established,to_server; http.uri; content:"/loading_page/paypal/paypal_cf_11/index.html?lptoken=17046900585411739193"; startswith; fast_pattern; http.host; content:"im.nbpublic.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014028; classtype:social-engineering; sid:6014028; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.teams-tr.com/p/fjbd-cbcr/fqjuqpdk)"; flow:established,to_server; http.uri; content:"/p/fjbd-cbcr/fqjuqpdk"; startswith; fast_pattern; http.host; content:"s.teams-tr.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014029; classtype:social-engineering; sid:6014029; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedrosoares1779822703712.2041778.meusitehostgator.com.br/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pedrosoares1779822703712.2041778.meusitehostgator.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014030; classtype:social-engineering; sid:6014030; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (swissseborg-login.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"swissseborg-login.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014031; classtype:social-engineering; sid:6014031; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tmo.attorneyuczzpa.tokyo/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tmo.attorneyuczzpa.tokyo"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014032; classtype:social-engineering; sid:6014032; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (index-qf0.sales-masterelevatorparts-com-s-account.workers.dev/7ba748bfc6436733/)"; flow:established,to_server; http.uri; content:"/7ba748bfc6436733/"; startswith; fast_pattern; http.host; content:"index-qf0.sales-masterelevatorparts-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014033; classtype:social-engineering; sid:6014033; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopeeprize339.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopeeprize339.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014034; classtype:social-engineering; sid:6014034; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (on-pedagiofreeflow.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"on-pedagiofreeflow.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014035; classtype:social-engineering; sid:6014035; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anszrgg.cloud-ip.cc/RR82358239/CA/)"; flow:established,to_server; http.uri; content:"/RR82358239/CA/"; startswith; fast_pattern; http.host; content:"anszrgg.cloud-ip.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014036; classtype:social-engineering; sid:6014036; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrf.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingrf.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014037; classtype:social-engineering; sid:6014037; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8yaz-k3zj-br05.cebsgroupsreceivables-ar-caesars-com-s-account.workers.dev/eb205bd2859f83a3?email=halix9@5d7752d31beab8bd95a382063714da1678e3.com/)"; flow:established,to_server; http.uri; content:"/eb205bd2859f83a3?email=halix9@5d7752d31beab8bd95a382063714da1678e3.com/"; startswith; fast_pattern; http.host; content:"8yaz-k3zj-br05.cebsgroupsreceivables-ar-caesars-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014038; classtype:social-engineering; sid:6014038; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shivraj6868.github.io/Amazon-Clone-)"; flow:established,to_server; http.uri; content:"/Amazon-Clone-"; startswith; fast_pattern; http.host; content:"shivraj6868.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014039; classtype:social-engineering; sid:6014039; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (businees-verify-badge-vip-123634cv.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"businees-verify-badge-vip-123634cv.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014040; classtype:social-engineering; sid:6014040; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rbux4aall.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rbux4aall.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014041; classtype:social-engineering; sid:6014041; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rewardstasksnew.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rewardstasksnew.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014042; classtype:social-engineering; sid:6014042; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (if4522.craftum.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"if4522.craftum.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014043; classtype:social-engineering; sid:6014043; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zggntgailz.github.io/Netflix/)"; flow:established,to_server; http.uri; content:"/Netflix/"; startswith; fast_pattern; http.host; content:"zggntgailz.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014044; classtype:social-engineering; sid:6014044; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (garakutaichi.com/wordpress/wp-content/plugins/made/membercenter.made-in-china.com/index.html)"; flow:established,to_server; http.uri; content:"/wordpress/wp-content/plugins/made/membercenter.made-in-china.com/index.html"; startswith; fast_pattern; http.host; content:"garakutaichi.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014045; classtype:social-engineering; sid:6014045; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (businees-verify-badge-vip-123645cvw.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"businees-verify-badge-vip-123645cvw.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014046; classtype:social-engineering; sid:6014046; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wpqpdldsallslsss.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wpqpdldsallslsss.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014047; classtype:social-engineering; sid:6014047; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (r7f1c8d4a6e23f9c5d1a7b0e4c8f6291.oimf.com.tr/?email=halusx@63481ae7644a83de534c949ec4ff91f873e1.org)"; flow:established,to_server; http.uri; content:"/?email=halusx@63481ae7644a83de534c949ec4ff91f873e1.org"; startswith; fast_pattern; http.host; content:"r7f1c8d4a6e23f9c5d1a7b0e4c8f6291.oimf.com.tr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014048; classtype:social-engineering; sid:6014048; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (macroxaa37dwjhbjhsdbjhsd-dtfeb2gedmd8bpfx.z02.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"macroxaa37dwjhbjhsdbjhsd-dtfeb2gedmd8bpfx.z02.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014049; classtype:social-engineering; sid:6014049; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rational-industry-828231.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rational-industry-828231.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014050; classtype:social-engineering; sid:6014050; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-index--camarerotem.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-index--camarerotem.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014051; classtype:social-engineering; sid:6014051; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (businees-verify-badge-vip-123634.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"businees-verify-badge-vip-123634.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014052; classtype:social-engineering; sid:6014052; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.podorejo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.podorejo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014053; classtype:social-engineering; sid:6014053; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nav-trezorsuite.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nav-trezorsuite.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014054; classtype:social-engineering; sid:6014054; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (connexion-app.com/clientes/login.php)"; flow:established,to_server; http.uri; content:"/clientes/login.php"; startswith; fast_pattern; http.host; content:"connexion-app.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014055; classtype:social-engineering; sid:6014055; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (index-1f1.sales-masterelevatorparts-com-s-account.workers.dev/4a13b29d079c8ca2/)"; flow:established,to_server; http.uri; content:"/4a13b29d079c8ca2/"; startswith; fast_pattern; http.host; content:"index-1f1.sales-masterelevatorparts-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014056; classtype:social-engineering; sid:6014056; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dc.crsorgi.gov.in.verifycertificate.info/general-public)"; flow:established,to_server; http.uri; content:"/general-public"; startswith; fast_pattern; http.host; content:"dc.crsorgi.gov.in.verifycertificate.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014057; classtype:social-engineering; sid:6014057; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fhhn-e49u-fn59.molly-hb-mirrors-com-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fhhn-e49u-fn59.molly-hb-mirrors-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014058; classtype:social-engineering; sid:6014058; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortnites.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortnites.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014059; classtype:social-engineering; sid:6014059; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auspost.customerservicei.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auspost.customerservicei.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014060; classtype:social-engineering; sid:6014060; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-index-page--melisapritt.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-index-page--melisapritt.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014061; classtype:social-engineering; sid:6014061; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auspost.customerserviceb.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auspost.customerserviceb.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014062; classtype:social-engineering; sid:6014062; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (siakad.stte.ac.id/?id_ID=OLXTOTO+BET+100)"; flow:established,to_server; http.uri; content:"/?id_ID=OLXTOTO+BET+100"; startswith; fast_pattern; http.host; content:"siakad.stte.ac.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014063; classtype:social-engineering; sid:6014063; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hkae-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hkae-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014064; classtype:social-engineering; sid:6014064; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auspost.customerservicek.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auspost.customerservicek.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014065; classtype:social-engineering; sid:6014065; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fnlockercheck.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fnlockercheck.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014066; classtype:social-engineering; sid:6014066; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atokk918-pixel.github.io/Pusat-bantuan-)"; flow:established,to_server; http.uri; content:"/Pusat-bantuan-"; startswith; fast_pattern; http.host; content:"atokk918-pixel.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014067; classtype:social-engineering; sid:6014067; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedagio-dobrasil.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pedagio-dobrasil.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014068; classtype:social-engineering; sid:6014068; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atokk918-pixel.github.io/Ou-)"; flow:established,to_server; http.uri; content:"/Ou-"; startswith; fast_pattern; http.host; content:"atokk918-pixel.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014069; classtype:social-engineering; sid:6014069; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hshsfrfr.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hshsfrfr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014070; classtype:social-engineering; sid:6014070; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.whh.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.whh.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014071; classtype:social-engineering; sid:6014071; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (unrivaled-meringue-509c76.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"unrivaled-meringue-509c76.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014072; classtype:social-engineering; sid:6014072; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docs.eu.itpatches.com/education_redirect_second?239e406a-cc37-43b0-8942-f022375ca24c)"; flow:established,to_server; http.uri; content:"/education_redirect_second?239e406a-cc37-43b0-8942-f022375ca24c"; startswith; fast_pattern; http.host; content:"docs.eu.itpatches.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014073; classtype:social-engineering; sid:6014073; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (link-support-badge-563234613zas.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"link-support-badge-563234613zas.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014074; classtype:social-engineering; sid:6014074; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pagesystemsupportfor.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pagesystemsupportfor.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014075; classtype:social-engineering; sid:6014075; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (link-support-badge-5632346zx456xc.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"link-support-badge-5632346zx456xc.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014076; classtype:social-engineering; sid:6014076; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.zg-nhsports.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.zg-nhsports.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014077; classtype:social-engineering; sid:6014077; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bestchange.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bestchange.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014078; classtype:social-engineering; sid:6014078; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (unityone-creditunion-docusign.edgeone.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"unityone-creditunion-docusign.edgeone.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014079; classtype:social-engineering; sid:6014079; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bnrurabetegt.biz.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bnrurabetegt.biz.site"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014080; classtype:social-engineering; sid:6014080; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klelnanzeigen-deutch.albertacraneservices.com/receive/order/ljidXUWuCrI?r=0x11)"; flow:established,to_server; http.uri; content:"/receive/order/ljidXUWuCrI?r=0x11"; startswith; fast_pattern; http.host; content:"klelnanzeigen-deutch.albertacraneservices.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014081; classtype:social-engineering; sid:6014081; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cr-bind-fenix.s3.us-east-1.amazonaws.com/XAc6geBVOhc?email=redacted@abuse.ionos.com)"; flow:established,to_server; http.uri; content:"/XAc6geBVOhc?email=redacted@abuse.ionos.com"; startswith; fast_pattern; http.host; content:"cr-bind-fenix.s3.us-east-1.amazonaws.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014082; classtype:social-engineering; sid:6014082; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nwgy3vtq-eekh5635oi9gda.ams3.digitaloceanspaces.com/InvoicingInstructions)"; flow:established,to_server; http.uri; content:"/InvoicingInstructions"; startswith; fast_pattern; http.host; content:"nwgy3vtq-eekh5635oi9gda.ams3.digitaloceanspaces.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014083; classtype:social-engineering; sid:6014083; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (banrural-en-linea.biz.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"banrural-en-linea.biz.site"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014084; classtype:social-engineering; sid:6014084; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sender.zohoinsights.eu/ck1/13ef.4aba358de/a4ad29d0-6510-11f1-bae2-e23f717f7d6f/b6faded6ec3255299ebf1d0898c19333b83951ca/2?e=xw3brQBS%2FleRIw2zZ8W4o2SKFWmJEdVU6%2BUbQoBdGzo%3D)"; flow:established,to_server; http.uri; content:"/ck1/13ef.4aba358de/a4ad29d0-6510-11f1-bae2-e23f717f7d6f/b6faded6ec3255299ebf1d0898c19333b83951ca/2?e=xw3brQBS%2FleRIw2zZ8W4o2SKFWmJEdVU6%2BUbQoBdGzo%3D"; startswith; fast_pattern; http.host; content:"sender.zohoinsights.eu"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014085; classtype:social-engineering; sid:6014085; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.edgecoinnews.com/a-disruptive-technology-blockchain-will-make-dubai-happiest-city-on-earth/)"; flow:established,to_server; http.uri; content:"/a-disruptive-technology-blockchain-will-make-dubai-happiest-city-on-earth/"; startswith; fast_pattern; http.host; content:"www.edgecoinnews.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014086; classtype:social-engineering; sid:6014086; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (banruralbancavirtualgt.biz.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"banruralbancavirtualgt.biz.site"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014087; classtype:social-engineering; sid:6014087; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bhamentertainment.com/en/main/?username=redacted@abuse.ionos.com&hash=4328338-4328338-4328338)"; flow:established,to_server; http.uri; content:"/en/main/?username=redacted@abuse.ionos.com&hash=4328338-4328338-4328338"; startswith; fast_pattern; http.host; content:"bhamentertainment.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014088; classtype:social-engineering; sid:6014088; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (banruralvirtualgt.biz.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"banruralvirtualgt.biz.site"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014089; classtype:social-engineering; sid:6014089; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (worldcup2026fifa.awsapps.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"worldcup2026fifa.awsapps.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014090; classtype:social-engineering; sid:6014090; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sanfanderbomk.icu/?secure_connect=241*fc*&_subid=2ge6qe4.43.1dq76&_token=3e78u193kmtj58.1781886699.1.c478b502c0753e8e25b4f67ca23ddf62)"; flow:established,to_server; http.uri; content:"/?secure_connect=241*fc*&_subid=2ge6qe4.43.1dq76&_token=3e78u193kmtj58.1781886699.1.c478b502c0753e8e25b4f67ca23ddf62"; startswith; fast_pattern; http.host; content:"sanfanderbomk.icu"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014091; classtype:social-engineering; sid:6014091; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ww1-dkb.webworkonline.co/webs.asp/DUVzTTavlOw/eLLPCe8pww7JaLVVL3PjC370)"; flow:established,to_server; http.uri; content:"/webs.asp/DUVzTTavlOw/eLLPCe8pww7JaLVVL3PjC370"; startswith; fast_pattern; http.host; content:"ww1-dkb.webworkonline.co"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014092; classtype:social-engineering; sid:6014092; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cpcontacts.20-120-116-237.cprapid.com/art?c_ds_na=EN9Bq6weH3IB6e4lX8pW2TPj3YgdFzTwCw51yzbNZU&c_ds_no=%2A%2F%2A)"; flow:established,to_server; http.uri; content:"/art?c_ds_na=EN9Bq6weH3IB6e4lX8pW2TPj3YgdFzTwCw51yzbNZU&c_ds_no=%2A%2F%2A"; startswith; fast_pattern; http.host; content:"cpcontacts.20-120-116-237.cprapid.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014093; classtype:social-engineering; sid:6014093; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dkserver.sviluppo.host/a/)"; flow:established,to_server; http.uri; content:"/a/"; startswith; fast_pattern; http.host; content:"dkserver.sviluppo.host"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014094; classtype:social-engineering; sid:6014094; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (r1sy-online.icu/?secure_connect=d9*8z*&_subid=1sd8jpm.93.1doqs&_token=124p3em17ihegp.1781851368.9.4a130128600ef185753ea8484e9107fe)"; flow:established,to_server; http.uri; content:"/?secure_connect=d9*8z*&_subid=1sd8jpm.93.1doqs&_token=124p3em17ihegp.1781851368.9.4a130128600ef185753ea8484e9107fe"; startswith; fast_pattern; http.host; content:"r1sy-online.icu"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014095; classtype:social-engineering; sid:6014095; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.glopakind.com/DocuSign/Mac/utility.php)"; flow:established,to_server; http.uri; content:"/DocuSign/Mac/utility.php"; startswith; fast_pattern; http.host; content:"www.glopakind.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014096; classtype:social-engineering; sid:6014096; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie.12030oh5.xyz/lokalnie/?id=7M2d5p3l3S0v0d3n5s0B6P2e9b1D2T1Y)"; flow:established,to_server; http.uri; content:"/lokalnie/?id=7M2d5p3l3S0v0d3n5s0B6P2e9b1D2T1Y"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.12030oh5.xyz"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014097; classtype:social-engineering; sid:6014097; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hnghnff.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hnghnff.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014098; classtype:social-engineering; sid:6014098; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pichincha.cc/ec)"; flow:established,to_server; http.uri; content:"/ec"; startswith; fast_pattern; http.host; content:"pichincha.cc"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014099; classtype:social-engineering; sid:6014099; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kuckointlogin.webador.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kuckointlogin.webador.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014100; classtype:social-engineering; sid:6014100; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (misthigupta0022.github.io/semester-2-project/)"; flow:established,to_server; http.uri; content:"/semester-2-project/"; startswith; fast_pattern; http.host; content:"misthigupta0022.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014101; classtype:social-engineering; sid:6014101; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tlktokshopa.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tlktokshopa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014102; classtype:social-engineering; sid:6014102; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd-ouwib.com/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd-ouwib.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014103; classtype:social-engineering; sid:6014103; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtw.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingtw.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014104; classtype:social-engineering; sid:6014104; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (codervishy.github.io/Amazon-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-clone/"; startswith; fast_pattern; http.host; content:"codervishy.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014105; classtype:social-engineering; sid:6014105; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (codervishy.github.io/amazon-ui-clone-html-css-ecommerce-clone/)"; flow:established,to_server; http.uri; content:"/amazon-ui-clone-html-css-ecommerce-clone/"; startswith; fast_pattern; http.host; content:"codervishy.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014106; classtype:social-engineering; sid:6014106; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (440yabo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"440yabo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014107; classtype:social-engineering; sid:6014107; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrf.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingrf.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014108; classtype:social-engineering; sid:6014108; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enjoyvacationnow.net/pages/ebf1c435-ec5b-41b4-b8b7-ebb693f86d29/50e507176b0197805e26cd77b816b7f4c50e5f1b988a2f9dabdc59287dcba109e8bb427d4c56daa4aa6d6aa6e208fd7de71fe5da6df963a3fc4a58ec49482861)"; flow:established,to_server; http.uri; content:"/pages/ebf1c435-ec5b-41b4-b8b7-ebb693f86d29/50e507176b0197805e26cd77b816b7f4c50e5f1b988a2f9dabdc59287dcba109e8bb427d4c56daa4aa6d6aa6e208fd7de71fe5da6df963a3fc4a58ec49482861"; startswith; fast_pattern; http.host; content:"enjoyvacationnow.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014109; classtype:social-engineering; sid:6014109; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aribafiroz2207.github.io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"aribafiroz2207.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014110; classtype:social-engineering; sid:6014110; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enfermeriacanaria.com/112/NRD/f91c8a7/Sign_in.php)"; flow:established,to_server; http.uri; content:"/112/NRD/f91c8a7/Sign_in.php"; startswith; fast_pattern; http.host; content:"enfermeriacanaria.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014111; classtype:social-engineering; sid:6014111; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enfermeriacanaria.com/112/NRD/9015988/Sign_in.php)"; flow:established,to_server; http.uri; content:"/112/NRD/9015988/Sign_in.php"; startswith; fast_pattern; http.host; content:"enfermeriacanaria.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014112; classtype:social-engineering; sid:6014112; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (odopdwkld.s3.eu-north-1.amazonaws.com/nwk.html)"; flow:established,to_server; http.uri; content:"/nwk.html"; startswith; fast_pattern; http.host; content:"odopdwkld.s3.eu-north-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014113; classtype:social-engineering; sid:6014113; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qrsu.io/n2J7D)"; flow:established,to_server; http.uri; content:"/n2J7D"; startswith; fast_pattern; http.host; content:"qrsu.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014114; classtype:social-engineering; sid:6014114; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jhrerth.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jhrerth.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014115; classtype:social-engineering; sid:6014115; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingty.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingty.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014116; classtype:social-engineering; sid:6014116; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedir-deliverys-ze.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pedir-deliverys-ze.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014117; classtype:social-engineering; sid:6014117; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (juliaince.com/randlpackaging/lukeunrauopendocaccess.html)"; flow:established,to_server; http.uri; content:"/randlpackaging/lukeunrauopendocaccess.html"; startswith; fast_pattern; http.host; content:"juliaince.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014118; classtype:social-engineering; sid:6014118; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.onmilz.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.onmilz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014119; classtype:social-engineering; sid:6014119; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smca.info/itschiro_time/)"; flow:established,to_server; http.uri; content:"/itschiro_time/"; startswith; fast_pattern; http.host; content:"smca.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014120; classtype:social-engineering; sid:6014120; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (schloss-castel.de/smalenegie/)"; flow:established,to_server; http.uri; content:"/smalenegie/"; startswith; fast_pattern; http.host; content:"schloss-castel.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014121; classtype:social-engineering; sid:6014121; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.vimareo.com/wap)"; flow:established,to_server; http.uri; content:"/wap"; startswith; fast_pattern; http.host; content:"www.vimareo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014122; classtype:social-engineering; sid:6014122; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1xplayers.com/GtNNJWZc)"; flow:established,to_server; http.uri; content:"/GtNNJWZc"; startswith; fast_pattern; http.host; content:"1xplayers.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014123; classtype:social-engineering; sid:6014123; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.customeraccessmembershipmovie.65-98-5-17.cpanel.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.customeraccessmembershipmovie.65-98-5-17.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014124; classtype:social-engineering; sid:6014124; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee8717.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopee8717.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014125; classtype:social-engineering; sid:6014125; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docs-trezor-io-login.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"docs-trezor-io-login.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014126; classtype:social-engineering; sid:6014126; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.105655222.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.105655222.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014127; classtype:social-engineering; sid:6014127; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shalusinghal4563-ops.github.io/amazon_project/)"; flow:established,to_server; http.uri; content:"/amazon_project/"; startswith; fast_pattern; http.host; content:"shalusinghal4563-ops.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014128; classtype:social-engineering; sid:6014128; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.taslimaenterprise.com/adobe/)"; flow:established,to_server; http.uri; content:"/adobe/"; startswith; fast_pattern; http.host; content:"www.taslimaenterprise.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014129; classtype:social-engineering; sid:6014129; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (petropolisclub.com/metalworkservice/index.php/)"; flow:established,to_server; http.uri; content:"/metalworkservice/index.php/"; startswith; fast_pattern; http.host; content:"petropolisclub.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014130; classtype:social-engineering; sid:6014130; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8ac76743.shield-signin.com/?d=SkX6BvRWql8n89OalyoWx)"; flow:established,to_server; http.uri; content:"/?d=SkX6BvRWql8n89OalyoWx"; startswith; fast_pattern; http.host; content:"8ac76743.shield-signin.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014131; classtype:social-engineering; sid:6014131; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.appealhelpspage.store/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.appealhelpspage.store"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014132; classtype:social-engineering; sid:6014132; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtt.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingtt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014133; classtype:social-engineering; sid:6014133; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9cmw-idx4-47fs.george-vandevorde-smithinsurancellc-com-s-account.workers.dev/12)"; flow:established,to_server; http.uri; content:"/12"; startswith; fast_pattern; http.host; content:"9cmw-idx4-47fs.george-vandevorde-smithinsurancellc-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014134; classtype:social-engineering; sid:6014134; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (affinityc2penterpris.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"affinityc2penterpris.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014135; classtype:social-engineering; sid:6014135; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee2449.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.shopee2449.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014136; classtype:social-engineering; sid:6014136; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sabadellherrero.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sabadellherrero.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014137; classtype:social-engineering; sid:6014137; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtt.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingtt.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014138; classtype:social-engineering; sid:6014138; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maxisoa.com/mymaxis)"; flow:established,to_server; http.uri; content:"/mymaxis"; startswith; fast_pattern; http.host; content:"maxisoa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014139; classtype:social-engineering; sid:6014139; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wordpress-212609-0.cloudclusters.net/4vaW1hZ/Sbbclients/CH10193/)"; flow:established,to_server; http.uri; content:"/4vaW1hZ/Sbbclients/CH10193/"; startswith; fast_pattern; http.host; content:"wordpress-212609-0.cloudclusters.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014140; classtype:social-engineering; sid:6014140; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b63.asia/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b63.asia"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014141; classtype:social-engineering; sid:6014141; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrb.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingrb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014142; classtype:social-engineering; sid:6014142; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (elizasilva13.github.io/elizasilva134.github.io/)"; flow:established,to_server; http.uri; content:"/elizasilva134.github.io/"; startswith; fast_pattern; http.host; content:"elizasilva13.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014143; classtype:social-engineering; sid:6014143; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiew7w6k3ryybdumpzpuaxenhl7btkqqdb6ss7aza5plujnxjk7jmm.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiew7w6k3ryybdumpzpuaxenhl7btkqqdb6ss7aza5plujnxjk7jmm.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014144; classtype:social-engineering; sid:6014144; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-pede48h-ze.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-pede48h-ze.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014145; classtype:social-engineering; sid:6014145; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrd.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingrd.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014146; classtype:social-engineering; sid:6014146; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1xlite-24510.bar/en/registration?tag=d_224327m_45857c_[]MS[]null[]null[]reg[]10853324_d28985_l259589_clickunder)"; flow:established,to_server; http.uri; content:"/en/registration?tag=d_224327m_45857c_[]MS[]null[]null[]reg[]10853324_d28985_l259589_clickunder"; startswith; fast_pattern; http.host; content:"1xlite-24510.bar"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014147; classtype:social-engineering; sid:6014147; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (80938cb1.secure-signin.co/?d=A27dcHPfqRyoTfQmWDGve)"; flow:established,to_server; http.uri; content:"/?d=A27dcHPfqRyoTfQmWDGve"; startswith; fast_pattern; http.host; content:"80938cb1.secure-signin.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014148; classtype:social-engineering; sid:6014148; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qrsu.io/8KL1O)"; flow:established,to_server; http.uri; content:"/8KL1O"; startswith; fast_pattern; http.host; content:"qrsu.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014149; classtype:social-engineering; sid:6014149; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (io-suitetrezr-en.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"io-suitetrezr-en.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014150; classtype:social-engineering; sid:6014150; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (learn-io-start-trezo.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"learn-io-start-trezo.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014151; classtype:social-engineering; sid:6014151; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (patelnikhil5245-blip.github.io/Amazone_Clone_)"; flow:established,to_server; http.uri; content:"/Amazone_Clone_"; startswith; fast_pattern; http.host; content:"patelnikhil5245-blip.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014152; classtype:social-engineering; sid:6014152; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (azwar-zsh.github.io/instagram-login)"; flow:established,to_server; http.uri; content:"/instagram-login"; startswith; fast_pattern; http.host; content:"azwar-zsh.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014153; classtype:social-engineering; sid:6014153; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-git-herman-cons-1985-responsive-web-changes-uniswap.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-git-herman-cons-1985-responsive-web-changes-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014154; classtype:social-engineering; sid:6014154; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ezeserverlogin-dptabl94lu7z.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ezeserverlogin-dptabl94lu7z.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014155; classtype:social-engineering; sid:6014155; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kleinanzeigen.kleinkauff0.icu/order/eUAWgCc4uJkB/?plg=polya_ma)"; flow:established,to_server; http.uri; content:"/order/eUAWgCc4uJkB/?plg=polya_ma"; startswith; fast_pattern; http.host; content:"kleinanzeigen.kleinkauff0.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014156; classtype:social-engineering; sid:6014156; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adrianstore.com.co/wp-content/I-Bots/CH/final/CHFINALE/)"; flow:established,to_server; http.uri; content:"/wp-content/I-Bots/CH/final/CHFINALE/"; startswith; fast_pattern; http.host; content:"adrianstore.com.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014157; classtype:social-engineering; sid:6014157; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.pl-58912547891.sbs/oferta/91329224/jacuzzi-dmuc)"; flow:established,to_server; http.uri; content:"/oferta/91329224/jacuzzi-dmuc"; startswith; fast_pattern; http.host; content:"allegrolokalnie.pl-58912547891.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014158; classtype:social-engineering; sid:6014158; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfiinityy.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfiinityy.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014159; classtype:social-engineering; sid:6014159; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vaai.la/RwTL)"; flow:established,to_server; http.uri; content:"/RwTL"; startswith; fast_pattern; http.host; content:"vaai.la"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014160; classtype:social-engineering; sid:6014160; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (foxinteriorsllc.com/~r5g8ldveioxpnxqm/assets/images/images/12/lng/login.php)"; flow:established,to_server; http.uri; content:"/~r5g8ldveioxpnxqm/assets/images/images/12/lng/login.php"; startswith; fast_pattern; http.host; content:"foxinteriorsllc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014161; classtype:social-engineering; sid:6014161; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrv.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingrv.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014162; classtype:social-engineering; sid:6014162; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-pedido24h-ze.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-pedido24h-ze.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014163; classtype:social-engineering; sid:6014163; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingty.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingty.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014164; classtype:social-engineering; sid:6014164; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd-bdjfa.cc/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd-bdjfa.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014165; classtype:social-engineering; sid:6014165; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (saibo2506.vip/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"saibo2506.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014166; classtype:social-engineering; sid:6014166; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (edward95.neocities.org/iclaaa/)"; flow:established,to_server; http.uri; content:"/iclaaa/"; startswith; fast_pattern; http.host; content:"edward95.neocities.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014167; classtype:social-engineering; sid:6014167; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chicagolandconstructionandremodeling.com/~r5g8ldveioxpnxqm/assets/images/images/12/lng/login.php)"; flow:established,to_server; http.uri; content:"/~r5g8ldveioxpnxqm/assets/images/images/12/lng/login.php"; startswith; fast_pattern; http.host; content:"chicagolandconstructionandremodeling.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014168; classtype:social-engineering; sid:6014168; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-mocha-three.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-mocha-three.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014169; classtype:social-engineering; sid:6014169; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (helphome-trezer-wallt.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"helphome-trezer-wallt.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014170; classtype:social-engineering; sid:6014170; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amplatzgifting.info/mediahub7818/?uo=161C1515&e=admin%2540jpn-online.ch&s3=&s4=&s5=&s6=&s7=&s8=&fol=m3R4wX2HoqiBoGCqm4R0f32dpqSHuZM)"; flow:established,to_server; http.uri; content:"/mediahub7818/?uo=161C1515&e=admin%2540jpn-online.ch&s3=&s4=&s5=&s6=&s7=&s8=&fol=m3R4wX2HoqiBoGCqm4R0f32dpqSHuZM"; startswith; fast_pattern; http.host; content:"amplatzgifting.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014171; classtype:social-engineering; sid:6014171; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (carrefour-pass-espace.com/espace/)"; flow:established,to_server; http.uri; content:"/espace/"; startswith; fast_pattern; http.host; content:"carrefour-pass-espace.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014172; classtype:social-engineering; sid:6014172; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrg.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingrg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014173; classtype:social-engineering; sid:6014173; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-delta-hazel.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-delta-hazel.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014174; classtype:social-engineering; sid:6014174; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.boafiles.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.boafiles.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014175; classtype:social-engineering; sid:6014175; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (entregas-ze-delivery.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"entregas-ze-delivery.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014176; classtype:social-engineering; sid:6014176; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (crm.relis.co.ke/vendor/meta-fb-page/login/)"; flow:established,to_server; http.uri; content:"/vendor/meta-fb-page/login/"; startswith; fast_pattern; http.host; content:"crm.relis.co.ke"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014177; classtype:social-engineering; sid:6014177; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-trezoor-suite-cdn.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"info-trezoor-suite-cdn.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014178; classtype:social-engineering; sid:6014178; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (relis.co.ke/vendor/meta-fb-page/login/)"; flow:established,to_server; http.uri; content:"/vendor/meta-fb-page/login/"; startswith; fast_pattern; http.host; content:"relis.co.ke"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014179; classtype:social-engineering; sid:6014179; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whapptr6.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whapptr6.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014180; classtype:social-engineering; sid:6014180; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoja94.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoja94.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014181; classtype:social-engineering; sid:6014181; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (siddharth-abesec.github.io/Amazon-ECE-1/)"; flow:established,to_server; http.uri; content:"/Amazon-ECE-1/"; startswith; fast_pattern; http.host; content:"siddharth-abesec.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014182; classtype:social-engineering; sid:6014182; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ecocashloans.online.techjeisolutions.co.ke/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ecocashloans.online.techjeisolutions.co.ke"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014183; classtype:social-engineering; sid:6014183; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingra.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingra.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014184; classtype:social-engineering; sid:6014184; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-pedidos24h-ze.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-pedidos24h-ze.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014185; classtype:social-engineering; sid:6014185; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comparable-beige-ghqsab8y.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comparable-beige-ghqsab8y.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014186; classtype:social-engineering; sid:6014186; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedir-adega24h-ze.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pedir-adega24h-ze.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014187; classtype:social-engineering; sid:6014187; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ghotkshop.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ghotkshop.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014188; classtype:social-engineering; sid:6014188; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fedexx-blue.vercel.app/Privacy%20&%20Security.html)"; flow:established,to_server; http.uri; content:"/Privacy%20&%20Security.html"; startswith; fast_pattern; http.host; content:"fedexx-blue.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014189; classtype:social-engineering; sid:6014189; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ovtv-b9jc-vs6z.admin-boltsigns-com-s-account.workers.dev/?q=a)"; flow:established,to_server; http.uri; content:"/?q=a"; startswith; fast_pattern; http.host; content:"ovtv-b9jc-vs6z.admin-boltsigns-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014190; classtype:social-engineering; sid:6014190; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bombardiha.framer.photos/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bombardiha.framer.photos"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014191; classtype:social-engineering; sid:6014191; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enfermeriacanaria.com/112/NRD/1b1fd37/Sign_in.php)"; flow:established,to_server; http.uri; content:"/112/NRD/1b1fd37/Sign_in.php"; startswith; fast_pattern; http.host; content:"enfermeriacanaria.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014192; classtype:social-engineering; sid:6014192; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrx.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingrx.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014193; classtype:social-engineering; sid:6014193; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (newcomer-courgette-121562.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"newcomer-courgette-121562.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014194; classtype:social-engineering; sid:6014194; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whapptr8.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whapptr8.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014195; classtype:social-engineering; sid:6014195; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtu.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingtu.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014196; classtype:social-engineering; sid:6014196; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adega-24h-ze.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"adega-24h-ze.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014197; classtype:social-engineering; sid:6014197; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maakmaghdouche.org/av-intel-order)"; flow:established,to_server; http.uri; content:"/av-intel-order"; startswith; fast_pattern; http.host; content:"maakmaghdouche.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014198; classtype:social-engineering; sid:6014198; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fedexx-blue.vercel.app/About%20Us%20_%20FedEx.html)"; flow:established,to_server; http.uri; content:"/About%20Us%20_%20FedEx.html"; startswith; fast_pattern; http.host; content:"fedexx-blue.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014199; classtype:social-engineering; sid:6014199; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (118924kraken.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"118924kraken.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014200; classtype:social-engineering; sid:6014200; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtg.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingtg.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014201; classtype:social-engineering; sid:6014201; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtr.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingtr.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014202; classtype:social-engineering; sid:6014202; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtp.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingtp.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014203; classtype:social-engineering; sid:6014203; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-pedidos48h-ze.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-pedidos48h-ze.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014204; classtype:social-engineering; sid:6014204; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anandyadav2007.github.io/Task-04/)"; flow:established,to_server; http.uri; content:"/Task-04/"; startswith; fast_pattern; http.host; content:"anandyadav2007.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014205; classtype:social-engineering; sid:6014205; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tkapp.jbrautocar.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tkapp.jbrautocar.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014206; classtype:social-engineering; sid:6014206; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d1q3y8y1gdsoni.cloudfront.net/?cid=8458657)"; flow:established,to_server; http.uri; content:"/?cid=8458657"; startswith; fast_pattern; http.host; content:"d1q3y8y1gdsoni.cloudfront.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014207; classtype:social-engineering; sid:6014207; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtu.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingtu.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014208; classtype:social-engineering; sid:6014208; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shalusinghal4563-ops.github.io/project_amazon_clone/)"; flow:established,to_server; http.uri; content:"/project_amazon_clone/"; startswith; fast_pattern; http.host; content:"shalusinghal4563-ops.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014209; classtype:social-engineering; sid:6014209; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreig3jc74ivzarf5ztajoezlzdfd6asq3shweqb6phzxt4obly3ig3i.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreig3jc74ivzarf5ztajoezlzdfd6asq3shweqb6phzxt4obly3ig3i.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014210; classtype:social-engineering; sid:6014210; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtk.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingtk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014211; classtype:social-engineering; sid:6014211; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingto.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingto.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014212; classtype:social-engineering; sid:6014212; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enfermeriacanaria.com/112/NRD/6a714fb/)"; flow:established,to_server; http.uri; content:"/112/NRD/6a714fb/"; startswith; fast_pattern; http.host; content:"enfermeriacanaria.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014213; classtype:social-engineering; sid:6014213; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uphold-login----apps.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uphold-login----apps.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014214; classtype:social-engineering; sid:6014214; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-pedidos-ze24h.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-pedidos-ze24h.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014215; classtype:social-engineering; sid:6014215; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (talktalk-101540.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"talktalk-101540.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014216; classtype:social-engineering; sid:6014216; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bexo-df6s-8jlw.george-vandevorde-smithinsurancellc-com-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bexo-df6s-8jlw.george-vandevorde-smithinsurancellc-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014217; classtype:social-engineering; sid:6014217; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.86365z.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.86365z.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014218; classtype:social-engineering; sid:6014218; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-pedidosze-24h.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-pedidosze-24h.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014219; classtype:social-engineering; sid:6014219; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (glowshiya.com/script.html)"; flow:established,to_server; http.uri; content:"/script.html"; startswith; fast_pattern; http.host; content:"glowshiya.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014220; classtype:social-engineering; sid:6014220; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedir-delivery-ze.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pedir-delivery-ze.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014221; classtype:social-engineering; sid:6014221; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecocash.zw3.co/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ecocash.zw3.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014222; classtype:social-engineering; sid:6014222; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maxisopk.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"maxisopk.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014223; classtype:social-engineering; sid:6014223; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stutiiag.github.io/Amazon.github.io)"; flow:established,to_server; http.uri; content:"/Amazon.github.io"; startswith; fast_pattern; http.host; content:"stutiiag.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014224; classtype:social-engineering; sid:6014224; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecommerce-website-nine-hazel.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ecommerce-website-nine-hazel.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014225; classtype:social-engineering; sid:6014225; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-entregas-ze24h.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-entregas-ze24h.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014226; classtype:social-engineering; sid:6014226; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (notewortha.sa.com/reviewhome/)"; flow:established,to_server; http.uri; content:"/reviewhome/"; startswith; fast_pattern; http.host; content:"notewortha.sa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014227; classtype:social-engineering; sid:6014227; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrx.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingrx.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014228; classtype:social-engineering; sid:6014228; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecocashloans.online.techjeisolutions.co.ke/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ecocashloans.online.techjeisolutions.co.ke"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014229; classtype:social-engineering; sid:6014229; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lc-kraken-social-8cbe.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lc-kraken-social-8cbe.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014230; classtype:social-engineering; sid:6014230; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faq-public-trzor-suit.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"faq-public-trzor-suit.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014231; classtype:social-engineering; sid:6014231; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (get-io-trez-or-st-art.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"get-io-trez-or-st-art.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014232; classtype:social-engineering; sid:6014232; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dilkashalam.github.io/Microsoft-Clone/)"; flow:established,to_server; http.uri; content:"/Microsoft-Clone/"; startswith; fast_pattern; http.host; content:"dilkashalam.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014233; classtype:social-engineering; sid:6014233; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-72186365-4338-4462-ad6b-9b797bd9b486.cleverapps.io/ANTAI/am/paiement.php/)"; flow:established,to_server; http.uri; content:"/ANTAI/am/paiement.php/"; startswith; fast_pattern; http.host; content:"app-72186365-4338-4462-ad6b-9b797bd9b486.cleverapps.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014234; classtype:social-engineering; sid:6014234; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whapptr1.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whapptr1.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014235; classtype:social-engineering; sid:6014235; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (basithalikp.github.io/netflix-frontend)"; flow:established,to_server; http.uri; content:"/netflix-frontend"; startswith; fast_pattern; http.host; content:"basithalikp.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014236; classtype:social-engineering; sid:6014236; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-pedido-ze24h.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-pedido-ze24h.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014237; classtype:social-engineering; sid:6014237; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.kfo-sports.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.kfo-sports.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014238; classtype:social-engineering; sid:6014238; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enfermeriacanaria.com/112/NRD/311d3a4/Sign_in.php)"; flow:established,to_server; http.uri; content:"/112/NRD/311d3a4/Sign_in.php"; startswith; fast_pattern; http.host; content:"enfermeriacanaria.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014239; classtype:social-engineering; sid:6014239; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.5157111.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.5157111.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014240; classtype:social-engineering; sid:6014240; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (copacomlimitedecampeao11.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"copacomlimitedecampeao11.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014241; classtype:social-engineering; sid:6014241; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (updatesnotified.com/concluded.php?k=4885483ce5ec713cba5cb60376f5c757f2bce4aa)"; flow:established,to_server; http.uri; content:"/concluded.php?k=4885483ce5ec713cba5cb60376f5c757f2bce4aa"; startswith; fast_pattern; http.host; content:"updatesnotified.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014242; classtype:social-engineering; sid:6014242; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fuv.jbw.temporary.site/112/NRD/1364f3c/Sign_in.php)"; flow:established,to_server; http.uri; content:"/112/NRD/1364f3c/Sign_in.php"; startswith; fast_pattern; http.host; content:"fuv.jbw.temporary.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014243; classtype:social-engineering; sid:6014243; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kijiji-autos-int.sm360.ca/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kijiji-autos-int.sm360.ca"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014244; classtype:social-engineering; sid:6014244; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.glopakind.com/DocuSign/Mac/utility.php/download/index.php)"; flow:established,to_server; http.uri; content:"/DocuSign/Mac/utility.php/download/index.php"; startswith; fast_pattern; http.host; content:"www.glopakind.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014245; classtype:social-engineering; sid:6014245; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (langley-speedway.com/particulier-societegenerale/societe/sg/login/fr/login.php/)"; flow:established,to_server; http.uri; content:"/particulier-societegenerale/societe/sg/login/fr/login.php/"; startswith; fast_pattern; http.host; content:"langley-speedway.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014246; classtype:social-engineering; sid:6014246; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whapptr2.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whapptr2.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014247; classtype:social-engineering; sid:6014247; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (minadeengajamento.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"minadeengajamento.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014248; classtype:social-engineering; sid:6014248; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toplukonut0054975248.vercel.app/giris.html)"; flow:established,to_server; http.uri; content:"/giris.html"; startswith; fast_pattern; http.host; content:"toplukonut0054975248.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014249; classtype:social-engineering; sid:6014249; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.3vg.de/sfvds/)"; flow:established,to_server; http.uri; content:"/sfvds/"; startswith; fast_pattern; http.host; content:"www.3vg.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014250; classtype:social-engineering; sid:6014250; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enfermeriacanaria.com/112/NRD/6a714fb/Sign_in.php)"; flow:established,to_server; http.uri; content:"/112/NRD/6a714fb/Sign_in.php"; startswith; fast_pattern; http.host; content:"enfermeriacanaria.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014251; classtype:social-engineering; sid:6014251; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.behbudlabs.com/Technical_Specification/docusign/Windows/utility.php/download/index.php/download/index.php)"; flow:established,to_server; http.uri; content:"/Technical_Specification/docusign/Windows/utility.php/download/index.php/download/index.php"; startswith; fast_pattern; http.host; content:"www.behbudlabs.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014252; classtype:social-engineering; sid:6014252; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auspost.customerserviceqo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auspost.customerserviceqo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014253; classtype:social-engineering; sid:6014253; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enjoyvacationnow.net/pages/ebf1c435-ec5b-41b4-b8b7-ebb693f86d29/c0b28e53dee347f2722ca1860e067549ea7617841950c6c9c371c53d4ae83e51259ba2dad4d2ce056f72b37a522e00bd86986edf12f658bf7233feb908c4bc37)"; flow:established,to_server; http.uri; content:"/pages/ebf1c435-ec5b-41b4-b8b7-ebb693f86d29/c0b28e53dee347f2722ca1860e067549ea7617841950c6c9c371c53d4ae83e51259ba2dad4d2ce056f72b37a522e00bd86986edf12f658bf7233feb908c4bc37"; startswith; fast_pattern; http.host; content:"enjoyvacationnow.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014254; classtype:social-engineering; sid:6014254; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrs.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingrs.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014255; classtype:social-engineering; sid:6014255; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrv.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingrv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014256; classtype:social-engineering; sid:6014256; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pu.ihwlipc.com/best)"; flow:established,to_server; http.uri; content:"/best"; startswith; fast_pattern; http.host; content:"pu.ihwlipc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014257; classtype:social-engineering; sid:6014257; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hg8088.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hg8088.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014258; classtype:social-engineering; sid:6014258; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fly-the-skies.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fly-the-skies.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014259; classtype:social-engineering; sid:6014259; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bellnetca.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bellnetca.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014260; classtype:social-engineering; sid:6014260; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nh638720-cmd.github.io/facebook/)"; flow:established,to_server; http.uri; content:"/facebook/"; startswith; fast_pattern; http.host; content:"nh638720-cmd.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014261; classtype:social-engineering; sid:6014261; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whapptr4.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whapptr4.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014262; classtype:social-engineering; sid:6014262; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pmisdemo.socioon.com/pdf/pd/f/)"; flow:established,to_server; http.uri; content:"/pdf/pd/f/"; startswith; fast_pattern; http.host; content:"pmisdemo.socioon.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014263; classtype:social-engineering; sid:6014263; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrd.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingrd.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014264; classtype:social-engineering; sid:6014264; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-pedidos-ze.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-pedidos-ze.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014265; classtype:social-engineering; sid:6014265; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1xlite-24510.bar/en/block?tag=d_224327m_45857c_%5B%5DMS%5B%5Dnull%5B%5Dnull%5B%5Dreg%5B%5D10853324_d28985_l259589_clickunder)"; flow:established,to_server; http.uri; content:"/en/block?tag=d_224327m_45857c_%5B%5DMS%5B%5Dnull%5B%5Dnull%5B%5Dreg%5B%5D10853324_d28985_l259589_clickunder"; startswith; fast_pattern; http.host; content:"1xlite-24510.bar"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014266; classtype:social-engineering; sid:6014266; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (50058c.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"50058c.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014267; classtype:social-engineering; sid:6014267; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (htttps-roblox.com/users/909139181/profile)"; flow:established,to_server; http.uri; content:"/users/909139181/profile"; startswith; fast_pattern; http.host; content:"htttps-roblox.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014268; classtype:social-engineering; sid:6014268; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pu.ihwlipc.com/best/indexs.html)"; flow:established,to_server; http.uri; content:"/best/indexs.html"; startswith; fast_pattern; http.host; content:"pu.ihwlipc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014269; classtype:social-engineering; sid:6014269; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.familydine.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.familydine.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014270; classtype:social-engineering; sid:6014270; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrc.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingrc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014271; classtype:social-engineering; sid:6014271; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingty.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingty.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014272; classtype:social-engineering; sid:6014272; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dao1-6em8.vercel.app/capcha.html)"; flow:established,to_server; http.uri; content:"/capcha.html"; startswith; fast_pattern; http.host; content:"dao1-6em8.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014273; classtype:social-engineering; sid:6014273; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ze-itens-24h.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ze-itens-24h.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014274; classtype:social-engineering; sid:6014274; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (juliaince.com/pierrepaulturgeon/multifamilyinvestingcanadaopendocaccess.html)"; flow:established,to_server; http.uri; content:"/pierrepaulturgeon/multifamilyinvestingcanadaopendocaccess.html"; startswith; fast_pattern; http.host; content:"juliaince.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014275; classtype:social-engineering; sid:6014275; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.desiaustralia.com/news/)"; flow:established,to_server; http.uri; content:"/news/"; startswith; fast_pattern; http.host; content:"www.desiaustralia.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014276; classtype:social-engineering; sid:6014276; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auspost.customerserviceqs.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auspost.customerserviceqs.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014277; classtype:social-engineering; sid:6014277; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.behbudlabs.com/Technical_Specification/docusign/Windows/utility.php/download/index.php/download/index.php/)"; flow:established,to_server; http.uri; content:"/Technical_Specification/docusign/Windows/utility.php/download/index.php/download/index.php/"; startswith; fast_pattern; http.host; content:"www.behbudlabs.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014278; classtype:social-engineering; sid:6014278; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shivamyadav1031.github.io/Amazon-ECE-1)"; flow:established,to_server; http.uri; content:"/Amazon-ECE-1"; startswith; fast_pattern; http.host; content:"shivamyadav1031.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014279; classtype:social-engineering; sid:6014279; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docuflow-2br.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"docuflow-2br.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014280; classtype:social-engineering; sid:6014280; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faqs-auth-trzor-sso.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"faqs-auth-trzor-sso.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014281; classtype:social-engineering; sid:6014281; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whapptr5.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whapptr5.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014282; classtype:social-engineering; sid:6014282; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (boafiles.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"boafiles.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014283; classtype:social-engineering; sid:6014283; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bigshopee597.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.bigshopee597.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014284; classtype:social-engineering; sid:6014284; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (customeraccessmembershipmovie.65-98-5-17.cpanel.site/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"customeraccessmembershipmovie.65-98-5-17.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014285; classtype:social-engineering; sid:6014285; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (soulful-reflect-310128.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"soulful-reflect-310128.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014286; classtype:social-engineering; sid:6014286; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (golr3795-sudo.github.io/Soporte/)"; flow:established,to_server; http.uri; content:"/Soporte/"; startswith; fast_pattern; http.host; content:"golr3795-sudo.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014287; classtype:social-engineering; sid:6014287; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (css-ch.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"css-ch.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014288; classtype:social-engineering; sid:6014288; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.blm7333.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.blm7333.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014289; classtype:social-engineering; sid:6014289; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtd.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingtd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014290; classtype:social-engineering; sid:6014290; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtj.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingtj.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014291; classtype:social-engineering; sid:6014291; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ecommerce-website-nine-hazel.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ecommerce-website-nine-hazel.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014292; classtype:social-engineering; sid:6014292; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (macelos.cyou/ins.gov.co.html)"; flow:established,to_server; http.uri; content:"/ins.gov.co.html"; startswith; fast_pattern; http.host; content:"macelos.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014293; classtype:social-engineering; sid:6014293; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toplukonut8879772196.vercel.app/giris.html)"; flow:established,to_server; http.uri; content:"/giris.html"; startswith; fast_pattern; http.host; content:"toplukonut8879772196.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014294; classtype:social-engineering; sid:6014294; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee2449.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopee2449.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014295; classtype:social-engineering; sid:6014295; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9cmw-idx4-47fs.george-vandevorde-smithinsurancellc-com-s-account.workers.dev/12...)"; flow:established,to_server; http.uri; content:"/12..."; startswith; fast_pattern; http.host; content:"9cmw-idx4-47fs.george-vandevorde-smithinsurancellc-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014296; classtype:social-engineering; sid:6014296; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kkhm-62ja-vye4.philip-turnkeytalk-com-s-account.workers.dev/c6b87fb685103ff6?email=3/)"; flow:established,to_server; http.uri; content:"/c6b87fb685103ff6?email=3/"; startswith; fast_pattern; http.host; content:"kkhm-62ja-vye4.philip-turnkeytalk-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014297; classtype:social-engineering; sid:6014297; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (manage-trezor-info-learn.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"manage-trezor-info-learn.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014298; classtype:social-engineering; sid:6014298; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sx.xmugrg.net/supprtdocs-remitstatementpdf/office/)"; flow:established,to_server; http.uri; content:"/supprtdocs-remitstatementpdf/office/"; startswith; fast_pattern; http.host; content:"sx.xmugrg.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014299; classtype:social-engineering; sid:6014299; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.jhrerth.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.jhrerth.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014300; classtype:social-engineering; sid:6014300; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (click.knowledesbase.info/ga/click/2-67234297-21-10951-21417-11884-890ae42d05-69da2e466b)"; flow:established,to_server; http.uri; content:"/ga/click/2-67234297-21-10951-21417-11884-890ae42d05-69da2e466b"; startswith; fast_pattern; http.host; content:"click.knowledesbase.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014301; classtype:social-engineering; sid:6014301; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (plearnthaipalace.com/~r5g8ldveioxpnxqm/assets/images/images/12/lng/login.php)"; flow:established,to_server; http.uri; content:"/~r5g8ldveioxpnxqm/assets/images/images/12/lng/login.php"; startswith; fast_pattern; http.host; content:"plearnthaipalace.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014302; classtype:social-engineering; sid:6014302; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (giftcard.lat/activate-189522795/)"; flow:established,to_server; http.uri; content:"/activate-189522795/"; startswith; fast_pattern; http.host; content:"giftcard.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014303; classtype:social-engineering; sid:6014303; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maxisap.com/mymaxis)"; flow:established,to_server; http.uri; content:"/mymaxis"; startswith; fast_pattern; http.host; content:"maxisap.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014304; classtype:social-engineering; sid:6014304; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dolamesbu.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dolamesbu.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014305; classtype:social-engineering; sid:6014305; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eco17.onrender.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eco17.onrender.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014306; classtype:social-engineering; sid:6014306; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alicefilmustherapy.com/~r5g8ldveioxpnxqm/assets/images/images/12/lng/login.php)"; flow:established,to_server; http.uri; content:"/~r5g8ldveioxpnxqm/assets/images/images/12/lng/login.php"; startswith; fast_pattern; http.host; content:"alicefilmustherapy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014307; classtype:social-engineering; sid:6014307; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd-padnu.com/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd-padnu.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014308; classtype:social-engineering; sid:6014308; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecocashquickloans.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ecocashquickloans.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014309; classtype:social-engineering; sid:6014309; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (macroja39whdsbhjbdjhbshdbj-cvcfckhzhhd0b7dr.z02.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"macroja39whdsbhjbdjhbshdbj-cvcfckhzhhd0b7dr.z02.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014310; classtype:social-engineering; sid:6014310; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (femmesopk.com/le-diagnostic-du-sopk-le-diagnostic-est-pose-si-au-moins-2-des-3-criteres/)"; flow:established,to_server; http.uri; content:"/le-diagnostic-du-sopk-le-diagnostic-est-pose-si-au-moins-2-des-3-criteres/"; startswith; fast_pattern; http.host; content:"femmesopk.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014311; classtype:social-engineering; sid:6014311; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtr.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingtr.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014312; classtype:social-engineering; sid:6014312; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd-lpobj.cc/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd-lpobj.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014313; classtype:social-engineering; sid:6014313; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (68-210-98-112.cprapid.com/de/kasse.php?f9g3df4kli27s0sk9fym)"; flow:established,to_server; http.uri; content:"/de/kasse.php?f9g3df4kli27s0sk9fym"; startswith; fast_pattern; http.host; content:"68-210-98-112.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014314; classtype:social-engineering; sid:6014314; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acessoradardigital.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"acessoradardigital.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014315; classtype:social-engineering; sid:6014315; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (asra144.github.io/Netflix-Clone)"; flow:established,to_server; http.uri; content:"/Netflix-Clone"; startswith; fast_pattern; http.host; content:"asra144.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014316; classtype:social-engineering; sid:6014316; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whapptr3.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whapptr3.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014317; classtype:social-engineering; sid:6014317; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mosquitomagnet-mrad.net/~r5g8ldveioxpnxqm/assets/images/images/12/lng/login.php)"; flow:established,to_server; http.uri; content:"/~r5g8ldveioxpnxqm/assets/images/images/12/lng/login.php"; startswith; fast_pattern; http.host; content:"www.mosquitomagnet-mrad.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014318; classtype:social-engineering; sid:6014318; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee8717.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.shopee8717.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014319; classtype:social-engineering; sid:6014319; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cofredeleads.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"cofredeleads.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014320; classtype:social-engineering; sid:6014320; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pruebegydo-ship-it.github.io/Web.biblioteca)"; flow:established,to_server; http.uri; content:"/Web.biblioteca"; startswith; fast_pattern; http.host; content:"pruebegydo-ship-it.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014321; classtype:social-engineering; sid:6014321; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whapptr9.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whapptr9.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014322; classtype:social-engineering; sid:6014322; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fuv.jbw.temporary.site/112/NRD/1364f3c/)"; flow:established,to_server; http.uri; content:"/112/NRD/1364f3c/"; startswith; fast_pattern; http.host; content:"fuv.jbw.temporary.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014323; classtype:social-engineering; sid:6014323; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bigshopee597.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"bigshopee597.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014324; classtype:social-engineering; sid:6014324; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (copataaiaumenteja70.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"copataaiaumenteja70.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014325; classtype:social-engineering; sid:6014325; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrn.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingrn.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014326; classtype:social-engineering; sid:6014326; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7wk0-c0co-0t2l.dturcotte-predictms-com-s-account.workers.dev/1a8578e3f506d45a?email=a$)"; flow:established,to_server; http.uri; content:"/1a8578e3f506d45a?email=a$"; startswith; fast_pattern; http.host; content:"7wk0-c0co-0t2l.dturcotte-predictms-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014327; classtype:social-engineering; sid:6014327; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (itens-ze.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"itens-ze.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014328; classtype:social-engineering; sid:6014328; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stutiiag.github.io/Amazon.github.io/)"; flow:established,to_server; http.uri; content:"/Amazon.github.io/"; startswith; fast_pattern; http.host; content:"stutiiag.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014329; classtype:social-engineering; sid:6014329; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vaai.la/Roblox_vng)"; flow:established,to_server; http.uri; content:"/Roblox_vng"; startswith; fast_pattern; http.host; content:"vaai.la"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014330; classtype:social-engineering; sid:6014330; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (should-fat-overhead-zones.trycloudflare.com/login.html)"; flow:established,to_server; http.uri; content:"/login.html"; startswith; fast_pattern; http.host; content:"should-fat-overhead-zones.trycloudflare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014331; classtype:social-engineering; sid:6014331; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365wtvip.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"365wtvip.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014332; classtype:social-engineering; sid:6014332; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coningmarincert.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coningmarincert.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014333; classtype:social-engineering; sid:6014333; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrc.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingrc.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014334; classtype:social-engineering; sid:6014334; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopeebig777.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopeebig777.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014335; classtype:social-engineering; sid:6014335; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtq.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingtq.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014336; classtype:social-engineering; sid:6014336; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (am.rdiyn.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"am.rdiyn.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014337; classtype:social-engineering; sid:6014337; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.df588a30.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.df588a30.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014338; classtype:social-engineering; sid:6014338; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (268365i.com/#/register?shareCode=0HDB)"; flow:established,to_server; http.uri; content:"/#/register?shareCode=0HDB"; startswith; fast_pattern; http.host; content:"268365i.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014339; classtype:social-engineering; sid:6014339; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (unlimited-overlays-836657.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"unlimited-overlays-836657.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014340; classtype:social-engineering; sid:6014340; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (farwa07.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"farwa07.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014341; classtype:social-engineering; sid:6014341; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (customeraccessmembershipmovie.65-98-5-17.cpanel.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"customeraccessmembershipmovie.65-98-5-17.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014342; classtype:social-engineering; sid:6014342; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (edward95.neocities.org/montinigro/)"; flow:established,to_server; http.uri; content:"/montinigro/"; startswith; fast_pattern; http.host; content:"edward95.neocities.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014343; classtype:social-engineering; sid:6014343; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (japassoudahoradeelevaraumenteja.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"japassoudahoradeelevaraumenteja.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014344; classtype:social-engineering; sid:6014344; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingts.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingts.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014345; classtype:social-engineering; sid:6014345; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auspost.customerserviceqi.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auspost.customerserviceqi.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014346; classtype:social-engineering; sid:6014346; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.teamcdk.com/p/fhw-obf/nrfshrgd/)"; flow:established,to_server; http.uri; content:"/p/fhw-obf/nrfshrgd/"; startswith; fast_pattern; http.host; content:"s.teamcdk.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014347; classtype:social-engineering; sid:6014347; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enfermeriacanaria.com/112/NRD/1b1fd37/)"; flow:established,to_server; http.uri; content:"/112/NRD/1b1fd37/"; startswith; fast_pattern; http.host; content:"enfermeriacanaria.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014348; classtype:social-engineering; sid:6014348; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtw.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingtw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014349; classtype:social-engineering; sid:6014349; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kycoq.com/?type=verify&\;key=siflirofpu)"; flow:established,to_server; http.uri; content:"/?type=verify&|3b|key=siflirofpu"; startswith; fast_pattern; http.host; content:"kycoq.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014350; classtype:social-engineering; sid:6014350; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bradesco.acesse-empresas.com/app/wd/index.php?p=carregando&_reqid=cf413dd01570edd02fdbf9173e5b44d7)"; flow:established,to_server; http.uri; content:"/app/wd/index.php?p=carregando&_reqid=cf413dd01570edd02fdbf9173e5b44d7"; startswith; fast_pattern; http.host; content:"bradesco.acesse-empresas.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014351; classtype:social-engineering; sid:6014351; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ferctharyzan.icu/?secure_connect=i2*9o*&_subid=28u3f78.96.1ekr4&_token=1vhvikq3ctv11g.1781937011.2.d9edf1e8ad7c5d68bb8f390cebc94092)"; flow:established,to_server; http.uri; content:"/?secure_connect=i2*9o*&_subid=28u3f78.96.1ekr4&_token=1vhvikq3ctv11g.1781937011.2.d9edf1e8ad7c5d68bb8f390cebc94092"; startswith; fast_pattern; http.host; content:"ferctharyzan.icu"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014352; classtype:social-engineering; sid:6014352; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klelnanzeigen-deutch.shzhjujia.com/9tawe1zSKW?m=8&__cf_chl_rt_tk=.fso38mGJYAkKQjKmAlDUqSw1E5Y8q.Bv0UjHtopLA4-1781884629-1.0.1.1-JUxXvWm9H16MJ9WdjCd.JAyLPI6mBVyjPIScRUTU3YQ)"; flow:established,to_server; http.uri; content:"/9tawe1zSKW?m=8&__cf_chl_rt_tk=.fso38mGJYAkKQjKmAlDUqSw1E5Y8q.Bv0UjHtopLA4-1781884629-1.0.1.1-JUxXvWm9H16MJ9WdjCd.JAyLPI6mBVyjPIScRUTU3YQ"; startswith; fast_pattern; http.host; content:"klelnanzeigen-deutch.shzhjujia.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014353; classtype:social-engineering; sid:6014353; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (valuabley.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"valuabley.xyz"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014354; classtype:social-engineering; sid:6014354; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (glsdtl.com/?type=verify&\;key=ptsuijiwsi)"; flow:established,to_server; http.uri; content:"/?type=verify&|3b|key=ptsuijiwsi"; startswith; fast_pattern; http.host; content:"glsdtl.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014355; classtype:social-engineering; sid:6014355; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cba1188.com/?ZnaH8IRmgoOp)"; flow:established,to_server; http.uri; content:"/?ZnaH8IRmgoOp"; startswith; fast_pattern; http.host; content:"www.cba1188.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014356; classtype:social-engineering; sid:6014356; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auspost.customerserviceqr.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auspost.customerserviceqr.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014357; classtype:social-engineering; sid:6014357; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fsdyt168.com/?8zueCpR91uVW)"; flow:established,to_server; http.uri; content:"/?8zueCpR91uVW"; startswith; fast_pattern; http.host; content:"www.fsdyt168.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014358; classtype:social-engineering; sid:6014358; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klelnanzeigen-deutch.shzhjujia.com/d2s6wIxE39?m=8&__cf_chl_rt_tk=vpkuiDibnvuWUR.hU27k7P6yD8Bt4N6U17HEA68trTg-1781877164-1.0.1.1-02enFqI_vwiqdbc9vXi4qUnz3oBOwgEv.yIrLJPXeUg)"; flow:established,to_server; http.uri; content:"/d2s6wIxE39?m=8&__cf_chl_rt_tk=vpkuiDibnvuWUR.hU27k7P6yD8Bt4N6U17HEA68trTg-1781877164-1.0.1.1-02enFqI_vwiqdbc9vXi4qUnz3oBOwgEv.yIrLJPXeUg"; startswith; fast_pattern; http.host; content:"klelnanzeigen-deutch.shzhjujia.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014359; classtype:social-engineering; sid:6014359; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kopaturismo.com.br/ase/saveenergy_09343.html)"; flow:established,to_server; http.uri; content:"/ase/saveenergy_09343.html"; startswith; fast_pattern; http.host; content:"kopaturismo.com.br"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014360; classtype:social-engineering; sid:6014360; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-password-recovery.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-password-recovery.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014361; classtype:social-engineering; sid:6014361; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (emioetygiauhfyue-rtyqwfugihiuoeooietyu.pages.dev/?e=Csolixsys@04c6e23c9c06a9e4827b14a484aff42d24e8.net)"; flow:established,to_server; http.uri; content:"/?e=Csolixsys@04c6e23c9c06a9e4827b14a484aff42d24e8.net"; startswith; fast_pattern; http.host; content:"emioetygiauhfyue-rtyqwfugihiuoeooietyu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014362; classtype:social-engineering; sid:6014362; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (produklokal.palukota.go.id/app)"; flow:established,to_server; http.uri; content:"/app"; startswith; fast_pattern; http.host; content:"produklokal.palukota.go.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014363; classtype:social-engineering; sid:6014363; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-r.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-r.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014364; classtype:social-engineering; sid:6014364; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (94709.my/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"94709.my"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014365; classtype:social-engineering; sid:6014365; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (capitalaccelusa.us-sea-1.linodeobjects.com/validate.html)"; flow:established,to_server; http.uri; content:"/validate.html"; startswith; fast_pattern; http.host; content:"capitalaccelusa.us-sea-1.linodeobjects.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014366; classtype:social-engineering; sid:6014366; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faq-trezo-or-hard-ware-walle-t.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"faq-trezo-or-hard-ware-walle-t.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014367; classtype:social-engineering; sid:6014367; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portaldodev.com.br/nday.html)"; flow:established,to_server; http.uri; content:"/nday.html"; startswith; fast_pattern; http.host; content:"portaldodev.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014368; classtype:social-engineering; sid:6014368; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (charminviteco.de/ecard/)"; flow:established,to_server; http.uri; content:"/ecard/"; startswith; fast_pattern; http.host; content:"charminviteco.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014369; classtype:social-engineering; sid:6014369; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fq.relink-tech.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fq.relink-tech.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014370; classtype:social-engineering; sid:6014370; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (os.techto.com.br/opening)"; flow:established,to_server; http.uri; content:"/opening"; startswith; fast_pattern; http.host; content:"os.techto.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014371; classtype:social-engineering; sid:6014371; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (url1402.nycamail.com/ls/click?upn=u001.O6jY7o9q5dogmtnrk4RHNyfiClE-2FdW0u4mVoJzQUWbl43jj-2Bk3VIt5wVfL10yYz8-2F0MlU5h4lHc0-2F527Vfp1Rg9WaAVbnT0lKyMb5-2ByVOkkzmc1loXcjwD00dBsi-2Bpuo1sN1BAVIzP14BCXPZIqxow-3D-3DbI1t_1K0sULVzZmD1Y43wkEC8mz1u4aiMsC3e7cQ11KiXIvDbtqxsJoY2t837YrWb3CJ66Dc0oauTwyQIkYg-2BmDnxee3FedFhlkMt3it9LlURYYXRS8hteDZed4heUotSWyPKKHChxN-2BeFymuOAtm-2FUIDFdN3QTOLkLTMKBpPBzavxdVfhdXPnRLnbLyzx4E3kFOUzPOx7mHrv-2B3MHYivnDmBkkTNRaEWqcBM55iYbdiPd21m0kEcQ8SZ2rj5ALr3hilz)"; flow:established,to_server; http.uri; content:"/ls/click?upn=u001.O6jY7o9q5dogmtnrk4RHNyfiClE-2FdW0u4mVoJzQUWbl43jj-2Bk3VIt5wVfL10yYz8-2F0MlU5h4lHc0-2F527Vfp1Rg9WaAVbnT0lKyMb5-2ByVOkkzmc1loXcjwD00dBsi-2Bpuo1sN1BAVIzP14BCXPZIqxow-3D-3DbI1t_1K0sULVzZmD1Y43wkEC8mz1u4aiMsC3e7cQ11KiXIvDbtqxsJoY2t837YrWb3CJ66Dc0oauTwyQIkYg-2BmDnxee3FedFhlkMt3it9LlURYYXRS8hteDZed4heUotSWyPKKHChxN-2BeFymuOAtm-2FUIDFdN3QTOLkLTMKBpPBzavxdVfhdXPnRLnbLyzx4E3kFOUzPOx7mHrv-2B3MHYivnDmBkkTNRaEWqcBM55iYbdiPd21m0kEcQ8SZ2rj5ALr3hilz"; startswith; fast_pattern; http.host; content:"url1402.nycamail.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014372; classtype:social-engineering; sid:6014372; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pesta-shopee509.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"pesta-shopee509.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014373; classtype:social-engineering; sid:6014373; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gabrielnovaesdev.github.io/Clone-de-Interface-do-Spotify)"; flow:established,to_server; http.uri; content:"/Clone-de-Interface-do-Spotify"; startswith; fast_pattern; http.host; content:"gabrielnovaesdev.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014374; classtype:social-engineering; sid:6014374; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nidarosdiskgolf.no/sgi/)"; flow:established,to_server; http.uri; content:"/sgi/"; startswith; fast_pattern; http.host; content:"nidarosdiskgolf.no"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014375; classtype:social-engineering; sid:6014375; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suite-trezear.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"suite-trezear.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014376; classtype:social-engineering; sid:6014376; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uspsglobaldelivery.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uspsglobaldelivery.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014377; classtype:social-engineering; sid:6014377; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-auth-trezor-wallet.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-auth-trezor-wallet.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014378; classtype:social-engineering; sid:6014378; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4-creeks.mpaeroz.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4-creeks.mpaeroz.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014379; classtype:social-engineering; sid:6014379; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-password-recovery.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-password-recovery.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014380; classtype:social-engineering; sid:6014380; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toplukonut1251251.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"toplukonut1251251.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014381; classtype:social-engineering; sid:6014381; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gerenciadorcaixaempresas.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gerenciadorcaixaempresas.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014382; classtype:social-engineering; sid:6014382; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-liive-app.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"ledger-liive-app.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014383; classtype:social-engineering; sid:6014383; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.00wnsr.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.00wnsr.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014384; classtype:social-engineering; sid:6014384; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentojaa01.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentojaa01.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014385; classtype:social-engineering; sid:6014385; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail03-blocage-provisoire.abrdns.com/id/soilandpile.com/wp-admin/js/js/index.html)"; flow:established,to_server; http.uri; content:"/id/soilandpile.com/wp-admin/js/js/index.html"; startswith; fast_pattern; http.host; content:"mail03-blocage-provisoire.abrdns.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014386; classtype:social-engineering; sid:6014386; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (btccompensation.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"btccompensation.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014387; classtype:social-engineering; sid:6014387; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lp-dialok-rs-pf.btg-goods.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lp-dialok-rs-pf.btg-goods.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014388; classtype:social-engineering; sid:6014388; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.css-ch.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.css-ch.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014389; classtype:social-engineering; sid:6014389; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rd3f-aicp-3l2z.jennifer-jencrosslaw-com-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rd3f-aicp-3l2z.jennifer-jencrosslaw-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014390; classtype:social-engineering; sid:6014390; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hga372.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hga372.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014391; classtype:social-engineering; sid:6014391; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (customersupport-portal.com/u.s.bank.customersupport-portal.com)"; flow:established,to_server; http.uri; content:"/u.s.bank.customersupport-portal.com"; startswith; fast_pattern; http.host; content:"customersupport-portal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014392; classtype:social-engineering; sid:6014392; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mspremierconsultinginc.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mspremierconsultinginc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014393; classtype:social-engineering; sid:6014393; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hsihwef.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hsihwef.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014394; classtype:social-engineering; sid:6014394; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toplukonut1251251.vercel.app/giris.html)"; flow:established,to_server; http.uri; content:"/giris.html"; startswith; fast_pattern; http.host; content:"toplukonut1251251.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014395; classtype:social-engineering; sid:6014395; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (in.flea.biz.id/dana.bantuan/)"; flow:established,to_server; http.uri; content:"/dana.bantuan/"; startswith; fast_pattern; http.host; content:"in.flea.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014396; classtype:social-engineering; sid:6014396; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (safelytrusted.com/api/user/request-perm?email_id=1265075701479070277)"; flow:established,to_server; http.uri; content:"/api/user/request-perm?email_id=1265075701479070277"; startswith; fast_pattern; http.host; content:"safelytrusted.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014397; classtype:social-engineering; sid:6014397; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.365365x.app:443/chs/)"; flow:established,to_server; http.uri; content:"/chs/"; startswith; fast_pattern; http.host; content:"m.365365x.app:443"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014398; classtype:social-engineering; sid:6014398; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ying8868.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ying8868.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014399; classtype:social-engineering; sid:6014399; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sicpac.com/sales)"; flow:established,to_server; http.uri; content:"/sales"; startswith; fast_pattern; http.host; content:"sicpac.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014400; classtype:social-engineering; sid:6014400; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fortchamp.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fortchamp.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014401; classtype:social-engineering; sid:6014401; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.rebrabooking.it/nfx)"; flow:established,to_server; http.uri; content:"/nfx"; startswith; fast_pattern; http.host; content:"www.rebrabooking.it"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014402; classtype:social-engineering; sid:6014402; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.365365x.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.365365x.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014403; classtype:social-engineering; sid:6014403; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (customersupport-portal.com/u.s.bank.customersupport-portal.com/)"; flow:established,to_server; http.uri; content:"/u.s.bank.customersupport-portal.com/"; startswith; fast_pattern; http.host; content:"customersupport-portal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014404; classtype:social-engineering; sid:6014404; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whatsapp-pulse-hub.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whatsapp-pulse-hub.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014405; classtype:social-engineering; sid:6014405; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faq-trezr-public-en.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"faq-trezr-public-en.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014406; classtype:social-engineering; sid:6014406; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aditieeeee.github.io/Aditieeeee.github/)"; flow:established,to_server; http.uri; content:"/Aditieeeee.github/"; startswith; fast_pattern; http.host; content:"aditieeeee.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014407; classtype:social-engineering; sid:6014407; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fuv.jbw.temporary.site/112/NRD/b3287fe/Sign_in.php/)"; flow:established,to_server; http.uri; content:"/112/NRD/b3287fe/Sign_in.php/"; startswith; fast_pattern; http.host; content:"www.fuv.jbw.temporary.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014408; classtype:social-engineering; sid:6014408; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (js4519.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"js4519.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014409; classtype:social-engineering; sid:6014409; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (welcome--suite-trezr-io.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"welcome--suite-trezr-io.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014410; classtype:social-engineering; sid:6014410; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fanciful-mochi-1778c3.netlify.app/#belelz@a592214ebafee626190c24b16bd58cf2f4bd.org)"; flow:established,to_server; http.uri; content:"/#belelz@a592214ebafee626190c24b16bd58cf2f4bd.org"; startswith; fast_pattern; http.host; content:"fanciful-mochi-1778c3.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014411; classtype:social-engineering; sid:6014411; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (goapps---y--uphold-com.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"goapps---y--uphold-com.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014412; classtype:social-engineering; sid:6014412; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (evobothub.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"evobothub.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014413; classtype:social-engineering; sid:6014413; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedagiodigitalonline.email/ecovias/home.php)"; flow:established,to_server; http.uri; content:"/ecovias/home.php"; startswith; fast_pattern; http.host; content:"pedagiodigitalonline.email"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014414; classtype:social-engineering; sid:6014414; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (360plus.net/eng/)"; flow:established,to_server; http.uri; content:"/eng/"; startswith; fast_pattern; http.host; content:"360plus.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014415; classtype:social-engineering; sid:6014415; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (potkek01.neocities.org/BR/)"; flow:established,to_server; http.uri; content:"/BR/"; startswith; fast_pattern; http.host; content:"potkek01.neocities.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014416; classtype:social-engineering; sid:6014416; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fed-ex.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fed-ex.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014417; classtype:social-engineering; sid:6014417; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (insta-clone-johnatanivini.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"insta-clone-johnatanivini.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014418; classtype:social-engineering; sid:6014418; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.web-git-herman-cons-1985-responsive-web-changes-uniswap.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.web-git-herman-cons-1985-responsive-web-changes-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014419; classtype:social-engineering; sid:6014419; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kesinlink3.one/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kesinlink3.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014420; classtype:social-engineering; sid:6014420; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.toplukonut1251251.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.toplukonut1251251.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014421; classtype:social-engineering; sid:6014421; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (colectivopa.hstn.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"colectivopa.hstn.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014422; classtype:social-engineering; sid:6014422; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365365a.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.365365a.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014423; classtype:social-engineering; sid:6014423; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (grihinie.org/gk/index.html)"; flow:established,to_server; http.uri; content:"/gk/index.html"; startswith; fast_pattern; http.host; content:"grihinie.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014424; classtype:social-engineering; sid:6014424; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (biiing.net/?r=9f45ed62-2dd0-43c0-b67b-ee43b48b5cc6&rg=eu)"; flow:established,to_server; http.uri; content:"/?r=9f45ed62-2dd0-43c0-b67b-ee43b48b5cc6&rg=eu"; startswith; fast_pattern; http.host; content:"biiing.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014425; classtype:social-engineering; sid:6014425; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (home-trez-or-walle-t.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"home-trez-or-walle-t.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014426; classtype:social-engineering; sid:6014426; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toplukonut1251251.vercel.app/giris.html/)"; flow:established,to_server; http.uri; content:"/giris.html/"; startswith; fast_pattern; http.host; content:"toplukonut1251251.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014427; classtype:social-engineering; sid:6014427; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (api.relis.co.ke/vendor/meta-fb-page/login/)"; flow:established,to_server; http.uri; content:"/vendor/meta-fb-page/login/"; startswith; fast_pattern; http.host; content:"api.relis.co.ke"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014428; classtype:social-engineering; sid:6014428; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (danaid.offlcial-info1.web.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"danaid.offlcial-info1.web.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014429; classtype:social-engineering; sid:6014429; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ptshopee-229.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"ptshopee-229.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014430; classtype:social-engineering; sid:6014430; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meine-zustellplanung.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meine-zustellplanung.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014431; classtype:social-engineering; sid:6014431; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vester.it/mol/idks4/konda1.html)"; flow:established,to_server; http.uri; content:"/mol/idks4/konda1.html"; startswith; fast_pattern; http.host; content:"vester.it"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014432; classtype:social-engineering; sid:6014432; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tealsmoorebag.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tealsmoorebag.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014433; classtype:social-engineering; sid:6014433; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (url-shortener.me/N5JS)"; flow:established,to_server; http.uri; content:"/N5JS"; startswith; fast_pattern; http.host; content:"url-shortener.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014434; classtype:social-engineering; sid:6014434; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.juplab.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.juplab.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014435; classtype:social-engineering; sid:6014435; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bitly.cx/aR7ZT)"; flow:established,to_server; http.uri; content:"/aR7ZT"; startswith; fast_pattern; http.host; content:"bitly.cx"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014436; classtype:social-engineering; sid:6014436; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.djj.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.djj.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014437; classtype:social-engineering; sid:6014437; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kok40.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kok40.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014438; classtype:social-engineering; sid:6014438; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fuv.jbw.temporary.site/112/NRD/b3287fe/Sign_in.php)"; flow:established,to_server; http.uri; content:"/112/NRD/b3287fe/Sign_in.php"; startswith; fast_pattern; http.host; content:"www.fuv.jbw.temporary.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014439; classtype:social-engineering; sid:6014439; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (post-finance.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"post-finance.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014440; classtype:social-engineering; sid:6014440; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365verificafacial.fwh.is/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"365verificafacial.fwh.is"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014441; classtype:social-engineering; sid:6014441; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sakshiyadav0925.github.io/Project)"; flow:established,to_server; http.uri; content:"/Project"; startswith; fast_pattern; http.host; content:"sakshiyadav0925.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014442; classtype:social-engineering; sid:6014442; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robuxstacks.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"robuxstacks.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014443; classtype:social-engineering; sid:6014443; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mathkaynsgvsjbhiabhsbu.github.io/Metamask-phish/)"; flow:established,to_server; http.uri; content:"/Metamask-phish/"; startswith; fast_pattern; http.host; content:"mathkaynsgvsjbhiabhsbu.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014444; classtype:social-engineering; sid:6014444; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reactivar-microsoft-mxx.iceiy.com/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"reactivar-microsoft-mxx.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014445; classtype:social-engineering; sid:6014445; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezoor-io-learn-cdn.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezoor-io-learn-cdn.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014446; classtype:social-engineering; sid:6014446; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (minabus.cl/km/santa.html)"; flow:established,to_server; http.uri; content:"/km/santa.html"; startswith; fast_pattern; http.host; content:"minabus.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014447; classtype:social-engineering; sid:6014447; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (confirmare.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"confirmare.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014448; classtype:social-engineering; sid:6014448; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreieok7tsdcw3zc5hqju7f35whwjuhajc7snjatmqmz4y6pmwmfm4te.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreieok7tsdcw3zc5hqju7f35whwjuhajc7snjatmqmz4y6pmwmfm4te.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014449; classtype:social-engineering; sid:6014449; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (snipergames.de/paylog2/index.html)"; flow:established,to_server; http.uri; content:"/paylog2/index.html"; startswith; fast_pattern; http.host; content:"snipergames.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014450; classtype:social-engineering; sid:6014450; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (encontrar.rft-z.com/?i=K9iyN)"; flow:established,to_server; http.uri; content:"/?i=K9iyN"; startswith; fast_pattern; http.host; content:"encontrar.rft-z.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014451; classtype:social-engineering; sid:6014451; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ptshopee-229.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.ptshopee-229.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014452; classtype:social-engineering; sid:6014452; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ptfuturewebinarfrellanceece.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ptfuturewebinarfrellanceece.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014453; classtype:social-engineering; sid:6014453; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ecocashquickloans.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ecocashquickloans.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014454; classtype:social-engineering; sid:6014454; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mr-sum1t.github.io/Amazon-Clone)"; flow:established,to_server; http.uri; content:"/Amazon-Clone"; startswith; fast_pattern; http.host; content:"mr-sum1t.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014455; classtype:social-engineering; sid:6014455; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bisque-takeaways-294067.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bisque-takeaways-294067.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014456; classtype:social-engineering; sid:6014456; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rscigroups.com/0602/access/zT7v84ofQi9lueNf0MtiVB0xYQYWPTlE7rOp)"; flow:established,to_server; http.uri; content:"/0602/access/zT7v84ofQi9lueNf0MtiVB0xYQYWPTlE7rOp"; startswith; fast_pattern; http.host; content:"rscigroups.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014457; classtype:social-engineering; sid:6014457; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tibexa.kesug.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tibexa.kesug.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014458; classtype:social-engineering; sid:6014458; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (convivial-smile-369927.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"convivial-smile-369927.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014459; classtype:social-engineering; sid:6014459; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (encontrar.rft-z.com/K9iyN/)"; flow:established,to_server; http.uri; content:"/K9iyN/"; startswith; fast_pattern; http.host; content:"encontrar.rft-z.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014460; classtype:social-engineering; sid:6014460; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pam-alpha-mail-ne-jp-fantastic-chainsaw-production-c3bb.up.railway.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pam-alpha-mail-ne-jp-fantastic-chainsaw-production-c3bb.up.railway.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014461; classtype:social-engineering; sid:6014461; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtn.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingtn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014462; classtype:social-engineering; sid:6014462; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (876678987.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"876678987.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014463; classtype:social-engineering; sid:6014463; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (final-ivory-yyeunzxk-dprqo0854tpr.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"final-ivory-yyeunzxk-dprqo0854tpr.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014464; classtype:social-engineering; sid:6014464; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.asdfghjkjhgfdsaq1.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.asdfghjkjhgfdsaq1.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014465; classtype:social-engineering; sid:6014465; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nidarosdiskgolf.no/sgi/065258aab9fe8e3/login.php)"; flow:established,to_server; http.uri; content:"/sgi/065258aab9fe8e3/login.php"; startswith; fast_pattern; http.host; content:"nidarosdiskgolf.no"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014466; classtype:social-engineering; sid:6014466; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (devansh-srivastava-source.github.io/amazon-uiclone01/product.html)"; flow:established,to_server; http.uri; content:"/amazon-uiclone01/product.html"; startswith; fast_pattern; http.host; content:"devansh-srivastava-source.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014467; classtype:social-engineering; sid:6014467; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (swapdev.clovernode.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"swapdev.clovernode.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014468; classtype:social-engineering; sid:6014468; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cerval.com.mx/app/)"; flow:established,to_server; http.uri; content:"/app/"; startswith; fast_pattern; http.host; content:"cerval.com.mx"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014469; classtype:social-engineering; sid:6014469; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vikramak-47.github.io/ECE-2-Amazon-Clone-Project-146/)"; flow:established,to_server; http.uri; content:"/ECE-2-Amazon-Clone-Project-146/"; startswith; fast_pattern; http.host; content:"vikramak-47.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014470; classtype:social-engineering; sid:6014470; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nidarosdiskgolf.no/sgi/bb9faf09d44eb31/login.php#signin)"; flow:established,to_server; http.uri; content:"/sgi/bb9faf09d44eb31/login.php#signin"; startswith; fast_pattern; http.host; content:"nidarosdiskgolf.no"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014471; classtype:social-engineering; sid:6014471; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iliovskiinn.com/uri/2/Email)"; flow:established,to_server; http.uri; content:"/uri/2/Email"; startswith; fast_pattern; http.host; content:"iliovskiinn.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014472; classtype:social-engineering; sid:6014472; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ai-start-faq-trezoor.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ai-start-faq-trezoor.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014473; classtype:social-engineering; sid:6014473; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (steamnconmunity.ru/Id/7656193558567372)"; flow:established,to_server; http.uri; content:"/Id/7656193558567372"; startswith; fast_pattern; http.host; content:"steamnconmunity.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014474; classtype:social-engineering; sid:6014474; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nidarosdiskgolf.no/sgi/d6f7c316396dd55/login.php#signin)"; flow:established,to_server; http.uri; content:"/sgi/d6f7c316396dd55/login.php#signin"; startswith; fast_pattern; http.host; content:"nidarosdiskgolf.no"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014475; classtype:social-engineering; sid:6014475; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whatsapp-base-app.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whatsapp-base-app.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014476; classtype:social-engineering; sid:6014476; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tibexa.kesug.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.tibexa.kesug.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014477; classtype:social-engineering; sid:6014477; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (live.aaveapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"live.aaveapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014478; classtype:social-engineering; sid:6014478; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (doniasyriac.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"doniasyriac.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014479; classtype:social-engineering; sid:6014479; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (singular-semolina-b8c7ee.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"singular-semolina-b8c7ee.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014480; classtype:social-engineering; sid:6014480; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (minhasvantagensitau.com.br/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"minhasvantagensitau.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014481; classtype:social-engineering; sid:6014481; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mmshipman.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mmshipman.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014482; classtype:social-engineering; sid:6014482; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (asdf.jkingredeints.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"asdf.jkingredeints.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014483; classtype:social-engineering; sid:6014483; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myqrcode.mobi/894a1a64)"; flow:established,to_server; http.uri; content:"/894a1a64"; startswith; fast_pattern; http.host; content:"myqrcode.mobi"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014484; classtype:social-engineering; sid:6014484; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fuv.jbw.temporary.site/112/NRD/b3287fe/)"; flow:established,to_server; http.uri; content:"/112/NRD/b3287fe/"; startswith; fast_pattern; http.host; content:"www.fuv.jbw.temporary.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014485; classtype:social-engineering; sid:6014485; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (glopakind.com/DocuSign/Mac/)"; flow:established,to_server; http.uri; content:"/DocuSign/Mac/"; startswith; fast_pattern; http.host; content:"glopakind.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014486; classtype:social-engineering; sid:6014486; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (grihinie.org/j/lmp.html)"; flow:established,to_server; http.uri; content:"/j/lmp.html"; startswith; fast_pattern; http.host; content:"grihinie.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014487; classtype:social-engineering; sid:6014487; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (conobse_prologe.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"conobse_prologe.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014488; classtype:social-engineering; sid:6014488; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.gjj.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.gjj.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014489; classtype:social-engineering; sid:6014489; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (onlinepharmacygx.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"onlinepharmacygx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014490; classtype:social-engineering; sid:6014490; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (devansh-srivastava-source.github.io/amazon-uiclone01/cart.html)"; flow:established,to_server; http.uri; content:"/amazon-uiclone01/cart.html"; startswith; fast_pattern; http.host; content:"devansh-srivastava-source.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014491; classtype:social-engineering; sid:6014491; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kleinanzeigen.envio010.es/0177891?mail=W0NBVENIXQ%3D%3D&meta=rlWjMKWwLJ50LJqyVwb1YPWhLJ1yVwbvKUHlAzRkKUIzMGOzVRAuqTAbGJHtGJScoTIlVvjvL2uuqS9cMPV6YGRjZQV5BQLkZmt0ZGNfVaAypaMcL2HvBvWeoTIcozShrzIcM2IhVvjvqUyjMFV6VzAuqTAboJIsoJScoPW9)"; flow:established,to_server; http.uri; content:"/0177891?mail=W0NBVENIXQ%3D%3D&meta=rlWjMKWwLJ50LJqyVwb1YPWhLJ1yVwbvKUHlAzRkKUIzMGOzVRAuqTAbGJHtGJScoTIlVvjvL2uuqS9cMPV6YGRjZQV5BQLkZmt0ZGNfVaAypaMcL2HvBvWeoTIcozShrzIcM2IhVvjvqUyjMFV6VzAuqTAboJIsoJScoPW9"; startswith; fast_pattern; http.host; content:"kleinanzeigen.envio010.es"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014492; classtype:social-engineering; sid:6014492; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (banco-pichincha.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"banco-pichincha.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014493; classtype:social-engineering; sid:6014493; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prestamos-adelantos-ecuador2026.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"prestamos-adelantos-ecuador2026.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014494; classtype:social-engineering; sid:6014494; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.clubedopresente.club/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app.clubedopresente.club"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014495; classtype:social-engineering; sid:6014495; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.jotform.com/251692439172563)"; flow:established,to_server; http.uri; content:"/251692439172563"; startswith; fast_pattern; http.host; content:"app.jotform.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014496; classtype:social-engineering; sid:6014496; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bradesco.chatcorporativopj.digital/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bradesco.chatcorporativopj.digital"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014497; classtype:social-engineering; sid:6014497; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mygloboltsb-online.icu/?secure_connect=v99*ft1&_subid=28u3f78.2d.1eoi7&_token=1vhvikq3ctv11g.1781937011.5.d653d72f006140538b8f26024ca92cc4)"; flow:established,to_server; http.uri; content:"/?secure_connect=v99*ft1&_subid=28u3f78.2d.1eoi7&_token=1vhvikq3ctv11g.1781937011.5.d653d72f006140538b8f26024ca92cc4"; startswith; fast_pattern; http.host; content:"mygloboltsb-online.icu"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014498; classtype:social-engineering; sid:6014498; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (komcontrol.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"komcontrol.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014499; classtype:social-engineering; sid:6014499; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie.prywatne8329.lol/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.prywatne8329.lol"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014500; classtype:social-engineering; sid:6014500; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-hn35vvz3h.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-hn35vvz3h.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014501; classtype:social-engineering; sid:6014501; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trust-wallet-cloned-beige.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trust-wallet-cloned-beige.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014502; classtype:social-engineering; sid:6014502; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtb.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingtb.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014503; classtype:social-engineering; sid:6014503; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.labrrums.co.uk/ngW49h7NdM1RF99HHFVi-j4PrMtujxw7BJEQBN68t0pg9LD98I6s3EW7bT8nJEkyVC2Aw5Ly0x-jGoZ29068CfMnX3qaOMpJZ_pfrJJ9XG44ToJ3QJgDy82CHJwN2S4yJNIZdnQoiFe4a1VsV764AZ8NNEcTAFo9e24TnmObKZij42XZ0f7r3v1wVLz4NlvjH0ujyivcKE7kWYXE1jV7Ic4BFBwKL_oF9T30OZhP6YbL5ePa3n9B475D/gwxDWpBW1hi0/)"; flow:established,to_server; http.uri; content:"/ngW49h7NdM1RF99HHFVi-j4PrMtujxw7BJEQBN68t0pg9LD98I6s3EW7bT8nJEkyVC2Aw5Ly0x-jGoZ29068CfMnX3qaOMpJZ_pfrJJ9XG44ToJ3QJgDy82CHJwN2S4yJNIZdnQoiFe4a1VsV764AZ8NNEcTAFo9e24TnmObKZij42XZ0f7r3v1wVLz4NlvjH0ujyivcKE7kWYXE1jV7Ic4BFBwKL_oF9T30OZhP6YbL5ePa3n9B475D/gwxDWpBW1hi0/"; startswith; fast_pattern; http.host; content:"www.labrrums.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014504; classtype:social-engineering; sid:6014504; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingyi.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingyi.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014505; classtype:social-engineering; sid:6014505; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingyr.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingyr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014506; classtype:social-engineering; sid:6014506; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (compuservinformatica.com/kabra/kabra.html)"; flow:established,to_server; http.uri; content:"/kabra/kabra.html"; startswith; fast_pattern; http.host; content:"compuservinformatica.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014507; classtype:social-engineering; sid:6014507; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.pl-65891248791243.sbs/oferta/66880113/jacuzzi-intex-whirlpool-purespa-196-x-71-cm)"; flow:established,to_server; http.uri; content:"/oferta/66880113/jacuzzi-intex-whirlpool-purespa-196-x-71-cm"; startswith; fast_pattern; http.host; content:"allegrolokalnie.pl-65891248791243.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014508; classtype:social-engineering; sid:6014508; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (security-indexer--adamlee160686.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"security-indexer--adamlee160686.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014509; classtype:social-engineering; sid:6014509; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1xlite-24510.bar/en/slots/)"; flow:established,to_server; http.uri; content:"/en/slots/"; startswith; fast_pattern; http.host; content:"www.1xlite-24510.bar"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014510; classtype:social-engineering; sid:6014510; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (org-007.github.io/instagram)"; flow:established,to_server; http.uri; content:"/instagram"; startswith; fast_pattern; http.host; content:"org-007.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014511; classtype:social-engineering; sid:6014511; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-r.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-r.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014512; classtype:social-engineering; sid:6014512; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.houstontacolover.com/Mac/utility.php)"; flow:established,to_server; http.uri; content:"/Mac/utility.php"; startswith; fast_pattern; http.host; content:"www.houstontacolover.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014513; classtype:social-engineering; sid:6014513; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ynlendriyonuzknk23154.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ynlendriyonuzknk23154.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014514; classtype:social-engineering; sid:6014514; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp-support-app.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp-support-app.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014515; classtype:social-engineering; sid:6014515; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp-app-hub.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp-app-hub.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014516; classtype:social-engineering; sid:6014516; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3gx4-9e9i-1a1y.hany-onixautomotive-com-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3gx4-9e9i-1a1y.hany-onixautomotive-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014517; classtype:social-engineering; sid:6014517; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtm.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingtm.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014518; classtype:social-engineering; sid:6014518; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (storno-addebiti.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"storno-addebiti.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014519; classtype:social-engineering; sid:6014519; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ynlendriyonuzknk23154.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ynlendriyonuzknk23154.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014520; classtype:social-engineering; sid:6014520; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (org-007.github.io/instagram-)"; flow:established,to_server; http.uri; content:"/instagram-"; startswith; fast_pattern; http.host; content:"org-007.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014521; classtype:social-engineering; sid:6014521; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vaibhavgarg78.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"vaibhavgarg78.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014522; classtype:social-engineering; sid:6014522; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (51qkzz.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"51qkzz.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014523; classtype:social-engineering; sid:6014523; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alert-navyfederal.web.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"alert-navyfederal.web.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014524; classtype:social-engineering; sid:6014524; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (parvathi982005.github.io/login-page)"; flow:established,to_server; http.uri; content:"/login-page"; startswith; fast_pattern; http.host; content:"parvathi982005.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014525; classtype:social-engineering; sid:6014525; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.365365a.app:443/chs/)"; flow:established,to_server; http.uri; content:"/chs/"; startswith; fast_pattern; http.host; content:"m.365365a.app:443"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014526; classtype:social-engineering; sid:6014526; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.paypal-banking.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.paypal-banking.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014527; classtype:social-engineering; sid:6014527; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.program-resmi67.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.program-resmi67.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014528; classtype:social-engineering; sid:6014528; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.id.rivdevis.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.id.rivdevis.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014529; classtype:social-engineering; sid:6014529; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail-owa-path-mail-crispy-sniffle-production-9007.up.railway.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webmail-owa-path-mail-crispy-sniffle-production-9007.up.railway.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014530; classtype:social-engineering; sid:6014530; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.program-resmi537.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.program-resmi537.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014531; classtype:social-engineering; sid:6014531; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (postfin-rd.abrdns.com/CH823979/CH/)"; flow:established,to_server; http.uri; content:"/CH823979/CH/"; startswith; fast_pattern; http.host; content:"postfin-rd.abrdns.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014532; classtype:social-engineering; sid:6014532; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.trezosuites.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.trezosuites.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014533; classtype:social-engineering; sid:6014533; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtm.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingtm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014534; classtype:social-engineering; sid:6014534; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp-sync-pro.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp-sync-pro.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014535; classtype:social-engineering; sid:6014535; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (realarpit.github.io/amazon_clone/)"; flow:established,to_server; http.uri; content:"/amazon_clone/"; startswith; fast_pattern; http.host; content:"realarpit.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014536; classtype:social-engineering; sid:6014536; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kovadlor.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kovadlor.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014537; classtype:social-engineering; sid:6014537; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (steam-totp.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"steam-totp.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014538; classtype:social-engineering; sid:6014538; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.secure-attestation.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.secure-attestation.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014539; classtype:social-engineering; sid:6014539; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (falabellaprestamos.click/inicio-movil.php)"; flow:established,to_server; http.uri; content:"/inicio-movil.php"; startswith; fast_pattern; http.host; content:"falabellaprestamos.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014540; classtype:social-engineering; sid:6014540; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whatsapp-crm-hub.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whatsapp-crm-hub.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014541; classtype:social-engineering; sid:6014541; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adityajoshi2628-collab.github.io/sem2.github.io/)"; flow:established,to_server; http.uri; content:"/sem2.github.io/"; startswith; fast_pattern; http.host; content:"adityajoshi2628-collab.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014542; classtype:social-engineering; sid:6014542; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp-mobile-hub.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp-mobile-hub.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014543; classtype:social-engineering; sid:6014543; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (itmaintenance.my/smiles)"; flow:established,to_server; http.uri; content:"/smiles"; startswith; fast_pattern; http.host; content:"itmaintenance.my"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014544; classtype:social-engineering; sid:6014544; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp-sales-pro.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp-sales-pro.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014545; classtype:social-engineering; sid:6014545; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facbook-marketplce-vehicles-cars-item4109524175.bringolf2you.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facbook-marketplce-vehicles-cars-item4109524175.bringolf2you.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014546; classtype:social-engineering; sid:6014546; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtp.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingtp.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014547; classtype:social-engineering; sid:6014547; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gl.andromedavpn.com.br/login.php)"; flow:established,to_server; http.uri; content:"/login.php"; startswith; fast_pattern; http.host; content:"gl.andromedavpn.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014548; classtype:social-engineering; sid:6014548; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alligator-finch-x9ae.squarespace.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"alligator-finch-x9ae.squarespace.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014549; classtype:social-engineering; sid:6014549; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (55001-55001-02.vip/promo.html)"; flow:established,to_server; http.uri; content:"/promo.html"; startswith; fast_pattern; http.host; content:"55001-55001-02.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014550; classtype:social-engineering; sid:6014550; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp-link-hub.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp-link-hub.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014551; classtype:social-engineering; sid:6014551; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mqv18.com:8989/mobile-client/bet365_627/index.html?td_channelid=627&c=&o=null)"; flow:established,to_server; http.uri; content:"/mobile-client/bet365_627/index.html?td_channelid=627&c=&o=null"; startswith; fast_pattern; http.host; content:"mqv18.com:8989"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014552; classtype:social-engineering; sid:6014552; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hawkh616-wq.github.io/instagram/)"; flow:established,to_server; http.uri; content:"/instagram/"; startswith; fast_pattern; http.host; content:"hawkh616-wq.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014553; classtype:social-engineering; sid:6014553; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (joint-turquoise-ajfkbwvy.edgeone.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"joint-turquoise-ajfkbwvy.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014554; classtype:social-engineering; sid:6014554; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fjordbadger.digital/c39zHnd7)"; flow:established,to_server; http.uri; content:"/c39zHnd7"; startswith; fast_pattern; http.host; content:"fjordbadger.digital"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014555; classtype:social-engineering; sid:6014555; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.trust-wallet-cloned-beige.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.trust-wallet-cloned-beige.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014556; classtype:social-engineering; sid:6014556; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (postfinance.ch-notfallhilfe.com/login.php)"; flow:established,to_server; http.uri; content:"/login.php"; startswith; fast_pattern; http.host; content:"postfinance.ch-notfallhilfe.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014557; classtype:social-engineering; sid:6014557; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.home-messenger-verrification-mailbox.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.home-messenger-verrification-mailbox.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014558; classtype:social-engineering; sid:6014558; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (waocreativacompany.com/kdn)"; flow:established,to_server; http.uri; content:"/kdn"; startswith; fast_pattern; http.host; content:"waocreativacompany.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014559; classtype:social-engineering; sid:6014559; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtd.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingtd.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014560; classtype:social-engineering; sid:6014560; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whatsapp-flow-app.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whatsapp-flow-app.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014561; classtype:social-engineering; sid:6014561; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suemaisnovoupgradeaumento.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"suemaisnovoupgradeaumento.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014562; classtype:social-engineering; sid:6014562; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.houstontacolover.com/Mac/)"; flow:established,to_server; http.uri; content:"/Mac/"; startswith; fast_pattern; http.host; content:"www.houstontacolover.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014563; classtype:social-engineering; sid:6014563; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (feinz.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"feinz.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014564; classtype:social-engineering; sid:6014564; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whatsapp-easy-flow.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whatsapp-easy-flow.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014565; classtype:social-engineering; sid:6014565; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopeetbk133.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.shopeetbk133.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014566; classtype:social-engineering; sid:6014566; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.site-hn35vvz3h.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.site-hn35vvz3h.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014567; classtype:social-engineering; sid:6014567; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreid5ebjfcsqjng6pzokmecfax3nki3xqsmqmb2uf4zqy675wrlewxq.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreid5ebjfcsqjng6pzokmecfax3nki3xqsmqmb2uf4zqy675wrlewxq.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014568; classtype:social-engineering; sid:6014568; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ginnovenergy.com/fb-page-review/login/)"; flow:established,to_server; http.uri; content:"/fb-page-review/login/"; startswith; fast_pattern; http.host; content:"www.ginnovenergy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014569; classtype:social-engineering; sid:6014569; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cw9h-2avi-96oj.jennifer-jencrosslaw-com-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cw9h-2avi-96oj.jennifer-jencrosslaw-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014570; classtype:social-engineering; sid:6014570; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vaaiidu.github.io/amazon/)"; flow:established,to_server; http.uri; content:"/amazon/"; startswith; fast_pattern; http.host; content:"vaaiidu.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014571; classtype:social-engineering; sid:6014571; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cra-atfykn.dft-tar.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cra-atfykn.dft-tar.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014572; classtype:social-engineering; sid:6014572; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp-hub-net.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp-hub-net.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014573; classtype:social-engineering; sid:6014573; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (carteras.bolsos.skin/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"carteras.bolsos.skin"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014574; classtype:social-engineering; sid:6014574; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.pl-65891248791243.sbs/oferta/66880113/jacuzzi-)"; flow:established,to_server; http.uri; content:"/oferta/66880113/jacuzzi-"; startswith; fast_pattern; http.host; content:"allegrolokalnie.pl-65891248791243.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014575; classtype:social-engineering; sid:6014575; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loginfacebook.site.je/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"loginfacebook.site.je"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014576; classtype:social-engineering; sid:6014576; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whatsapp-zone-hub.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whatsapp-zone-hub.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014577; classtype:social-engineering; sid:6014577; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0991contacto.github.io/revisar09mail/)"; flow:established,to_server; http.uri; content:"/revisar09mail/"; startswith; fast_pattern; http.host; content:"0991contacto.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014578; classtype:social-engineering; sid:6014578; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pesta-shopee509.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pesta-shopee509.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014579; classtype:social-engineering; sid:6014579; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sample-painting.com/two.html)"; flow:established,to_server; http.uri; content:"/two.html"; startswith; fast_pattern; http.host; content:"sample-painting.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014580; classtype:social-engineering; sid:6014580; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (securelink.newsupdate.cloud/updateemailinformation?rid=GLGzR9t)"; flow:established,to_server; http.uri; content:"/updateemailinformation?rid=GLGzR9t"; startswith; fast_pattern; http.host; content:"securelink.newsupdate.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014581; classtype:social-engineering; sid:6014581; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafybeidijorazwioy33ekcfbv2zyvthhjtklisrk6aoyxl6evmoro4jpka.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafybeidijorazwioy33ekcfbv2zyvthhjtklisrk6aoyxl6evmoro4jpka.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014582; classtype:social-engineering; sid:6014582; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.365365a.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.365365a.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014583; classtype:social-engineering; sid:6014583; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (attfiberoptic.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"attfiberoptic.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014584; classtype:social-engineering; sid:6014584; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toplukonut214925192.vercel.app/giris.html)"; flow:established,to_server; http.uri; content:"/giris.html"; startswith; fast_pattern; http.host; content:"toplukonut214925192.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014585; classtype:social-engineering; sid:6014585; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sbszgszaz.wpdevcloud.com/spd/spd/page/login.php)"; flow:established,to_server; http.uri; content:"/spd/spd/page/login.php"; startswith; fast_pattern; http.host; content:"sbszgszaz.wpdevcloud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014586; classtype:social-engineering; sid:6014586; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.alligator-finch-x9ae.squarespace.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.alligator-finch-x9ae.squarespace.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014587; classtype:social-engineering; sid:6014587; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoja001.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoja001.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014588; classtype:social-engineering; sid:6014588; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (equipamentosdolareacimasempre.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"equipamentosdolareacimasempre.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014589; classtype:social-engineering; sid:6014589; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.pl-65891248791243.sbs/oferta/11670530/karta-gr)"; flow:established,to_server; http.uri; content:"/oferta/11670530/karta-gr"; startswith; fast_pattern; http.host; content:"allegrolokalnie.pl-65891248791243.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014590; classtype:social-engineering; sid:6014590; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (z9p3t6k1r8w4.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"z9p3t6k1r8w4.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014591; classtype:social-engineering; sid:6014591; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deutschebank.abbove.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"deutschebank.abbove.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014592; classtype:social-engineering; sid:6014592; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sender1.zohoinsights.com.au/ck1/7a6803.1a13b9c22/a7213d90-6ae3-11f1-a441-7ec00f710257/ffbc7b02bba08b1c8637d56c23f5452b8ce2c2c9/2?e=PhH3ITXZ6BBnQVVMx7Dh5Og5k0oSQY7EcjGL3bakyrCCNxMcRF0NAJ9gR2X1yXWmyQDsTTWOxhJzmbH9EZz43A==)"; flow:established,to_server; http.uri; content:"/ck1/7a6803.1a13b9c22/a7213d90-6ae3-11f1-a441-7ec00f710257/ffbc7b02bba08b1c8637d56c23f5452b8ce2c2c9/2?e=PhH3ITXZ6BBnQVVMx7Dh5Og5k0oSQY7EcjGL3bakyrCCNxMcRF0NAJ9gR2X1yXWmyQDsTTWOxhJzmbH9EZz43A=="; startswith; fast_pattern; http.host; content:"sender1.zohoinsights.com.au"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014593; classtype:social-engineering; sid:6014593; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingyi.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingyi.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014594; classtype:social-engineering; sid:6014594; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (houstontacolover.com/Mac/visit.php)"; flow:established,to_server; http.uri; content:"/Mac/visit.php"; startswith; fast_pattern; http.host; content:"houstontacolover.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014595; classtype:social-engineering; sid:6014595; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.epcheck.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.epcheck.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014596; classtype:social-engineering; sid:6014596; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (id.rivdevis.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"id.rivdevis.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014597; classtype:social-engineering; sid:6014597; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-9hrs9q9vu.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-9hrs9q9vu.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014598; classtype:social-engineering; sid:6014598; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (belbuilnet.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"belbuilnet.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014599; classtype:social-engineering; sid:6014599; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.site-9hrs9q9vu.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.site-9hrs9q9vu.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014600; classtype:social-engineering; sid:6014600; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (servmsn-live.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"servmsn-live.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014601; classtype:social-engineering; sid:6014601; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hibcoprotector.com/mac/secure_access-5.html)"; flow:established,to_server; http.uri; content:"/mac/secure_access-5.html"; startswith; fast_pattern; http.host; content:"hibcoprotector.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014602; classtype:social-engineering; sid:6014602; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (att-resetaccount.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"att-resetaccount.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014603; classtype:social-engineering; sid:6014603; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acct.caixesp-finbk.com/es)"; flow:established,to_server; http.uri; content:"/es"; startswith; fast_pattern; http.host; content:"acct.caixesp-finbk.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014604; classtype:social-engineering; sid:6014604; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp-now-hub.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp-now-hub.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014605; classtype:social-engineering; sid:6014605; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (angela-lala-bruno.com/wp-includes/ID3/multi/home.php?newtoken=)"; flow:established,to_server; http.uri; content:"/wp-includes/ID3/multi/home.php?newtoken="; startswith; fast_pattern; http.host; content:"angela-lala-bruno.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014606; classtype:social-engineering; sid:6014606; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.qee.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.qee.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014607; classtype:social-engineering; sid:6014607; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (greatmaninlifejeuscomefromkenny.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"greatmaninlifejeuscomefromkenny.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014608; classtype:social-engineering; sid:6014608; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtn.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingtn.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014609; classtype:social-engineering; sid:6014609; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kurasiz.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kurasiz.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014610; classtype:social-engineering; sid:6014610; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abialine.ng/ffr/?naps/)"; flow:established,to_server; http.uri; content:"/ffr/?naps/"; startswith; fast_pattern; http.host; content:"abialine.ng"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014611; classtype:social-engineering; sid:6014611; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paypal-banking.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paypal-banking.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014612; classtype:social-engineering; sid:6014612; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fraudoptix.com/vi22fe02226/792e0bff658f2ae7fbbaa7c2/index.php?id=40c92f7aa24713d87e3a9a66c2be7f13)"; flow:established,to_server; http.uri; content:"/vi22fe02226/792e0bff658f2ae7fbbaa7c2/index.php?id=40c92f7aa24713d87e3a9a66c2be7f13"; startswith; fast_pattern; http.host; content:"fraudoptix.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014613; classtype:social-engineering; sid:6014613; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (turbopage.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"turbopage.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014614; classtype:social-engineering; sid:6014614; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (r-unicorn-international.com/meta-page-fb/login)"; flow:established,to_server; http.uri; content:"/meta-page-fb/login"; startswith; fast_pattern; http.host; content:"r-unicorn-international.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014615; classtype:social-engineering; sid:6014615; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (program-resmi537.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"program-resmi537.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014616; classtype:social-engineering; sid:6014616; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingyr.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingyr.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014617; classtype:social-engineering; sid:6014617; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auspost.customerserviceqp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auspost.customerserviceqp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014618; classtype:social-engineering; sid:6014618; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingyt.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingyt.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014619; classtype:social-engineering; sid:6014619; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezosuites.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"trezosuites.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014620; classtype:social-engineering; sid:6014620; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whatsapp-hub-net.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whatsapp-hub-net.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014621; classtype:social-engineering; sid:6014621; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clone-facebook-alpha.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"clone-facebook-alpha.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014622; classtype:social-engineering; sid:6014622; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verificar-cu3nta.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"verificar-cu3nta.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014623; classtype:social-engineering; sid:6014623; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f006.backblazeb2.com/b2api/v1/b2_download_file_by_id?fileId=4_zf0f29bcab7ad83729ee4031b_f1154f0ebdf5db998_d20260602_m094724_c006_v0601002_t0025_u01780393644294)"; flow:established,to_server; http.uri; content:"/b2api/v1/b2_download_file_by_id?fileId=4_zf0f29bcab7ad83729ee4031b_f1154f0ebdf5db998_d20260602_m094724_c006_v0601002_t0025_u01780393644294"; startswith; fast_pattern; http.host; content:"f006.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014624; classtype:social-engineering; sid:6014624; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deutschebank.abbove.com/users/sign_in)"; flow:established,to_server; http.uri; content:"/users/sign_in"; startswith; fast_pattern; http.host; content:"deutschebank.abbove.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014625; classtype:social-engineering; sid:6014625; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.wwwlaoatv.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.wwwlaoatv.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014626; classtype:social-engineering; sid:6014626; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kyrasgame.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kyrasgame.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014627; classtype:social-engineering; sid:6014627; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (singhsatyam76259-prog.github.io/AMAZON-CLONE-SEM2/)"; flow:established,to_server; http.uri; content:"/AMAZON-CLONE-SEM2/"; startswith; fast_pattern; http.host; content:"singhsatyam76259-prog.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014628; classtype:social-engineering; sid:6014628; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (baldedealcance.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"baldedealcance.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014629; classtype:social-engineering; sid:6014629; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (admin369.ttht.ink/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"admin369.ttht.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014630; classtype:social-engineering; sid:6014630; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (request-reviews.business-minange.com/secret=xs/)"; flow:established,to_server; http.uri; content:"/secret=xs/"; startswith; fast_pattern; http.host; content:"request-reviews.business-minange.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014631; classtype:social-engineering; sid:6014631; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (admin369.ttht.ink/h5/)"; flow:established,to_server; http.uri; content:"/h5/"; startswith; fast_pattern; http.host; content:"admin369.ttht.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014632; classtype:social-engineering; sid:6014632; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ems.account-info.email/6197094-oH1faBZb-PKS9Q)"; flow:established,to_server; http.uri; content:"/6197094-oH1faBZb-PKS9Q"; startswith; fast_pattern; http.host; content:"ems.account-info.email"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014633; classtype:social-engineering; sid:6014633; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toplukonuthemenbasvuru.live/giris.php)"; flow:established,to_server; http.uri; content:"/giris.php"; startswith; fast_pattern; http.host; content:"toplukonuthemenbasvuru.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014634; classtype:social-engineering; sid:6014634; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whatsapp-core-app.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whatsapp-core-app.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014635; classtype:social-engineering; sid:6014635; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adityajoshi2628-collab.github.io/sem2.github.io)"; flow:established,to_server; http.uri; content:"/sem2.github.io"; startswith; fast_pattern; http.host; content:"adityajoshi2628-collab.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014636; classtype:social-engineering; sid:6014636; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopix.testuat.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopix.testuat.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014637; classtype:social-engineering; sid:6014637; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (program-resmi67.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"program-resmi67.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014638; classtype:social-engineering; sid:6014638; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jbapamxtra.my/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jbapamxtra.my"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014639; classtype:social-engineering; sid:6014639; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aaagggg.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aaagggg.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014640; classtype:social-engineering; sid:6014640; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeetbk133.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopeetbk133.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014641; classtype:social-engineering; sid:6014641; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (daftarpinjamandisinivt1.apexe.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"daftarpinjamandisinivt1.apexe.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014642; classtype:social-engineering; sid:6014642; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adithya2788.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"adithya2788.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014643; classtype:social-engineering; sid:6014643; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp-vibe-hub.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp-vibe-hub.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014644; classtype:social-engineering; sid:6014644; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.colmed3.org.ar/santanew/page/login.php)"; flow:established,to_server; http.uri; content:"/santanew/page/login.php"; startswith; fast_pattern; http.host; content:"www.colmed3.org.ar"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014645; classtype:social-engineering; sid:6014645; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en-hard-ware-trezr.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"en-hard-ware-trezr.typedream.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014646; classtype:social-engineering; sid:6014646; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (visual-contributors-047142.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"visual-contributors-047142.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014647; classtype:social-engineering; sid:6014647; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pretty-today-002056.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pretty-today-002056.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014648; classtype:social-engineering; sid:6014648; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cauport.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cauport.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014649; classtype:social-engineering; sid:6014649; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moccasin-absolute-605532.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moccasin-absolute-605532.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014650; classtype:social-engineering; sid:6014650; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shawwinc.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shawwinc.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014651; classtype:social-engineering; sid:6014651; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hhhtpwpcu.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hhhtpwpcu.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014652; classtype:social-engineering; sid:6014652; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mommrr.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mommrr.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014653; classtype:social-engineering; sid:6014653; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kemendagi.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kemendagi.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014654; classtype:social-engineering; sid:6014654; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lucky-interaction-114381.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lucky-interaction-114381.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014655; classtype:social-engineering; sid:6014655; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eng-trezoo-bridge.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eng-trezoo-bridge.netlify.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014656; classtype:social-engineering; sid:6014656; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jceikp.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.jceikp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014657; classtype:social-engineering; sid:6014657; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (frander435.github.io/Doc-attacthed/Purchase)"; flow:established,to_server; http.uri; content:"/Doc-attacthed/Purchase"; startswith; fast_pattern; http.host; content:"frander435.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014658; classtype:social-engineering; sid:6014658; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bplg-agb.at/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bplg-agb.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014659; classtype:social-engineering; sid:6014659; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (am.kuwik.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"am.kuwik.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014660; classtype:social-engineering; sid:6014660; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (macxlazy.uk.cc/5g/)"; flow:established,to_server; http.uri; content:"/5g/"; startswith; fast_pattern; http.host; content:"macxlazy.uk.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014661; classtype:social-engineering; sid:6014661; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (soniyapatwal123-svg.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"soniyapatwal123-svg.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014662; classtype:social-engineering; sid:6014662; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metimask-log-signin.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metimask-log-signin.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014663; classtype:social-engineering; sid:6014663; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiverr-payment.help/work/new-orders)"; flow:established,to_server; http.uri; content:"/work/new-orders"; startswith; fast_pattern; http.host; content:"fiverr-payment.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014664; classtype:social-engineering; sid:6014664; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (first-order.top/work/ask)"; flow:established,to_server; http.uri; content:"/work/ask"; startswith; fast_pattern; http.host; content:"first-order.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014665; classtype:social-engineering; sid:6014665; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.cmftxu.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.cmftxu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014666; classtype:social-engineering; sid:6014666; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (autoimportferia.vercel.app/portal/bhd)"; flow:established,to_server; http.uri; content:"/portal/bhd"; startswith; fast_pattern; http.host; content:"autoimportferia.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014667; classtype:social-engineering; sid:6014667; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coinbase-wallets.blogspot.com/2022/11/?m=1)"; flow:established,to_server; http.uri; content:"/2022/11/?m=1"; startswith; fast_pattern; http.host; content:"coinbase-wallets.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014668; classtype:social-engineering; sid:6014668; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (banco-pichincha.hellofig.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"banco-pichincha.hellofig.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014669; classtype:social-engineering; sid:6014669; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.program-resmi359.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.program-resmi359.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014670; classtype:social-engineering; sid:6014670; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (65956365756.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"65956365756.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014671; classtype:social-engineering; sid:6014671; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (satyamkumar1232.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"satyamkumar1232.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014672; classtype:social-engineering; sid:6014672; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tasks-flverr.help/project/katy2)"; flow:established,to_server; http.uri; content:"/project/katy2"; startswith; fast_pattern; http.host; content:"tasks-flverr.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014673; classtype:social-engineering; sid:6014673; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoja52.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoja52.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014674; classtype:social-engineering; sid:6014674; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365365n.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.365365n.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014675; classtype:social-engineering; sid:6014675; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1f108e7d.sibforms.com/serve/MUIFAKQdE59mxAZ_eAl-ORmHK4Xsx_J3DisW98xMwiCDrze-S2Q6oJnVTd8thmwnn_3aeR1cm3bkyUdx7PK1Ikm_SEmOb0Ll-W-AJ7_hdQrpgunJkIiGn8OvlXy-XJGqvpYDJ6KiBMMRJQqaqy_JDe_iZi05QMUxAcmmhRwK4QbGPnCuzqVyUwpP_2_Jonxa2O14IIpvnWVDulbRtg==/)"; flow:established,to_server; http.uri; content:"/serve/MUIFAKQdE59mxAZ_eAl-ORmHK4Xsx_J3DisW98xMwiCDrze-S2Q6oJnVTd8thmwnn_3aeR1cm3bkyUdx7PK1Ikm_SEmOb0Ll-W-AJ7_hdQrpgunJkIiGn8OvlXy-XJGqvpYDJ6KiBMMRJQqaqy_JDe_iZi05QMUxAcmmhRwK4QbGPnCuzqVyUwpP_2_Jonxa2O14IIpvnWVDulbRtg==/"; startswith; fast_pattern; http.host; content:"1f108e7d.sibforms.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014676; classtype:social-engineering; sid:6014676; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingyp.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingyp.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014677; classtype:social-engineering; sid:6014677; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (program-resmi359.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"program-resmi359.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014678; classtype:social-engineering; sid:6014678; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (155378.com/m)"; flow:established,to_server; http.uri; content:"/m"; startswith; fast_pattern; http.host; content:"155378.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014679; classtype:social-engineering; sid:6014679; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.js7448.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.js7448.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014680; classtype:social-engineering; sid:6014680; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (karimgaboussa.github.io/tiktok-pro)"; flow:established,to_server; http.uri; content:"/tiktok-pro"; startswith; fast_pattern; http.host; content:"karimgaboussa.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014681; classtype:social-engineering; sid:6014681; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingyp.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingyp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014682; classtype:social-engineering; sid:6014682; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.uqhlsk.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.uqhlsk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014683; classtype:social-engineering; sid:6014683; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mostafa-dev124.github.io/Facebook-Login-Page)"; flow:established,to_server; http.uri; content:"/Facebook-Login-Page"; startswith; fast_pattern; http.host; content:"mostafa-dev124.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014684; classtype:social-engineering; sid:6014684; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (radiorsj.be/baj/305951f25b685b4/login.php)"; flow:established,to_server; http.uri; content:"/baj/305951f25b685b4/login.php"; startswith; fast_pattern; http.host; content:"radiorsj.be"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014685; classtype:social-engineering; sid:6014685; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.4s4dc3.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.4s4dc3.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014686; classtype:social-engineering; sid:6014686; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (compadramos.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"compadramos.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014687; classtype:social-engineering; sid:6014687; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brajmohan01.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"brajmohan01.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014688; classtype:social-engineering; sid:6014688; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.66122186365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.66122186365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014689; classtype:social-engineering; sid:6014689; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bombarde.framer.media/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bombarde.framer.media"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014690; classtype:social-engineering; sid:6014690; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (luanmcarvalho.github.io/airbnb-clone)"; flow:established,to_server; http.uri; content:"/airbnb-clone"; startswith; fast_pattern; http.host; content:"luanmcarvalho.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014691; classtype:social-engineering; sid:6014691; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (radiorsj.be/baj/cb81f3693366960/login.php)"; flow:established,to_server; http.uri; content:"/baj/cb81f3693366960/login.php"; startswith; fast_pattern; http.host; content:"radiorsj.be"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014692; classtype:social-engineering; sid:6014692; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pbadlu.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.pbadlu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014693; classtype:social-engineering; sid:6014693; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiifkanpaylater.ujj.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiifkanpaylater.ujj.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014694; classtype:social-engineering; sid:6014694; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d365kvip.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d365kvip.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014695; classtype:social-engineering; sid:6014695; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prontikot.com/od/processing1142)"; flow:established,to_server; http.uri; content:"/od/processing1142"; startswith; fast_pattern; http.host; content:"prontikot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014696; classtype:social-engineering; sid:6014696; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.365365n.app/chs/)"; flow:established,to_server; http.uri; content:"/chs/"; startswith; fast_pattern; http.host; content:"m.365365n.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014697; classtype:social-engineering; sid:6014697; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (monti296.github.io/Spotify-Clone)"; flow:established,to_server; http.uri; content:"/Spotify-Clone"; startswith; fast_pattern; http.host; content:"monti296.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014698; classtype:social-engineering; sid:6014698; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nati673.github.io/Apple-with-Bootstrap)"; flow:established,to_server; http.uri; content:"/Apple-with-Bootstrap"; startswith; fast_pattern; http.host; content:"nati673.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014699; classtype:social-engineering; sid:6014699; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (unknown9672.github.io/Insta-Login/)"; flow:established,to_server; http.uri; content:"/Insta-Login/"; startswith; fast_pattern; http.host; content:"unknown9672.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014700; classtype:social-engineering; sid:6014700; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roaring-wisp-bf1c61.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"roaring-wisp-bf1c61.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014701; classtype:social-engineering; sid:6014701; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (copilotupgrade.offices-support.com/home/6c896708c0364d9db8887c56c6b8df82/acacbe21d011740f988665175a1f3ddff)"; flow:established,to_server; http.uri; content:"/home/6c896708c0364d9db8887c56c6b8df82/acacbe21d011740f988665175a1f3ddff"; startswith; fast_pattern; http.host; content:"copilotupgrade.offices-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014702; classtype:social-engineering; sid:6014702; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gestion-ingresar.infy.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gestion-ingresar.infy.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014703; classtype:social-engineering; sid:6014703; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booking-poc-ejr.pages.dev/haarlem_rfc_v5)"; flow:established,to_server; http.uri; content:"/haarlem_rfc_v5"; startswith; fast_pattern; http.host; content:"booking-poc-ejr.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014704; classtype:social-engineering; sid:6014704; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www--roblox.co/communities/775951477)"; flow:established,to_server; http.uri; content:"/communities/775951477"; startswith; fast_pattern; http.host; content:"www--roblox.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014705; classtype:social-engineering; sid:6014705; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (copilotupgrade.offices-support.com/i/acacbe21d011740f988665175a1f3ddff)"; flow:established,to_server; http.uri; content:"/i/acacbe21d011740f988665175a1f3ddff"; startswith; fast_pattern; http.host; content:"copilotupgrade.offices-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014706; classtype:social-engineering; sid:6014706; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.js779933.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.js779933.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014707; classtype:social-engineering; sid:6014707; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.ie-track.icu/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.ie-track.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014708; classtype:social-engineering; sid:6014708; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apple204797a7901743bf88326c2be2d7806e.4fvj23.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"apple204797a7901743bf88326c2be2d7806e.4fvj23.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014709; classtype:social-engineering; sid:6014709; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.khuixo.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.khuixo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014710; classtype:social-engineering; sid:6014710; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix.bikramgyawali.com.np/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix.bikramgyawali.com.np"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014711; classtype:social-engineering; sid:6014711; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gayatri-gahtori.github.io/Spotify-clone)"; flow:established,to_server; http.uri; content:"/Spotify-clone"; startswith; fast_pattern; http.host; content:"gayatri-gahtori.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014712; classtype:social-engineering; sid:6014712; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso--login--trezor--io-cdn.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sso--login--trezor--io-cdn.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014713; classtype:social-engineering; sid:6014713; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (radiorsj.be/baj/722dc8e994e7ebb/login.php)"; flow:established,to_server; http.uri; content:"/baj/722dc8e994e7ebb/login.php"; startswith; fast_pattern; http.host; content:"radiorsj.be"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014714; classtype:social-engineering; sid:6014714; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jpqeyt.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.jpqeyt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014715; classtype:social-engineering; sid:6014715; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-flverr.help/project/Flverr)"; flow:established,to_server; http.uri; content:"/project/Flverr"; startswith; fast_pattern; http.host; content:"app-flverr.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014716; classtype:social-engineering; sid:6014716; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reative-sua-assinatura.fun/access.php?verify=0EXM80SK0EXM-024U-0EXM024U024U-EKVF024U&identifyData=mj66usha74j8b086vjkrm9dp4j&timeAttemp=eccbc87e4b5ce2fe28308fd9f2a7baf3)"; flow:established,to_server; http.uri; content:"/access.php?verify=0EXM80SK0EXM-024U-0EXM024U024U-EKVF024U&identifyData=mj66usha74j8b086vjkrm9dp4j&timeAttemp=eccbc87e4b5ce2fe28308fd9f2a7baf3"; startswith; fast_pattern; http.host; content:"reative-sua-assinatura.fun"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014717; classtype:social-engineering; sid:6014717; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (httgaminileog.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"httgaminileog.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014718; classtype:social-engineering; sid:6014718; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rohitchaudhary99-eng.github.io/Amazon_Project)"; flow:established,to_server; http.uri; content:"/Amazon_Project"; startswith; fast_pattern; http.host; content:"rohitchaudhary99-eng.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014719; classtype:social-engineering; sid:6014719; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (assingment-approve.top/work/ask)"; flow:established,to_server; http.uri; content:"/work/ask"; startswith; fast_pattern; http.host; content:"assingment-approve.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014720; classtype:social-engineering; sid:6014720; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (radiorsj.be/baj/8bbd79a87f32bff/login.php#signin)"; flow:established,to_server; http.uri; content:"/baj/8bbd79a87f32bff/login.php#signin"; startswith; fast_pattern; http.host; content:"radiorsj.be"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014721; classtype:social-engineering; sid:6014721; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paybonuscooudmae.lovable.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paybonuscooudmae.lovable.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014722; classtype:social-engineering; sid:6014722; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ztedjdd.com/wap.html)"; flow:established,to_server; http.uri; content:"/wap.html"; startswith; fast_pattern; http.host; content:"ztedjdd.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014723; classtype:social-engineering; sid:6014723; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (assingment-approve.top/project/moment)"; flow:established,to_server; http.uri; content:"/project/moment"; startswith; fast_pattern; http.host; content:"assingment-approve.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014724; classtype:social-engineering; sid:6014724; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (serviciopacifico.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"serviciopacifico.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014725; classtype:social-engineering; sid:6014725; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (radiorsj.be/baj/67eeed88a9c1bcc/login.php)"; flow:established,to_server; http.uri; content:"/baj/67eeed88a9c1bcc/login.php"; startswith; fast_pattern; http.host; content:"radiorsj.be"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014726; classtype:social-engineering; sid:6014726; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiverr-clientpay.pro/work/ask)"; flow:established,to_server; http.uri; content:"/work/ask"; startswith; fast_pattern; http.host; content:"fiverr-clientpay.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014727; classtype:social-engineering; sid:6014727; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiverr-payment.help/project/Flverr)"; flow:established,to_server; http.uri; content:"/project/Flverr"; startswith; fast_pattern; http.host; content:"fiverr-payment.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014728; classtype:social-engineering; sid:6014728; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cclo.click/seek/zzzz63563535yvhxcvv3cytv8ubxbvxhbhvxhdjhbdvybdhvdybndnbbghhdgdhgdhgdghdsgnnnDDDDD556bhnkynkynhhjrftcfg4f4f44ewcoded231view231iiutybbuitbu.html)"; flow:established,to_server; http.uri; content:"/seek/zzzz63563535yvhxcvv3cytv8ubxbvxhbhvxhdjhbdvybdhvdybndnbbghhdgdhgdhgdghdsgnnnDDDDD556bhnkynkynhhjrftcfg4f4f44ewcoded231view231iiutybbuitbu.html"; startswith; fast_pattern; http.host; content:"cclo.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014729; classtype:social-engineering; sid:6014729; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (radiorsj.be/baj/613872afe942722/login.php)"; flow:established,to_server; http.uri; content:"/baj/613872afe942722/login.php"; startswith; fast_pattern; http.host; content:"radiorsj.be"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014730; classtype:social-engineering; sid:6014730; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiverr-order-payment.pro/project/Flverr)"; flow:established,to_server; http.uri; content:"/project/Flverr"; startswith; fast_pattern; http.host; content:"fiverr-order-payment.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014731; classtype:social-engineering; sid:6014731; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (in-posd.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"in-posd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014732; classtype:social-engineering; sid:6014732; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hire12.github.io/Apple-Bootstrap)"; flow:established,to_server; http.uri; content:"/Apple-Bootstrap"; startswith; fast_pattern; http.host; content:"hire12.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014733; classtype:social-engineering; sid:6014733; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (globalveln.com/object/978483)"; flow:established,to_server; http.uri; content:"/object/978483"; startswith; fast_pattern; http.host; content:"globalveln.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014734; classtype:social-engineering; sid:6014734; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8bezt5.cn/mmixosct)"; flow:established,to_server; http.uri; content:"/mmixosct"; startswith; fast_pattern; http.host; content:"8bezt5.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014735; classtype:social-engineering; sid:6014735; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tommytmg12.github.io/Discord)"; flow:established,to_server; http.uri; content:"/Discord"; startswith; fast_pattern; http.host; content:"tommytmg12.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014736; classtype:social-engineering; sid:6014736; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yr.tqgledd.net/pair/owa.html)"; flow:established,to_server; http.uri; content:"/pair/owa.html"; startswith; fast_pattern; http.host; content:"yr.tqgledd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014737; classtype:social-engineering; sid:6014737; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fankuver.top/view/states)"; flow:established,to_server; http.uri; content:"/view/states"; startswith; fast_pattern; http.host; content:"fankuver.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014738; classtype:social-engineering; sid:6014738; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (copper-carline-67.tiiny.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"copper-carline-67.tiiny.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014739; classtype:social-engineering; sid:6014739; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reative-sua-assinatura.fun/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"reative-sua-assinatura.fun"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014740; classtype:social-engineering; sid:6014740; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (guest.refassured.net/0jR7GEZ0/)"; flow:established,to_server; http.uri; content:"/0jR7GEZ0/"; startswith; fast_pattern; http.host; content:"guest.refassured.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014741; classtype:social-engineering; sid:6014741; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netlog.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netlog.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014742; classtype:social-engineering; sid:6014742; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ayush74-web.github.io/spotify-clone)"; flow:established,to_server; http.uri; content:"/spotify-clone"; startswith; fast_pattern; http.host; content:"ayush74-web.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014743; classtype:social-engineering; sid:6014743; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chandanagowri06-blip.github.io/amazon-homepage-clone)"; flow:established,to_server; http.uri; content:"/amazon-homepage-clone"; startswith; fast_pattern; http.host; content:"chandanagowri06-blip.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014744; classtype:social-engineering; sid:6014744; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-db02f7e3-d968-4688-bd32-db6821ddf048.cleverapps.io/sb/CHPASSALI-Bots/CHPASSALI-Bots/CHFINAL/eab95/)"; flow:established,to_server; http.uri; content:"/sb/CHPASSALI-Bots/CHPASSALI-Bots/CHFINAL/eab95/"; startswith; fast_pattern; http.host; content:"app-db02f7e3-d968-4688-bd32-db6821ddf048.cleverapps.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014745; classtype:social-engineering; sid:6014745; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (assignmentre.digital/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"assignmentre.digital"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014746; classtype:social-engineering; sid:6014746; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hotmailoutlook2026.iceiy.com/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"hotmailoutlook2026.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014747; classtype:social-engineering; sid:6014747; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (guest.refassured.com/0jR7GEZ0/)"; flow:established,to_server; http.uri; content:"/0jR7GEZ0/"; startswith; fast_pattern; http.host; content:"guest.refassured.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014748; classtype:social-engineering; sid:6014748; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jhtelc.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.jhtelc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014749; classtype:social-engineering; sid:6014749; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robinhoodwojak.life/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"robinhoodwojak.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014750; classtype:social-engineering; sid:6014750; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wordpress-212624-0.cloudclusters.net/2hVzVqY2R/sbbclient2/WTJSL3NiY/)"; flow:established,to_server; http.uri; content:"/2hVzVqY2R/sbbclient2/WTJSL3NiY/"; startswith; fast_pattern; http.host; content:"wordpress-212624-0.cloudclusters.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014751; classtype:social-engineering; sid:6014751; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wzfhgq.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.wzfhgq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014752; classtype:social-engineering; sid:6014752; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (radiorsj.be/baj/753378f575002af/login.php)"; flow:established,to_server; http.uri; content:"/baj/753378f575002af/login.php"; startswith; fast_pattern; http.host; content:"radiorsj.be"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014753; classtype:social-engineering; sid:6014753; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mails-safe.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mails-safe.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014754; classtype:social-engineering; sid:6014754; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-en-nndax.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sso-en-nndax.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014755; classtype:social-engineering; sid:6014755; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chaukhanh211.github.io/CoinTikTok)"; flow:established,to_server; http.uri; content:"/CoinTikTok"; startswith; fast_pattern; http.host; content:"chaukhanh211.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014756; classtype:social-engineering; sid:6014756; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (home-en-com-netcoin.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"home-en-com-netcoin.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014757; classtype:social-engineering; sid:6014757; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dhlpas.shop/pa)"; flow:established,to_server; http.uri; content:"/pa"; startswith; fast_pattern; http.host; content:"dhlpas.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014758; classtype:social-engineering; sid:6014758; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortprice.world/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortprice.world"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014759; classtype:social-engineering; sid:6014759; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d9y3-h22y-hwzb.eroberts-mtrncid-com-s-account.workers.dev/f3c0feb3e4553943?email=corenx@23e2d4c3b58932b452fa030bc84af38ffc9b.com/)"; flow:established,to_server; http.uri; content:"/f3c0feb3e4553943?email=corenx@23e2d4c3b58932b452fa030bc84af38ffc9b.com/"; startswith; fast_pattern; http.host; content:"d9y3-h22y-hwzb.eroberts-mtrncid-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014760; classtype:social-engineering; sid:6014760; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoja53.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoja53.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014761; classtype:social-engineering; sid:6014761; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ashumaver54-create.github.io/amazon_-layout-by-me)"; flow:established,to_server; http.uri; content:"/amazon_-layout-by-me"; startswith; fast_pattern; http.host; content:"ashumaver54-create.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014762; classtype:social-engineering; sid:6014762; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nya.meatings.se/ppw/korea.html)"; flow:established,to_server; http.uri; content:"/ppw/korea.html"; startswith; fast_pattern; http.host; content:"nya.meatings.se"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014763; classtype:social-engineering; sid:6014763; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ledger-liive-app.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ledger-liive-app.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014764; classtype:social-engineering; sid:6014764; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiverr-orders-pay.pro/view/states)"; flow:established,to_server; http.uri; content:"/view/states"; startswith; fast_pattern; http.host; content:"fiverr-orders-pay.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014765; classtype:social-engineering; sid:6014765; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (japi-trust.github.io/Apple-Boostrap-Clone-Master)"; flow:established,to_server; http.uri; content:"/Apple-Boostrap-Clone-Master"; startswith; fast_pattern; http.host; content:"japi-trust.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014766; classtype:social-engineering; sid:6014766; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booking-poc-ejr.pages.dev/haarlem_rfc_v5.html)"; flow:established,to_server; http.uri; content:"/haarlem_rfc_v5.html"; startswith; fast_pattern; http.host; content:"booking-poc-ejr.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014767; classtype:social-engineering; sid:6014767; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiverr-order-pay.pro/project/Flverr)"; flow:established,to_server; http.uri; content:"/project/Flverr"; startswith; fast_pattern; http.host; content:"fiverr-order-pay.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014768; classtype:social-engineering; sid:6014768; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fitfreebie.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fitfreebie.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014769; classtype:social-engineering; sid:6014769; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dtvbsu.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.dtvbsu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014770; classtype:social-engineering; sid:6014770; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (radiorsj.be/baj/)"; flow:established,to_server; http.uri; content:"/baj/"; startswith; fast_pattern; http.host; content:"radiorsj.be"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014771; classtype:social-engineering; sid:6014771; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.teamvf.com/p/fhw-obf/vedfrgtn/)"; flow:established,to_server; http.uri; content:"/p/fhw-obf/vedfrgtn/"; startswith; fast_pattern; http.host; content:"s.teamvf.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014772; classtype:social-engineering; sid:6014772; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-flverr.help/work/new-orders)"; flow:established,to_server; http.uri; content:"/work/new-orders"; startswith; fast_pattern; http.host; content:"app-flverr.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014773; classtype:social-engineering; sid:6014773; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon.i5k4n.com/jp/)"; flow:established,to_server; http.uri; content:"/jp/"; startswith; fast_pattern; http.host; content:"amazon.i5k4n.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014774; classtype:social-engineering; sid:6014774; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spectrum.hirevue-app.com/utilities/setTimeZone.aspx?url=%2fguest%2fce%2ffoyers%2fnow%2fEvent.aspx%3fssid%3d5884577%26h_ssid%3dQwym3Il6%252Bm2ISUFqiddemSyUz81fAzXkJmua3v%252F3zi9MyAHim60KiLAwP4KqxJ%252Bt8vliLJ%252Bf6PrmGyFh1qC%252F6Q%253D%253D)"; flow:established,to_server; http.uri; content:"/utilities/setTimeZone.aspx?url=%2fguest%2fce%2ffoyers%2fnow%2fEvent.aspx%3fssid%3d5884577%26h_ssid%3dQwym3Il6%252Bm2ISUFqiddemSyUz81fAzXkJmua3v%252F3zi9MyAHim60KiLAwP4KqxJ%252Bt8vliLJ%252Bf6PrmGyFh1qC%252F6Q%253D%253D"; startswith; fast_pattern; http.host; content:"spectrum.hirevue-app.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014775; classtype:social-engineering; sid:6014775; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiverr-orderpay.pro/project/mary4)"; flow:established,to_server; http.uri; content:"/project/mary4"; startswith; fast_pattern; http.host; content:"fiverr-orderpay.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014776; classtype:social-engineering; sid:6014776; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lordtech2.github.io/Bank)"; flow:established,to_server; http.uri; content:"/Bank"; startswith; fast_pattern; http.host; content:"lordtech2.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014777; classtype:social-engineering; sid:6014777; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (radiorsj.be/baj/ec54f77e5066186/login.php)"; flow:established,to_server; http.uri; content:"/baj/ec54f77e5066186/login.php"; startswith; fast_pattern; http.host; content:"radiorsj.be"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014778; classtype:social-engineering; sid:6014778; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (radiorsj.be/baj/744571e270e5114/login.php)"; flow:established,to_server; http.uri; content:"/baj/744571e270e5114/login.php"; startswith; fast_pattern; http.host; content:"radiorsj.be"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014779; classtype:social-engineering; sid:6014779; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.localizar-entrega.top/shop/)"; flow:established,to_server; http.uri; content:"/shop/"; startswith; fast_pattern; http.host; content:"www.localizar-entrega.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014780; classtype:social-engineering; sid:6014780; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (momomoo34.github.io/coinsd)"; flow:established,to_server; http.uri; content:"/coinsd"; startswith; fast_pattern; http.host; content:"momomoo34.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014781; classtype:social-engineering; sid:6014781; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hghdhjd.42web.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hghdhjd.42web.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014782; classtype:social-engineering; sid:6014782; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (honour.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"honour.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014783; classtype:social-engineering; sid:6014783; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wqnptf.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.wqnptf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014784; classtype:social-engineering; sid:6014784; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwl.soycreativo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wwl.soycreativo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014785; classtype:social-engineering; sid:6014785; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (radiorsj.be/baj/1c64c00e7b063e6/login.php)"; flow:established,to_server; http.uri; content:"/baj/1c64c00e7b063e6/login.php"; startswith; fast_pattern; http.host; content:"radiorsj.be"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014786; classtype:social-engineering; sid:6014786; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.team-xk.com/p/fhtb-mrgw/nwjrmgwv/)"; flow:established,to_server; http.uri; content:"/p/fhtb-mrgw/nwjrmgwv/"; startswith; fast_pattern; http.host; content:"s.team-xk.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014787; classtype:social-engineering; sid:6014787; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (first-order.top/project/Flverr)"; flow:established,to_server; http.uri; content:"/project/Flverr"; startswith; fast_pattern; http.host; content:"first-order.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014788; classtype:social-engineering; sid:6014788; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (biomederp.com/adm/adt/adv)"; flow:established,to_server; http.uri; content:"/adm/adt/adv"; startswith; fast_pattern; http.host; content:"biomederp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014789; classtype:social-engineering; sid:6014789; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (homebest.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"homebest.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014790; classtype:social-engineering; sid:6014790; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiverr-order-payment.pro/work/new-orders)"; flow:established,to_server; http.uri; content:"/work/new-orders"; startswith; fast_pattern; http.host; content:"fiverr-order-payment.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014791; classtype:social-engineering; sid:6014791; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kartiksinghks2005-arch.github.io/Amazon_clone/)"; flow:established,to_server; http.uri; content:"/Amazon_clone/"; startswith; fast_pattern; http.host; content:"kartiksinghks2005-arch.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014792; classtype:social-engineering; sid:6014792; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ayudas-gestion-anulares.infy.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ayudas-gestion-anulares.infy.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014793; classtype:social-engineering; sid:6014793; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.ie-place.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.ie-place.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014794; classtype:social-engineering; sid:6014794; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dthecourierguy.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dthecourierguy.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014795; classtype:social-engineering; sid:6014795; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ibnkva.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.ibnkva.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014796; classtype:social-engineering; sid:6014796; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faq-begin-trezorio-us.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"faq-begin-trezorio-us.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014797; classtype:social-engineering; sid:6014797; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.4fvj23.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.4fvj23.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014798; classtype:social-engineering; sid:6014798; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abhiramk18.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"abhiramk18.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014799; classtype:social-engineering; sid:6014799; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sornak.casa/credi0099)"; flow:established,to_server; http.uri; content:"/credi0099"; startswith; fast_pattern; http.host; content:"sornak.casa"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014800; classtype:social-engineering; sid:6014800; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.ie-delivery.cfd/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd.ie-delivery.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014801; classtype:social-engineering; sid:6014801; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apple6b9d2d28c045413a97dcffe33c170e2a.4s4dc3.cn/applefaa5e0bb04684676b38e53d64d601c6b)"; flow:established,to_server; http.uri; content:"/applefaa5e0bb04684676b38e53d64d601c6b"; startswith; fast_pattern; http.host; content:"apple6b9d2d28c045413a97dcffe33c170e2a.4s4dc3.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014802; classtype:social-engineering; sid:6014802; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (radiorsj.be/baj/927aa49403322b0/login.php)"; flow:established,to_server; http.uri; content:"/baj/927aa49403322b0/login.php"; startswith; fast_pattern; http.host; content:"radiorsj.be"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014803; classtype:social-engineering; sid:6014803; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.clone-facebook-alpha.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.clone-facebook-alpha.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014804; classtype:social-engineering; sid:6014804; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stopngochicken.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"stopngochicken.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014805; classtype:social-engineering; sid:6014805; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sayak-op.github.io/airbnb-clone)"; flow:established,to_server; http.uri; content:"/airbnb-clone"; startswith; fast_pattern; http.host; content:"sayak-op.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014806; classtype:social-engineering; sid:6014806; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.h5-sbetsports.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.h5-sbetsports.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014807; classtype:social-engineering; sid:6014807; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enlacesantander.mx2335.cfd/LOGBET_ENS/enlace.php?dse_operationName=login&dse_nextEventName=start&dse_processorState=initial&nowCheckingCookies=1624361310949)"; flow:established,to_server; http.uri; content:"/LOGBET_ENS/enlace.php?dse_operationName=login&dse_nextEventName=start&dse_processorState=initial&nowCheckingCookies=1624361310949"; startswith; fast_pattern; http.host; content:"enlacesantander.mx2335.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014808; classtype:social-engineering; sid:6014808; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fankuver.top/view/lk)"; flow:established,to_server; http.uri; content:"/view/lk"; startswith; fast_pattern; http.host; content:"fankuver.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014809; classtype:social-engineering; sid:6014809; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apple204797a7901743bf88326c2be2d7806e.4fvj23.cn/apple006ca8aaa93347169e3182159b5d3d41)"; flow:established,to_server; http.uri; content:"/apple006ca8aaa93347169e3182159b5d3d41"; startswith; fast_pattern; http.host; content:"apple204797a7901743bf88326c2be2d7806e.4fvj23.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014810; classtype:social-engineering; sid:6014810; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mjwplk.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.mjwplk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014811; classtype:social-engineering; sid:6014811; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafybeigvhkndbrfme6cbhe4vnxrshzowhlb35tgmud4ntc7murhr5rnwne.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafybeigvhkndbrfme6cbhe4vnxrshzowhlb35tgmud4ntc7murhr5rnwne.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014812; classtype:social-engineering; sid:6014812; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nileshparmar2361.github.io/netflix-landing-page/)"; flow:established,to_server; http.uri; content:"/netflix-landing-page/"; startswith; fast_pattern; http.host; content:"nileshparmar2361.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014813; classtype:social-engineering; sid:6014813; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinityrefunds.com/token/092BB67ED1C3478C82728EEA5C53B3FB)"; flow:established,to_server; http.uri; content:"/token/092BB67ED1C3478C82728EEA5C53B3FB"; startswith; fast_pattern; http.host; content:"xfinityrefunds.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014814; classtype:social-engineering; sid:6014814; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fortnityy.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fortnityy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014815; classtype:social-engineering; sid:6014815; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiverr-orders-pay.pro/project/katy2)"; flow:established,to_server; http.uri; content:"/project/katy2"; startswith; fast_pattern; http.host; content:"fiverr-orders-pay.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014816; classtype:social-engineering; sid:6014816; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.insta-clone-johnatanivini.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.insta-clone-johnatanivini.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014817; classtype:social-engineering; sid:6014817; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zhangcn968.bitbucket.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zhangcn968.bitbucket.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014818; classtype:social-engineering; sid:6014818; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-db02f7e3-d968-4688-bd32-db6821ddf048.cleverapps.io/sb/CHPASSALI-Bots/CHPASSALI-Bots/CHFINAL/)"; flow:established,to_server; http.uri; content:"/sb/CHPASSALI-Bots/CHPASSALI-Bots/CHFINAL/"; startswith; fast_pattern; http.host; content:"app-db02f7e3-d968-4688-bd32-db6821ddf048.cleverapps.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014819; classtype:social-engineering; sid:6014819; rev:1; metadata: signature_severity Major, created_et 2026_06_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalne.prywant8492119.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalne.prywant8492119.xyz"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014820; classtype:social-engineering; sid:6014820; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.ifoert4389712.baby/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalnie.ifoert4389712.baby"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014821; classtype:social-engineering; sid:6014821; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toplukonuthemenbasvuru.sbs/giris.php)"; flow:established,to_server; http.uri; content:"/giris.php"; startswith; fast_pattern; http.host; content:"toplukonuthemenbasvuru.sbs"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014822; classtype:social-engineering; sid:6014822; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webxtestsolve.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webxtestsolve.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014823; classtype:social-engineering; sid:6014823; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ernflngftsvb-online.top/?secure_connect=2v41*fc*&_subid=1sd8jpm.53.1fnqq&_token=kme11l3153u2.1782026672.29.d3b67c6bb38df2339025f515ac30c3bd)"; flow:established,to_server; http.uri; content:"/?secure_connect=2v41*fc*&_subid=1sd8jpm.53.1fnqq&_token=kme11l3153u2.1782026672.29.d3b67c6bb38df2339025f515ac30c3bd"; startswith; fast_pattern; http.host; content:"ernflngftsvb-online.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014824; classtype:social-engineering; sid:6014824; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dfjgdjfgjrjdkgdjfgjrkdkfgkjdfgrdf-8479.twil.io/fjgfkjghkfght.html)"; flow:established,to_server; http.uri; content:"/fjgfkjghkfght.html"; startswith; fast_pattern; http.host; content:"dfjgdjfgjrjdkgdjfgjrkdkfgkjdfgrdf-8479.twil.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014825; classtype:social-engineering; sid:6014825; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-9g1gujotw.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-9g1gujotw.godaddysites.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014826; classtype:social-engineering; sid:6014826; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.smar8t473291.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalnie.smar8t473291.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014827; classtype:social-engineering; sid:6014827; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mjour.info/361519)"; flow:established,to_server; http.uri; content:"/361519"; startswith; fast_pattern; http.host; content:"mjour.info"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014828; classtype:social-engineering; sid:6014828; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my-pntfp.icu/?secure_connect=uj2*fc*&_subid=1sd8jpm.33.1fnrq&_token=kme11l3153u2.1782026672.31.a8e6686ad3d637a8e70f587c54d7d0f9)"; flow:established,to_server; http.uri; content:"/?secure_connect=uj2*fc*&_subid=1sd8jpm.33.1fnrq&_token=kme11l3153u2.1782026672.31.a8e6686ad3d637a8e70f587c54d7d0f9"; startswith; fast_pattern; http.host; content:"my-pntfp.icu"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014829; classtype:social-engineering; sid:6014829; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web.tegktv.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web.tegktv.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014830; classtype:social-engineering; sid:6014830; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nbdfjgdjfgjrjdfgdfgrdfg-4653.twil.io/kfghkfttt.html)"; flow:established,to_server; http.uri; content:"/kfghkfttt.html"; startswith; fast_pattern; http.host; content:"nbdfjgdjfgjrjdfgdfgrdfg-4653.twil.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014831; classtype:social-engineering; sid:6014831; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (actual348bhd49.yzz.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"actual348bhd49.yzz.me"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014832; classtype:social-engineering; sid:6014832; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (advanwx-redirect.s3.us-east-1.amazonaws.com/apobz.html)"; flow:established,to_server; http.uri; content:"/apobz.html"; startswith; fast_pattern; http.host; content:"advanwx-redirect.s3.us-east-1.amazonaws.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014833; classtype:social-engineering; sid:6014833; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (home-tr-z-r-suite-us.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"home-tr-z-r-suite-us.typedream.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014834; classtype:social-engineering; sid:6014834; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (public-io-trzer-wallet.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"public-io-trzer-wallet.typedream.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6014835; classtype:social-engineering; sid:6014835; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.yuhongxx.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.yuhongxx.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014836; classtype:social-engineering; sid:6014836; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spectrummailhgfd.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spectrummailhgfd.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014837; classtype:social-engineering; sid:6014837; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kmyf-web-whatsapp.hk.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kmyf-web-whatsapp.hk.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014838; classtype:social-engineering; sid:6014838; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.teams-ei.com/p/fjbd-cbcr/xnmxgmvs)"; flow:established,to_server; http.uri; content:"/p/fjbd-cbcr/xnmxgmvs"; startswith; fast_pattern; http.host; content:"s.teams-ei.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014839; classtype:social-engineering; sid:6014839; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (his-examine-armor-nascar.trycloudflare.com/login.html/)"; flow:established,to_server; http.uri; content:"/login.html/"; startswith; fast_pattern; http.host; content:"his-examine-armor-nascar.trycloudflare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014840; classtype:social-engineering; sid:6014840; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingyo.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingyo.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014841; classtype:social-engineering; sid:6014841; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (harshavardhan3535.github.io/netflix-ui-clone/)"; flow:established,to_server; http.uri; content:"/netflix-ui-clone/"; startswith; fast_pattern; http.host; content:"harshavardhan3535.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014842; classtype:social-engineering; sid:6014842; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atmotv.github.io/WebStream/)"; flow:established,to_server; http.uri; content:"/WebStream/"; startswith; fast_pattern; http.host; content:"atmotv.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014843; classtype:social-engineering; sid:6014843; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2ft4.github.io/log_in_acount/)"; flow:established,to_server; http.uri; content:"/log_in_acount/"; startswith; fast_pattern; http.host; content:"2ft4.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014844; classtype:social-engineering; sid:6014844; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.okrwjf.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.okrwjf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014845; classtype:social-engineering; sid:6014845; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metanet-configuration-domain-serviceid9626.vidiglass.it/Metanet/fb717a13fd29966473b1158a984ad69e/?fb717a13fd29966473b1158a984ad69e=w2Et4cVf9CH&payer)"; flow:established,to_server; http.uri; content:"/Metanet/fb717a13fd29966473b1158a984ad69e/?fb717a13fd29966473b1158a984ad69e=w2Et4cVf9CH&payer"; startswith; fast_pattern; http.host; content:"metanet-configuration-domain-serviceid9626.vidiglass.it"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014846; classtype:social-engineering; sid:6014846; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtm.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingtm.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014847; classtype:social-engineering; sid:6014847; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (new.radwoodfilms.com/ap/signin)"; flow:established,to_server; http.uri; content:"/ap/signin"; startswith; fast_pattern; http.host; content:"new.radwoodfilms.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014848; classtype:social-engineering; sid:6014848; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.naziko.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.naziko.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014849; classtype:social-engineering; sid:6014849; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (home-100290.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"home-100290.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014850; classtype:social-engineering; sid:6014850; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingya.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingya.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014851; classtype:social-engineering; sid:6014851; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myfidelitysite.com/upmc)"; flow:established,to_server; http.uri; content:"/upmc"; startswith; fast_pattern; http.host; content:"myfidelitysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014852; classtype:social-engineering; sid:6014852; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cpcalendars.165-227-27-180.cprapid.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cpcalendars.165-227-27-180.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014853; classtype:social-engineering; sid:6014853; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apurbashee-11.github.io/spotify-clone)"; flow:established,to_server; http.uri; content:"/spotify-clone"; startswith; fast_pattern; http.host; content:"apurbashee-11.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014854; classtype:social-engineering; sid:6014854; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (keerat1951.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"keerat1951.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014855; classtype:social-engineering; sid:6014855; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.js7598.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.js7598.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014856; classtype:social-engineering; sid:6014856; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bet1992.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bet1992.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014857; classtype:social-engineering; sid:6014857; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xcatrfgav.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xcatrfgav.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014858; classtype:social-engineering; sid:6014858; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiverr-orders-payment.help/project/mary5)"; flow:established,to_server; http.uri; content:"/project/mary5"; startswith; fast_pattern; http.host; content:"fiverr-orders-payment.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014859; classtype:social-engineering; sid:6014859; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gh7f6hfmj8v.gthcyexikcfremhbrc.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gh7f6hfmj8v.gthcyexikcfremhbrc.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014860; classtype:social-engineering; sid:6014860; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prachikushwaha34.github.io/netflixclone/)"; flow:established,to_server; http.uri; content:"/netflixclone/"; startswith; fast_pattern; http.host; content:"prachikushwaha34.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014861; classtype:social-engineering; sid:6014861; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.webfun.website/landingpages/fe996bbf-3dce-487c-acd3-4a69200fa8a0/dmushm7cirtej6cjlv3ip3hmyar0lmwdfjsmgio69ik)"; flow:established,to_server; http.uri; content:"/landingpages/fe996bbf-3dce-487c-acd3-4a69200fa8a0/dmushm7cirtej6cjlv3ip3hmyar0lmwdfjsmgio69ik"; startswith; fast_pattern; http.host; content:"www.webfun.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014862; classtype:social-engineering; sid:6014862; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.stopngochicken.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.stopngochicken.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014863; classtype:social-engineering; sid:6014863; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help-io-star-t-trezo-or-en.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"help-io-star-t-trezo-or-en.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014864; classtype:social-engineering; sid:6014864; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dhruvjha23.github.io/Airbnb-Clone)"; flow:established,to_server; http.uri; content:"/Airbnb-Clone"; startswith; fast_pattern; http.host; content:"dhruvjha23.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014865; classtype:social-engineering; sid:6014865; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fanciersprout-o7rxov.stormkit.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fanciersprout-o7rxov.stormkit.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014866; classtype:social-engineering; sid:6014866; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingyg.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingyg.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014867; classtype:social-engineering; sid:6014867; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-io-trezo.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"info-io-trezo.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014868; classtype:social-engineering; sid:6014868; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atakilit-git.github.io/Apple-bootstrap)"; flow:established,to_server; http.uri; content:"/Apple-bootstrap"; startswith; fast_pattern; http.host; content:"atakilit-git.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014869; classtype:social-engineering; sid:6014869; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robin-ui.github.io/Apple-india)"; flow:established,to_server; http.uri; content:"/Apple-india"; startswith; fast_pattern; http.host; content:"robin-ui.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014870; classtype:social-engineering; sid:6014870; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hiythamali.github.io/netflix)"; flow:established,to_server; http.uri; content:"/netflix"; startswith; fast_pattern; http.host; content:"hiythamali.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014871; classtype:social-engineering; sid:6014871; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shreyansh3223.github.io/spotify-web-clone)"; flow:established,to_server; http.uri; content:"/spotify-web-clone"; startswith; fast_pattern; http.host; content:"shreyansh3223.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014872; classtype:social-engineering; sid:6014872; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365756amylzz.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"365756amylzz.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014873; classtype:social-engineering; sid:6014873; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtn.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingtn.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014874; classtype:social-engineering; sid:6014874; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ledgerwalletnewrelease.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ledgerwalletnewrelease.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014875; classtype:social-engineering; sid:6014875; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiverr-orders-payment.help/work/new-orders)"; flow:established,to_server; http.uri; content:"/work/new-orders"; startswith; fast_pattern; http.host; content:"fiverr-orders-payment.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014876; classtype:social-engineering; sid:6014876; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.klbqst.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.klbqst.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014877; classtype:social-engineering; sid:6014877; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (servicesupport-i.cloud/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"servicesupport-i.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014878; classtype:social-engineering; sid:6014878; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fariskt.github.io/airbnb-clone)"; flow:established,to_server; http.uri; content:"/airbnb-clone"; startswith; fast_pattern; http.host; content:"fariskt.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014879; classtype:social-engineering; sid:6014879; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5237-mests.github.io/apple.com-replica-using-bootsrap)"; flow:established,to_server; http.uri; content:"/apple.com-replica-using-bootsrap"; startswith; fast_pattern; http.host; content:"5237-mests.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014880; classtype:social-engineering; sid:6014880; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vkrlin.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.vkrlin.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014881; classtype:social-engineering; sid:6014881; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (86365kk.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"86365kk.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014882; classtype:social-engineering; sid:6014882; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (72dcbo.cn/mmixosct/)"; flow:established,to_server; http.uri; content:"/mmixosct/"; startswith; fast_pattern; http.host; content:"72dcbo.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014883; classtype:social-engineering; sid:6014883; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiverr-orders-sale.pro/work/new-orders)"; flow:established,to_server; http.uri; content:"/work/new-orders"; startswith; fast_pattern; http.host; content:"fiverr-orders-sale.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014884; classtype:social-engineering; sid:6014884; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kpxcia.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.kpxcia.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014885; classtype:social-engineering; sid:6014885; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingyr.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingyr.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014886; classtype:social-engineering; sid:6014886; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365756amylzz.com/index_m.html)"; flow:established,to_server; http.uri; content:"/index_m.html"; startswith; fast_pattern; http.host; content:"365756amylzz.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014887; classtype:social-engineering; sid:6014887; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingyq.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingyq.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014888; classtype:social-engineering; sid:6014888; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (krishnasoni260207.github.io/Amazon-clone)"; flow:established,to_server; http.uri; content:"/Amazon-clone"; startswith; fast_pattern; http.host; content:"krishnasoni260207.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014889; classtype:social-engineering; sid:6014889; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gocupq.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.gocupq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014890; classtype:social-engineering; sid:6014890; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ultimateguide.info/reference5/?u=97C1466&e=torio7@41bb9b22ce2c246d5819bc5f4c16a406d584.org&s3=Joanna&s4=Ginalska&s5=&s6=&s7=&s8=&f=m3SawX2HnmKBtmCrm5p0fn2dppd_oHJ3rw)"; flow:established,to_server; http.uri; content:"/reference5/?u=97C1466&e=torio7@41bb9b22ce2c246d5819bc5f4c16a406d584.org&s3=Joanna&s4=Ginalska&s5=&s6=&s7=&s8=&f=m3SawX2HnmKBtmCrm5p0fn2dppd_oHJ3rw"; startswith; fast_pattern; http.host; content:"ultimateguide.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014891; classtype:social-engineering; sid:6014891; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiverr-orders-payment.help/work/ask)"; flow:established,to_server; http.uri; content:"/work/ask"; startswith; fast_pattern; http.host; content:"fiverr-orders-payment.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014892; classtype:social-engineering; sid:6014892; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thebossman400.github.io/Instagramclone)"; flow:established,to_server; http.uri; content:"/Instagramclone"; startswith; fast_pattern; http.host; content:"thebossman400.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014893; classtype:social-engineering; sid:6014893; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1nqp0tkpprvjg77.be7bnq.cfd/i/et09y/7298914081673472#selectedba)"; flow:established,to_server; http.uri; content:"/i/et09y/7298914081673472#selectedba"; startswith; fast_pattern; http.host; content:"1nqp0tkpprvjg77.be7bnq.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014894; classtype:social-engineering; sid:6014894; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tianjincaogang.com/ap/signin)"; flow:established,to_server; http.uri; content:"/ap/signin"; startswith; fast_pattern; http.host; content:"tianjincaogang.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014895; classtype:social-engineering; sid:6014895; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.soporte-gob.es/?keyname=SlyYu3P)"; flow:established,to_server; http.uri; content:"/?keyname=SlyYu3P"; startswith; fast_pattern; http.host; content:"login.soporte-gob.es"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014896; classtype:social-engineering; sid:6014896; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.biblesignals.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.biblesignals.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014897; classtype:social-engineering; sid:6014897; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bhanutejareddy968.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"bhanutejareddy968.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014898; classtype:social-engineering; sid:6014898; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jihadur.com/10/xifix/xinfini)"; flow:established,to_server; http.uri; content:"/10/xifix/xinfini"; startswith; fast_pattern; http.host; content:"jihadur.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014899; classtype:social-engineering; sid:6014899; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (truonghoanglien2007-spec.github.io/amazon-web)"; flow:established,to_server; http.uri; content:"/amazon-web"; startswith; fast_pattern; http.host; content:"truonghoanglien2007-spec.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014900; classtype:social-engineering; sid:6014900; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usa.amazonamir.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"usa.amazonamir.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014901; classtype:social-engineering; sid:6014901; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (santander.es.app.aviso2.mydomain.zone/stvm/login.php)"; flow:established,to_server; http.uri; content:"/stvm/login.php"; startswith; fast_pattern; http.host; content:"santander.es.app.aviso2.mydomain.zone"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014902; classtype:social-engineering; sid:6014902; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingyt.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingyt.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014903; classtype:social-engineering; sid:6014903; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezorawlalet.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezorawlalet.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014904; classtype:social-engineering; sid:6014904; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kanak-tech.github.io/Responsive-Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Responsive-Amazon-Clone/"; startswith; fast_pattern; http.host; content:"kanak-tech.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014905; classtype:social-engineering; sid:6014905; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lyningli.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lyningli.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014906; classtype:social-engineering; sid:6014906; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ortan.ru/vendor/ralouphie/getallcookies/)"; flow:established,to_server; http.uri; content:"/vendor/ralouphie/getallcookies/"; startswith; fast_pattern; http.host; content:"www.ortan.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014907; classtype:social-engineering; sid:6014907; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c365kvip.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c365kvip.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014908; classtype:social-engineering; sid:6014908; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingyo.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingyo.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014909; classtype:social-engineering; sid:6014909; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingyu.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingyu.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014910; classtype:social-engineering; sid:6014910; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiverr-orders-payment.help/project/mary4)"; flow:established,to_server; http.uri; content:"/project/mary4"; startswith; fast_pattern; http.host; content:"fiverr-orders-payment.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014911; classtype:social-engineering; sid:6014911; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spify-mex.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spify-mex.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014912; classtype:social-engineering; sid:6014912; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingyg.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingyg.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014913; classtype:social-engineering; sid:6014913; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deepakkushwaha0422.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"deepakkushwaha0422.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014914; classtype:social-engineering; sid:6014914; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gvesjo.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.gvesjo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014915; classtype:social-engineering; sid:6014915; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kv-nandhu.github.io/apple)"; flow:established,to_server; http.uri; content:"/apple"; startswith; fast_pattern; http.host; content:"kv-nandhu.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014916; classtype:social-engineering; sid:6014916; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.teams-ic.com/p/fjbd-cbcr/xzkpaqni)"; flow:established,to_server; http.uri; content:"/p/fjbd-cbcr/xzkpaqni"; startswith; fast_pattern; http.host; content:"s.teams-ic.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014917; classtype:social-engineering; sid:6014917; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (his-examine-armor-nascar.trycloudflare.com/login.html)"; flow:established,to_server; http.uri; content:"/login.html"; startswith; fast_pattern; http.host; content:"his-examine-armor-nascar.trycloudflare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014918; classtype:social-engineering; sid:6014918; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.skvdtu.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.skvdtu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014919; classtype:social-engineering; sid:6014919; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (actual348bhd49.yzz.me/?i=2)"; flow:established,to_server; http.uri; content:"/?i=2"; startswith; fast_pattern; http.host; content:"actual348bhd49.yzz.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014920; classtype:social-engineering; sid:6014920; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apple5a277ebfbad8462c9c6d0f2380520d41.5eg94f.cn/apple2a299f185a284ad185001d531e75c0df)"; flow:established,to_server; http.uri; content:"/apple2a299f185a284ad185001d531e75c0df"; startswith; fast_pattern; http.host; content:"apple5a277ebfbad8462c9c6d0f2380520d41.5eg94f.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014921; classtype:social-engineering; sid:6014921; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingye.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingye.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014922; classtype:social-engineering; sid:6014922; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ruqayyafatema-ops.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"ruqayyafatema-ops.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014923; classtype:social-engineering; sid:6014923; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (biblesignals.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"biblesignals.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014924; classtype:social-engineering; sid:6014924; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (siddhartha-sharmaa.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"siddhartha-sharmaa.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014925; classtype:social-engineering; sid:6014925; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingyy.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingyy.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014926; classtype:social-engineering; sid:6014926; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toplukonuthemenbasvuru.sbs/giris.php)"; flow:established,to_server; http.uri; content:"/giris.php"; startswith; fast_pattern; http.host; content:"toplukonuthemenbasvuru.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014927; classtype:social-engineering; sid:6014927; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hub-coinbase-wallet-extn.gitbook.io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"hub-coinbase-wallet-extn.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014928; classtype:social-engineering; sid:6014928; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (conseilspro.com/nl/app)"; flow:established,to_server; http.uri; content:"/nl/app"; startswith; fast_pattern; http.host; content:"conseilspro.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014929; classtype:social-engineering; sid:6014929; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingye.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingye.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014930; classtype:social-engineering; sid:6014930; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trerznriostart.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trerznriostart.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014931; classtype:social-engineering; sid:6014931; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezr-home-login.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezr-home-login.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014932; classtype:social-engineering; sid:6014932; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dirge-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.dirge-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014933; classtype:social-engineering; sid:6014933; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toki2006-vercel.vercel.app/giris.php)"; flow:established,to_server; http.uri; content:"/giris.php"; startswith; fast_pattern; http.host; content:"toki2006-vercel.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014934; classtype:social-engineering; sid:6014934; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (royamaildelivery.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"royamaildelivery.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014935; classtype:social-engineering; sid:6014935; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreifm5v2lbfpkifubdvv2qyamasb5kaeg6vzo7zvxotvjmygaq7ylka.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreifm5v2lbfpkifubdvv2qyamasb5kaeg6vzo7zvxotvjmygaq7ylka.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014936; classtype:social-engineering; sid:6014936; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fapp1.olacabs.com/IZAGCU?id=24897=dUsCVQEMCFsFTlEPAAYHUQNWUVRUC1cKXlIFB1QBUlcCDgFWCg8JBFZUVAFQVAZSAQIZCFpAVwYmXA5GDlILDhhRQBkCDwhTCgsGDgQEBgUGVF1SD08LRhJEWx1MVQMSRgYcCl9ZUwNQQRxaXV8YfmgnIiFjDApWGkJS&fl=XkNGFUACH01ZQkFKV0BBXlEDFkxQQUx8JxtTC1QcEAdSXg==)"; flow:established,to_server; http.uri; content:"/IZAGCU?id=24897=dUsCVQEMCFsFTlEPAAYHUQNWUVRUC1cKXlIFB1QBUlcCDgFWCg8JBFZUVAFQVAZSAQIZCFpAVwYmXA5GDlILDhhRQBkCDwhTCgsGDgQEBgUGVF1SD08LRhJEWx1MVQMSRgYcCl9ZUwNQQRxaXV8YfmgnIiFjDApWGkJS&fl=XkNGFUACH01ZQkFKV0BBXlEDFkxQQUx8JxtTC1QcEAdSXg=="; startswith; fast_pattern; http.host; content:"fapp1.olacabs.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014937; classtype:social-engineering; sid:6014937; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hub-coinbase-wallet-extn.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hub-coinbase-wallet-extn.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014938; classtype:social-engineering; sid:6014938; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.wzyuanyuan.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.wzyuanyuan.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014939; classtype:social-engineering; sid:6014939; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atulxss.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"atulxss.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014940; classtype:social-engineering; sid:6014940; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingyu.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingyu.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014941; classtype:social-engineering; sid:6014941; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.m-kokosports.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.m-kokosports.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014942; classtype:social-engineering; sid:6014942; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.iaftlb.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.iaftlb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014943; classtype:social-engineering; sid:6014943; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smamuga.sidikmu.com/files/ali/alibaba/index.html)"; flow:established,to_server; http.uri; content:"/files/ali/alibaba/index.html"; startswith; fast_pattern; http.host; content:"smamuga.sidikmu.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014944; classtype:social-engineering; sid:6014944; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yisoubooks.com/wp-admin/.wp-languages/.wjpl95qv_mlr.php)"; flow:established,to_server; http.uri; content:"/wp-admin/.wp-languages/.wjpl95qv_mlr.php"; startswith; fast_pattern; http.host; content:"yisoubooks.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014945; classtype:social-engineering; sid:6014945; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (neat-retention-846400.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"neat-retention-846400.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014946; classtype:social-engineering; sid:6014946; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingyw.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingyw.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014947; classtype:social-engineering; sid:6014947; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezor-wallet-overview.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezor-wallet-overview.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014948; classtype:social-engineering; sid:6014948; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usa.amazonamir.shop/en-us/)"; flow:established,to_server; http.uri; content:"/en-us/"; startswith; fast_pattern; http.host; content:"usa.amazonamir.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014949; classtype:social-engineering; sid:6014949; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.aukcja53725.cfd/oferta/bmw-e46-320d/73441)"; flow:established,to_server; http.uri; content:"/oferta/bmw-e46-320d/73441"; startswith; fast_pattern; http.host; content:"allegrolokalnie.aukcja53725.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014950; classtype:social-engineering; sid:6014950; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.amscgo.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.amscgo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014951; classtype:social-engineering; sid:6014951; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (conseilspro.com/products.html)"; flow:established,to_server; http.uri; content:"/products.html"; startswith; fast_pattern; http.host; content:"conseilspro.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014952; classtype:social-engineering; sid:6014952; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hassank10.github.io/Apple-Clone)"; flow:established,to_server; http.uri; content:"/Apple-Clone"; startswith; fast_pattern; http.host; content:"hassank10.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014953; classtype:social-engineering; sid:6014953; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (expanded-candidate-299136.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"expanded-candidate-299136.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014954; classtype:social-engineering; sid:6014954; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.js7328.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.js7328.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014955; classtype:social-engineering; sid:6014955; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wzljni.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.wzljni.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014956; classtype:social-engineering; sid:6014956; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yassinebarouda0-blip.github.io/instagram/)"; flow:established,to_server; http.uri; content:"/instagram/"; startswith; fast_pattern; http.host; content:"yassinebarouda0-blip.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014957; classtype:social-engineering; sid:6014957; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.teamtm.world/p/kqg-qsn/ikmjpwgr)"; flow:established,to_server; http.uri; content:"/p/kqg-qsn/ikmjpwgr"; startswith; fast_pattern; http.host; content:"s.teamtm.world"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014958; classtype:social-engineering; sid:6014958; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiverr-orders-sale.pro/project/mary2)"; flow:established,to_server; http.uri; content:"/project/mary2"; startswith; fast_pattern; http.host; content:"fiverr-orders-sale.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014959; classtype:social-engineering; sid:6014959; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tesentia.de/Atelierstoneage/)"; flow:established,to_server; http.uri; content:"/Atelierstoneage/"; startswith; fast_pattern; http.host; content:"tesentia.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014960; classtype:social-engineering; sid:6014960; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-uphold-cloud.tem3.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sso-uphold-cloud.tem3.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014961; classtype:social-engineering; sid:6014961; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingyy.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingyy.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014962; classtype:social-engineering; sid:6014962; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sahkib159.github.io/Amazon-Clone-Website)"; flow:established,to_server; http.uri; content:"/Amazon-Clone-Website"; startswith; fast_pattern; http.host; content:"sahkib159.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014963; classtype:social-engineering; sid:6014963; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (soumyadip718.github.io/Amazon-Clone)"; flow:established,to_server; http.uri; content:"/Amazon-Clone"; startswith; fast_pattern; http.host; content:"soumyadip718.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014964; classtype:social-engineering; sid:6014964; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (home-tr-z-r-suite-us.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"home-tr-z-r-suite-us.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014965; classtype:social-engineering; sid:6014965; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5237-mests.github.io/apple.com-replica-using-bootsrap/)"; flow:established,to_server; http.uri; content:"/apple.com-replica-using-bootsrap/"; startswith; fast_pattern; http.host; content:"5237-mests.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014966; classtype:social-engineering; sid:6014966; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.teams-ea.com/p/fjbd-cbcr/fjvesdvj)"; flow:established,to_server; http.uri; content:"/p/fjbd-cbcr/fjvesdvj"; startswith; fast_pattern; http.host; content:"s.teams-ea.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014967; classtype:social-engineering; sid:6014967; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rabia-irshad2.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"rabia-irshad2.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014968; classtype:social-engineering; sid:6014968; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.live.com.outlook-adminnotifications.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"login.live.com.outlook-adminnotifications.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014969; classtype:social-engineering; sid:6014969; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (svnbancolombia.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"svnbancolombia.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014970; classtype:social-engineering; sid:6014970; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bhanutejareddy968.github.io/AMAZON-PROJECT)"; flow:established,to_server; http.uri; content:"/AMAZON-PROJECT"; startswith; fast_pattern; http.host; content:"bhanutejareddy968.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014971; classtype:social-engineering; sid:6014971; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (botuque-homes9811.com/63616/)"; flow:established,to_server; http.uri; content:"/63616/"; startswith; fast_pattern; http.host; content:"botuque-homes9811.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014972; classtype:social-engineering; sid:6014972; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (krishqop.github.io/Amazonweb-Task)"; flow:established,to_server; http.uri; content:"/Amazonweb-Task"; startswith; fast_pattern; http.host; content:"krishqop.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014973; classtype:social-engineering; sid:6014973; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pay.emag.hu/pay/v2/)"; flow:established,to_server; http.uri; content:"/pay/v2/"; startswith; fast_pattern; http.host; content:"pay.emag.hu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014974; classtype:social-engineering; sid:6014974; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.js7761.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.js7761.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014975; classtype:social-engineering; sid:6014975; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mnaxskpmya.top/5g)"; flow:established,to_server; http.uri; content:"/5g"; startswith; fast_pattern; http.host; content:"mnaxskpmya.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014976; classtype:social-engineering; sid:6014976; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prajjwalmathur90.github.io/spotify-clone)"; flow:established,to_server; http.uri; content:"/spotify-clone"; startswith; fast_pattern; http.host; content:"prajjwalmathur90.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014977; classtype:social-engineering; sid:6014977; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netfli-x-clone.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netfli-x-clone.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014978; classtype:social-engineering; sid:6014978; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtb.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingtb.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014979; classtype:social-engineering; sid:6014979; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ledgerwalletrelease.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ledgerwalletrelease.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014980; classtype:social-engineering; sid:6014980; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jokerelectronics.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jokerelectronics.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014981; classtype:social-engineering; sid:6014981; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alabid234.github.io/Amazon-Project)"; flow:established,to_server; http.uri; content:"/Amazon-Project"; startswith; fast_pattern; http.host; content:"alabid234.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014982; classtype:social-engineering; sid:6014982; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (public-io-trzer-wallet.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"public-io-trzer-wallet.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014983; classtype:social-engineering; sid:6014983; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingyq.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingyq.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014984; classtype:social-engineering; sid:6014984; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ayush-34612.github.io/spotify-clone)"; flow:established,to_server; http.uri; content:"/spotify-clone"; startswith; fast_pattern; http.host; content:"ayush-34612.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014985; classtype:social-engineering; sid:6014985; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mobile.jnzqbkbllo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mobile.jnzqbkbllo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014986; classtype:social-engineering; sid:6014986; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prenticecostamesquit1781876953123.1141655.meusitehostgator.com.br/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"prenticecostamesquit1781876953123.1141655.meusitehostgator.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014987; classtype:social-engineering; sid:6014987; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ranjanbaibhav377-code.github.io/netflixclone/)"; flow:established,to_server; http.uri; content:"/netflixclone/"; startswith; fast_pattern; http.host; content:"ranjanbaibhav377-code.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014988; classtype:social-engineering; sid:6014988; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (o-o.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"o-o.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014989; classtype:social-engineering; sid:6014989; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ldvpoy.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.ldvpoy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014990; classtype:social-engineering; sid:6014990; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.yjtgbz.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.yjtgbz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014991; classtype:social-engineering; sid:6014991; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tellsstraawellxc.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tellsstraawellxc.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014992; classtype:social-engineering; sid:6014992; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (us-trezor-login-start.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"us-trezor-login-start.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014993; classtype:social-engineering; sid:6014993; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiverr-orders-pay.help/project/katy2)"; flow:established,to_server; http.uri; content:"/project/katy2"; startswith; fast_pattern; http.host; content:"fiverr-orders-pay.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014994; classtype:social-engineering; sid:6014994; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (viju-net.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"viju-net.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014995; classtype:social-engineering; sid:6014995; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shubhamtiwari54.github.io/netflix_simple/)"; flow:established,to_server; http.uri; content:"/netflix_simple/"; startswith; fast_pattern; http.host; content:"shubhamtiwari54.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014996; classtype:social-engineering; sid:6014996; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ayeshajaveed576.github.io/Amazon-clone)"; flow:established,to_server; http.uri; content:"/Amazon-clone"; startswith; fast_pattern; http.host; content:"ayeshajaveed576.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014997; classtype:social-engineering; sid:6014997; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amrithachandrabose.github.io/Netflix-clone)"; flow:established,to_server; http.uri; content:"/Netflix-clone"; startswith; fast_pattern; http.host; content:"amrithachandrabose.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014998; classtype:social-engineering; sid:6014998; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (22365ok.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"22365ok.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6014999; classtype:social-engineering; sid:6014999; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (santandercycling.com.co/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"santandercycling.com.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015000; classtype:social-engineering; sid:6015000; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (manikantareddykapa.github.io/Amozon--Clone)"; flow:established,to_server; http.uri; content:"/Amozon--Clone"; startswith; fast_pattern; http.host; content:"manikantareddykapa.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015001; classtype:social-engineering; sid:6015001; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kpsservices.fr/NA/297/redi)"; flow:established,to_server; http.uri; content:"/NA/297/redi"; startswith; fast_pattern; http.host; content:"kpsservices.fr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015002; classtype:social-engineering; sid:6015002; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.blogistix.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.blogistix.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015003; classtype:social-engineering; sid:6015003; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thiagoaas.github.io/Recria-o-NETFLIX)"; flow:established,to_server; http.uri; content:"/Recria-o-NETFLIX"; startswith; fast_pattern; http.host; content:"thiagoaas.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015004; classtype:social-engineering; sid:6015004; rev:1; metadata: signature_severity Major, created_et 2026_06_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mycomcastnet.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mycomcastnet.framer.ai"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015005; classtype:social-engineering; sid:6015005; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (line.me.ja.geraiqawti.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"line.me.ja.geraiqawti.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015006; classtype:social-engineering; sid:6015006; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonshot-listing-skg.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonshot-listing-skg.netlify.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015007; classtype:social-engineering; sid:6015007; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (demolasthotmail.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"demolasthotmail.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015008; classtype:social-engineering; sid:6015008; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.oferta30592749592747.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalnie.oferta30592749592747.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015009; classtype:social-engineering; sid:6015009; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mylecu.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mylecu.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015010; classtype:social-engineering; sid:6015010; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mongroupegls.help/verification-oq5fbnm54z4fm66v)"; flow:established,to_server; http.uri; content:"/verification-oq5fbnm54z4fm66v"; startswith; fast_pattern; http.host; content:"mongroupegls.help"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015011; classtype:social-engineering; sid:6015011; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonshot-listing-kvc.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonshot-listing-kvc.netlify.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015012; classtype:social-engineering; sid:6015012; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-g63lkz.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi)"; flow:established,to_server; http.uri; content:"/Bin/ScreenConnect.ClientSetup.msi"; startswith; fast_pattern; http.host; content:"web-g63lkz.screenconnect.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015013; classtype:social-engineering; sid:6015013; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (colegioconexao.com.br/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"colegioconexao.com.br"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015014; classtype:social-engineering; sid:6015014; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enthusiastic-cassava-092831.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"enthusiastic-cassava-092831.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015015; classtype:social-engineering; sid:6015015; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (little-travel-744918.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"little-travel-744918.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015016; classtype:social-engineering; sid:6015016; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (royamailpost.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"royamailpost.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015017; classtype:social-engineering; sid:6015017; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (youandeverwlse0nllne.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"youandeverwlse0nllne.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015018; classtype:social-engineering; sid:6015018; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (long-icloud.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"long-icloud.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015019; classtype:social-engineering; sid:6015019; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.educationpolicy.eu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.educationpolicy.eu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015020; classtype:social-engineering; sid:6015020; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cn-core-baowei.com/?Action&Apply/=)"; flow:established,to_server; http.uri; content:"/?Action&Apply/="; startswith; fast_pattern; http.host; content:"cn-core-baowei.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015021; classtype:social-engineering; sid:6015021; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.o4o23-200.xyz/lokalnie/?id=9P4r7Q3B4l9F6h9z2q0p9e8R3e5X9b4z)"; flow:established,to_server; http.uri; content:"/lokalnie/?id=9P4r7Q3B4l9F6h9z2q0p9e8R3e5X9b4z"; startswith; fast_pattern; http.host; content:"allegro.o4o23-200.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015022; classtype:social-engineering; sid:6015022; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezur-en-us.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezur-en-us.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015023; classtype:social-engineering; sid:6015023; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (setwallet.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"setwallet.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015024; classtype:social-engineering; sid:6015024; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (22-icloud.com/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"22-icloud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015025; classtype:social-engineering; sid:6015025; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dgtl.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dgtl.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015026; classtype:social-engineering; sid:6015026; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.device-detect.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.device-detect.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015027; classtype:social-engineering; sid:6015027; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.l-lcloud-1-com.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.l-lcloud-1-com.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015028; classtype:social-engineering; sid:6015028; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloud-localizado.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"icloud-localizado.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015029; classtype:social-engineering; sid:6015029; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.lcloud-support2.com/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.lcloud-support2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015030; classtype:social-engineering; sid:6015030; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wym.sfu.mybluehost.me/wp-includes/sitemaps/gucsapv/rkgmy1j/awpvyhb/property.html)"; flow:established,to_server; http.uri; content:"/wp-includes/sitemaps/gucsapv/rkgmy1j/awpvyhb/property.html"; startswith; fast_pattern; http.host; content:"wym.sfu.mybluehost.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015031; classtype:social-engineering; sid:6015031; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (epicinfo.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"epicinfo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015032; classtype:social-engineering; sid:6015032; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (efficientattics.com/wp-admin/page.html)"; flow:established,to_server; http.uri; content:"/wp-admin/page.html"; startswith; fast_pattern; http.host; content:"efficientattics.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015033; classtype:social-engineering; sid:6015033; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lcloud-support2.com/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"lcloud-support2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015034; classtype:social-engineering; sid:6015034; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.support-icloudfinds.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.support-icloudfinds.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015035; classtype:social-engineering; sid:6015035; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.devicelocate.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.devicelocate.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015036; classtype:social-engineering; sid:6015036; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.ifindphonemy.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.ifindphonemy.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015037; classtype:social-engineering; sid:6015037; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ashish13-hub.github.io/Amazon-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-clone/"; startswith; fast_pattern; http.host; content:"ashish13-hub.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015038; classtype:social-engineering; sid:6015038; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adityapandey87.github.io/adityaportfolio/)"; flow:established,to_server; http.uri; content:"/adityaportfolio/"; startswith; fast_pattern; http.host; content:"adityapandey87.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015039; classtype:social-engineering; sid:6015039; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (unl.one/2ZZW4.mp4)"; flow:established,to_server; http.uri; content:"/2ZZW4.mp4"; startswith; fast_pattern; http.host; content:"unl.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015040; classtype:social-engineering; sid:6015040; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abhaythakor07.github.io/Amazon-Clone-Home-Page/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone-Home-Page/"; startswith; fast_pattern; http.host; content:"abhaythakor07.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015041; classtype:social-engineering; sid:6015041; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (plavereuropa.com/ap/signin)"; flow:established,to_server; http.uri; content:"/ap/signin"; startswith; fast_pattern; http.host; content:"plavereuropa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015042; classtype:social-engineering; sid:6015042; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lcloud-support1.com/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"lcloud-support1.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015043; classtype:social-engineering; sid:6015043; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (started-ledger.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"started-ledger.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015044; classtype:social-engineering; sid:6015044; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.icloud-myfind.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.icloud-myfind.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015045; classtype:social-engineering; sid:6015045; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maps-icloudmy1.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"maps-icloudmy1.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015046; classtype:social-engineering; sid:6015046; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ahn43814-boop.github.io/mircosoft-index/)"; flow:established,to_server; http.uri; content:"/mircosoft-index/"; startswith; fast_pattern; http.host; content:"ahn43814-boop.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015047; classtype:social-engineering; sid:6015047; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accounts-findmy.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"accounts-findmy.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015048; classtype:social-engineering; sid:6015048; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.device-iphone.life/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.device-iphone.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015049; classtype:social-engineering; sid:6015049; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myfindphone.help/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"myfindphone.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015050; classtype:social-engineering; sid:6015050; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (location-fmdl.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"location-fmdl.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015051; classtype:social-engineering; sid:6015051; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kleinanzeigen.klrdomkauf.shop/order/1j3Vt4RLBpCE/?plg=catchme)"; flow:established,to_server; http.uri; content:"/order/1j3Vt4RLBpCE/?plg=catchme"; startswith; fast_pattern; http.host; content:"kleinanzeigen.klrdomkauf.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015052; classtype:social-engineering; sid:6015052; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortsky.xyz/id/login)"; flow:established,to_server; http.uri; content:"/id/login"; startswith; fast_pattern; http.host; content:"fortsky.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015053; classtype:social-engineering; sid:6015053; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoja003.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoja003.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015054; classtype:social-engineering; sid:6015054; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.flndmeapple.info/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.flndmeapple.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015055; classtype:social-engineering; sid:6015055; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee-tbk777.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopee-tbk777.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015056; classtype:social-engineering; sid:6015056; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.findmy2.support/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.findmy2.support"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015057; classtype:social-engineering; sid:6015057; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (victino2005.github.io/Netflix/)"; flow:established,to_server; http.uri; content:"/Netflix/"; startswith; fast_pattern; http.host; content:"victino2005.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015058; classtype:social-engineering; sid:6015058; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b1senissks-joeyblog.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b1senissks-joeyblog.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015059; classtype:social-engineering; sid:6015059; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mahendradhang.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"mahendradhang.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015060; classtype:social-engineering; sid:6015060; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.myphone-app.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.myphone-app.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015061; classtype:social-engineering; sid:6015061; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flndmedevice.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"flndmedevice.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015062; classtype:social-engineering; sid:6015062; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paylap.uber.space/.uk/css/?token=)"; flow:established,to_server; http.uri; content:"/.uk/css/?token="; startswith; fast_pattern; http.host; content:"paylap.uber.space"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015063; classtype:social-engineering; sid:6015063; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cloud-lostdevice.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"cloud-lostdevice.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015064; classtype:social-engineering; sid:6015064; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingyz.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingyz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015065; classtype:social-engineering; sid:6015065; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myphone-app.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"myphone-app.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015066; classtype:social-engineering; sid:6015066; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloud-mapsphonehl.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"icloud-mapsphonehl.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015067; classtype:social-engineering; sid:6015067; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (livewalletsvalidationsync.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"livewalletsvalidationsync.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015068; classtype:social-engineering; sid:6015068; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.location-iclouds.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.location-iclouds.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015069; classtype:social-engineering; sid:6015069; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1-lcloud-l-com.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"1-lcloud-l-com.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015070; classtype:social-engineering; sid:6015070; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (devicelocate.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"devicelocate.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015071; classtype:social-engineering; sid:6015071; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365okvip2.com/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"365okvip2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015072; classtype:social-engineering; sid:6015072; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (memberunion04apr.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"memberunion04apr.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015073; classtype:social-engineering; sid:6015073; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.11-icloud.com/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.11-icloud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015074; classtype:social-engineering; sid:6015074; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.myfindphone.help/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.myfindphone.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015075; classtype:social-engineering; sid:6015075; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aanya900.github.io/Amazon-Clone)"; flow:established,to_server; http.uri; content:"/Amazon-Clone"; startswith; fast_pattern; http.host; content:"aanya900.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015076; classtype:social-engineering; sid:6015076; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cccm.jsdaweb.my.id/dana/)"; flow:established,to_server; http.uri; content:"/dana/"; startswith; fast_pattern; http.host; content:"cccm.jsdaweb.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015077; classtype:social-engineering; sid:6015077; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.location-fmdl.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.location-fmdl.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015078; classtype:social-engineering; sid:6015078; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee-tbk888.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopee-tbk888.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015079; classtype:social-engineering; sid:6015079; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.22-icloud.com/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.22-icloud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015080; classtype:social-engineering; sid:6015080; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (urlvanish.com/3ccce1a7)"; flow:established,to_server; http.uri; content:"/3ccce1a7"; startswith; fast_pattern; http.host; content:"urlvanish.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015081; classtype:social-engineering; sid:6015081; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (soporte-mapas.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"soporte-mapas.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015082; classtype:social-engineering; sid:6015082; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (demo.dentistwestallis.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"demo.dentistwestallis.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015083; classtype:social-engineering; sid:6015083; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.365bet441.com/chs/)"; flow:established,to_server; http.uri; content:"/chs/"; startswith; fast_pattern; http.host; content:"m.365bet441.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015084; classtype:social-engineering; sid:6015084; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brantico.com/generator/amazongiftcard.html)"; flow:established,to_server; http.uri; content:"/generator/amazongiftcard.html"; startswith; fast_pattern; http.host; content:"brantico.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015085; classtype:social-engineering; sid:6015085; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (akash-b2005.github.io/static-clone-netflix/)"; flow:established,to_server; http.uri; content:"/static-clone-netflix/"; startswith; fast_pattern; http.host; content:"akash-b2005.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015086; classtype:social-engineering; sid:6015086; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mdkaif-eng.github.io/Spotify-clone)"; flow:established,to_server; http.uri; content:"/Spotify-clone"; startswith; fast_pattern; http.host; content:"mdkaif-eng.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015087; classtype:social-engineering; sid:6015087; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (detect-device.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"detect-device.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015088; classtype:social-engineering; sid:6015088; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ifindphonemy.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"ifindphonemy.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015089; classtype:social-engineering; sid:6015089; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreifgarbo26xb5vntfmedqcyosjpeqi4otz6lpk2g3mbvhdmovpb55m.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreifgarbo26xb5vntfmedqcyosjpeqi4otz6lpk2g3mbvhdmovpb55m.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015090; classtype:social-engineering; sid:6015090; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebooksuporteolaine.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebooksuporteolaine.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015091; classtype:social-engineering; sid:6015091; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abrahamjosephaykkaraa-ship-it.github.io/airbnb)"; flow:established,to_server; http.uri; content:"/airbnb"; startswith; fast_pattern; http.host; content:"abrahamjosephaykkaraa-ship-it.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015092; classtype:social-engineering; sid:6015092; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloud-myfind.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"icloud-myfind.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015093; classtype:social-engineering; sid:6015093; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (urlvanish.com/e2982d9c)"; flow:established,to_server; http.uri; content:"/e2982d9c"; startswith; fast_pattern; http.host; content:"urlvanish.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015094; classtype:social-engineering; sid:6015094; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.awzxfu.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.awzxfu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015095; classtype:social-engineering; sid:6015095; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sibaprasadsahu410-cpu.github.io/NETFLIX-CLONE/)"; flow:established,to_server; http.uri; content:"/NETFLIX-CLONE/"; startswith; fast_pattern; http.host; content:"sibaprasadsahu410-cpu.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015096; classtype:social-engineering; sid:6015096; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lomfi-lotra-biz-rentra-dokli-sp19ct3bur.pages.dev/heartily_welcome?welcome=1804942259817696&id=1804942259817696&page_name=Everman%20ISD/)"; flow:established,to_server; http.uri; content:"/heartily_welcome?welcome=1804942259817696&id=1804942259817696&page_name=Everman%20ISD/"; startswith; fast_pattern; http.host; content:"lomfi-lotra-biz-rentra-dokli-sp19ct3bur.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015097; classtype:social-engineering; sid:6015097; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deepak2006ez-ship-it.github.io/netflix-clone)"; flow:established,to_server; http.uri; content:"/netflix-clone"; startswith; fast_pattern; http.host; content:"deepak2006ez-ship-it.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015098; classtype:social-engineering; sid:6015098; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.findmy-supportjl.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.findmy-supportjl.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015099; classtype:social-engineering; sid:6015099; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (redirect.me/r/yhejge)"; flow:established,to_server; http.uri; content:"/r/yhejge"; startswith; fast_pattern; http.host; content:"redirect.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015100; classtype:social-engineering; sid:6015100; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xzpbmk.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.xzpbmk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015101; classtype:social-engineering; sid:6015101; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.mydevice-support.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.mydevice-support.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015102; classtype:social-engineering; sid:6015102; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (danaa-iindonesiaa.ckk.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"danaa-iindonesiaa.ckk.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015103; classtype:social-engineering; sid:6015103; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.serch-finds.life/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.serch-finds.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015104; classtype:social-engineering; sid:6015104; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mozdesign.com.br/454618e5/gmail/)"; flow:established,to_server; http.uri; content:"/454618e5/gmail/"; startswith; fast_pattern; http.host; content:"mozdesign.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015105; classtype:social-engineering; sid:6015105; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eniotrezor.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eniotrezor.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015106; classtype:social-engineering; sid:6015106; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support-rescuedevice.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"support-rescuedevice.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015107; classtype:social-engineering; sid:6015107; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopeejkt195.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopeejkt195.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015108; classtype:social-engineering; sid:6015108; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my-iapple-lost.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"my-iapple-lost.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015109; classtype:social-engineering; sid:6015109; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apple-icloud.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"apple-icloud.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015110; classtype:social-engineering; sid:6015110; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.icloud-longin.com/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.icloud-longin.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015111; classtype:social-engineering; sid:6015111; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ingeminandina.cl/mover/pages/login.php)"; flow:established,to_server; http.uri; content:"/mover/pages/login.php"; startswith; fast_pattern; http.host; content:"www.ingeminandina.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015112; classtype:social-engineering; sid:6015112; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xffinnittyy.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xffinnittyy.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015113; classtype:social-engineering; sid:6015113; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (consulta-oferta.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"consulta-oferta.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015114; classtype:social-engineering; sid:6015114; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en--start-tr-zor-cdn.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"en--start-tr-zor-cdn.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015115; classtype:social-engineering; sid:6015115; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kuyzcoinlogin.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kuyzcoinlogin.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015116; classtype:social-engineering; sid:6015116; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (officia-jiangnan.com/?BoardBrief&SeoeuSHsnK/=)"; flow:established,to_server; http.uri; content:"/?BoardBrief&SeoeuSHsnK/="; startswith; fast_pattern; http.host; content:"officia-jiangnan.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015117; classtype:social-engineering; sid:6015117; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kavyaaggrawal27-cell.github.io/netflix.clone/)"; flow:established,to_server; http.uri; content:"/netflix.clone/"; startswith; fast_pattern; http.host; content:"kavyaaggrawal27-cell.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015118; classtype:social-engineering; sid:6015118; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qvubyk.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.qvubyk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015119; classtype:social-engineering; sid:6015119; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.apple-col.com/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.apple-col.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015120; classtype:social-engineering; sid:6015120; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kavyaaggrawal27-cell.github.io/netflix.clone)"; flow:established,to_server; http.uri; content:"/netflix.clone"; startswith; fast_pattern; http.host; content:"kavyaaggrawal27-cell.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015121; classtype:social-engineering; sid:6015121; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.findmy-mapslcp.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.findmy-mapslcp.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015122; classtype:social-engineering; sid:6015122; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m-facebookk.com.vn/mt7gh5euhec)"; flow:established,to_server; http.uri; content:"/mt7gh5euhec"; startswith; fast_pattern; http.host; content:"m-facebookk.com.vn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015123; classtype:social-engineering; sid:6015123; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (findmy-supportjl.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"findmy-supportjl.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015124; classtype:social-engineering; sid:6015124; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fy-device-iapple.com/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"fy-device-iapple.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015125; classtype:social-engineering; sid:6015125; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tight-butterfly-24b3.dcctavjjrwonaqe.workers.dev/facebook.com-1027275509)"; flow:established,to_server; http.uri; content:"/facebook.com-1027275509"; startswith; fast_pattern; http.host; content:"tight-butterfly-24b3.dcctavjjrwonaqe.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015126; classtype:social-engineering; sid:6015126; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lms.beexfit-academy.com/app/)"; flow:established,to_server; http.uri; content:"/app/"; startswith; fast_pattern; http.host; content:"lms.beexfit-academy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015127; classtype:social-engineering; sid:6015127; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (humorous-stack-874003.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"humorous-stack-874003.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015128; classtype:social-engineering; sid:6015128; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (11-icloud.com/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"11-icloud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015129; classtype:social-engineering; sid:6015129; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (encontrar-my-iphone.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"encontrar-my-iphone.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015130; classtype:social-engineering; sid:6015130; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (devices-ifind.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"devices-ifind.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015131; classtype:social-engineering; sid:6015131; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.soporte-mapas.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.soporte-mapas.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015132; classtype:social-engineering; sid:6015132; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (device-ifind.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"device-ifind.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015133; classtype:social-engineering; sid:6015133; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.icloud-localizado.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.icloud-localizado.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015134; classtype:social-engineering; sid:6015134; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.supportefind.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.supportefind.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015135; classtype:social-engineering; sid:6015135; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.1-lcloud-l-com.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.1-lcloud-l-com.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015136; classtype:social-engineering; sid:6015136; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.appieid-supported.com/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.appieid-supported.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015137; classtype:social-engineering; sid:6015137; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (findmy-support1.com/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"findmy-support1.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015138; classtype:social-engineering; sid:6015138; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adityab9990.github.io/MicroSoft_store)"; flow:established,to_server; http.uri; content:"/MicroSoft_store"; startswith; fast_pattern; http.host; content:"adityab9990.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015139; classtype:social-engineering; sid:6015139; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.detect-device.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.detect-device.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015140; classtype:social-engineering; sid:6015140; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.icloud-mapsphonehl.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.icloud-mapsphonehl.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015141; classtype:social-engineering; sid:6015141; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spiky-days-709346.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spiky-days-709346.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015142; classtype:social-engineering; sid:6015142; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sawanpanchal.github.io/Netflix.co/)"; flow:established,to_server; http.uri; content:"/Netflix.co/"; startswith; fast_pattern; http.host; content:"sawanpanchal.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015143; classtype:social-engineering; sid:6015143; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pratham-matrix.github.io/Amazon-clone-site/)"; flow:established,to_server; http.uri; content:"/Amazon-clone-site/"; startswith; fast_pattern; http.host; content:"pratham-matrix.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015144; classtype:social-engineering; sid:6015144; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ieasycommerzb.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ieasycommerzb.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015145; classtype:social-engineering; sid:6015145; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (satyam-v3.github.io/Netflix_clone/)"; flow:established,to_server; http.uri; content:"/Netflix_clone/"; startswith; fast_pattern; http.host; content:"satyam-v3.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015146; classtype:social-engineering; sid:6015146; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.m.dentistwestallis.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.m.dentistwestallis.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015147; classtype:social-engineering; sid:6015147; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.support-locationjfls.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.support-locationjfls.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015148; classtype:social-engineering; sid:6015148; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiax55d5bmxagbpknmkwh72r33zxhddshkqwrxzpuljn3g365b2ohu.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiax55d5bmxagbpknmkwh72r33zxhddshkqwrxzpuljn3g365b2ohu.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015149; classtype:social-engineering; sid:6015149; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support-icloudfinds.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"support-icloudfinds.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015150; classtype:social-engineering; sid:6015150; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.devices-ifind.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.devices-ifind.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015151; classtype:social-engineering; sid:6015151; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (33-icloud.com/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"33-icloud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015152; classtype:social-engineering; sid:6015152; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.jsupport-myclouds.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.jsupport-myclouds.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015153; classtype:social-engineering; sid:6015153; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (remote.dentistwestallis.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"remote.dentistwestallis.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015154; classtype:social-engineering; sid:6015154; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paylap.uber.space/.uk/css/pages/login.php)"; flow:established,to_server; http.uri; content:"/.uk/css/pages/login.php"; startswith; fast_pattern; http.host; content:"paylap.uber.space"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015155; classtype:social-engineering; sid:6015155; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (entreeprises-sg-fr.com/icdeweb/web/login.php/)"; flow:established,to_server; http.uri; content:"/icdeweb/web/login.php/"; startswith; fast_pattern; http.host; content:"entreeprises-sg-fr.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015156; classtype:social-engineering; sid:6015156; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lambruchona.com/-8d4NWe)"; flow:established,to_server; http.uri; content:"/-8d4NWe"; startswith; fast_pattern; http.host; content:"lambruchona.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015157; classtype:social-engineering; sid:6015157; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (encontrarmaps.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"encontrarmaps.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015158; classtype:social-engineering; sid:6015158; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fr-relay-tracking.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fr-relay-tracking.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015159; classtype:social-engineering; sid:6015159; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (phone-mapslop.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"phone-mapslop.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015160; classtype:social-engineering; sid:6015160; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.serchphone7.life/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.serchphone7.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015161; classtype:social-engineering; sid:6015161; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-login-page-kappa.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-login-page-kappa.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015162; classtype:social-engineering; sid:6015162; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kucoinwlogn.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kucoinwlogn.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015163; classtype:social-engineering; sid:6015163; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dokument-cembra.com/e-dokument/web-tag/index.php)"; flow:established,to_server; http.uri; content:"/e-dokument/web-tag/index.php"; startswith; fast_pattern; http.host; content:"dokument-cembra.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015164; classtype:social-engineering; sid:6015164; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.cloud-lostdevice.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.cloud-lostdevice.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015165; classtype:social-engineering; sid:6015165; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingyl.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingyl.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015166; classtype:social-engineering; sid:6015166; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloud-longin.com/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"icloud-longin.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015167; classtype:social-engineering; sid:6015167; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sawanpanchal.github.io/Netflix.co)"; flow:established,to_server; http.uri; content:"/Netflix.co"; startswith; fast_pattern; http.host; content:"sawanpanchal.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015168; classtype:social-engineering; sid:6015168; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (raorizwan-125.github.io/Facebook-login-page/)"; flow:established,to_server; http.uri; content:"/Facebook-login-page/"; startswith; fast_pattern; http.host; content:"raorizwan-125.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015169; classtype:social-engineering; sid:6015169; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.dentistwestallis.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.dentistwestallis.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015170; classtype:social-engineering; sid:6015170; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee-tbk777.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopee-tbk777.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015171; classtype:social-engineering; sid:6015171; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.encontratmiiphone.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.encontratmiiphone.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015172; classtype:social-engineering; sid:6015172; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (arshtiwari940-collab.github.io/NetflixClone/)"; flow:established,to_server; http.uri; content:"/NetflixClone/"; startswith; fast_pattern; http.host; content:"arshtiwari940-collab.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015173; classtype:social-engineering; sid:6015173; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (idcloud-lost.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"idcloud-lost.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015174; classtype:social-engineering; sid:6015174; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apple-col.com/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"apple-col.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015175; classtype:social-engineering; sid:6015175; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (device-iphone.life/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"device-iphone.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015176; classtype:social-engineering; sid:6015176; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (locations-findmy.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"locations-findmy.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015177; classtype:social-engineering; sid:6015177; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (demolasthotmail.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"demolasthotmail.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015178; classtype:social-engineering; sid:6015178; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.idcloud-lost.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.idcloud-lost.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015179; classtype:social-engineering; sid:6015179; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alexrslobal.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"alexrslobal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015180; classtype:social-engineering; sid:6015180; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (khushikushwaha826.github.io/KHUSHI-KUSHWAHA/)"; flow:established,to_server; http.uri; content:"/KHUSHI-KUSHWAHA/"; startswith; fast_pattern; http.host; content:"khushikushwaha826.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015181; classtype:social-engineering; sid:6015181; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help-iapple.com/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"help-iapple.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015182; classtype:social-engineering; sid:6015182; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (raj-hans-hub.github.io/netflix/)"; flow:established,to_server; http.uri; content:"/netflix/"; startswith; fast_pattern; http.host; content:"raj-hans-hub.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015183; classtype:social-engineering; sid:6015183; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (started-trezrio.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"started-trezrio.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015184; classtype:social-engineering; sid:6015184; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (securepdffile1.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"securepdffile1.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015185; classtype:social-engineering; sid:6015185; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fr-relay-tracking.com/en/login/)"; flow:established,to_server; http.uri; content:"/en/login/"; startswith; fast_pattern; http.host; content:"fr-relay-tracking.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015186; classtype:social-engineering; sid:6015186; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.long-icloud.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.long-icloud.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015187; classtype:social-engineering; sid:6015187; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sawanpanchal.github.io/NETFLIX.htps/)"; flow:established,to_server; http.uri; content:"/NETFLIX.htps/"; startswith; fast_pattern; http.host; content:"sawanpanchal.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015188; classtype:social-engineering; sid:6015188; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (learn-trezrostart.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"learn-trezrostart.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015189; classtype:social-engineering; sid:6015189; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.findmy-support1.com/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.findmy-support1.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015190; classtype:social-engineering; sid:6015190; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support-locationjfls.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"support-locationjfls.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015191; classtype:social-engineering; sid:6015191; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.zkk.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.zkk.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015192; classtype:social-engineering; sid:6015192; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.apple-icloud.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.apple-icloud.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015193; classtype:social-engineering; sid:6015193; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (id-mycloud.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"id-mycloud.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015194; classtype:social-engineering; sid:6015194; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.rccghopehall.com/m/index.html)"; flow:established,to_server; http.uri; content:"/m/index.html"; startswith; fast_pattern; http.host; content:"m.rccghopehall.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015195; classtype:social-engineering; sid:6015195; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.encontrar-my-iphone.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.encontrar-my-iphone.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015196; classtype:social-engineering; sid:6015196; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (serchphone7.life/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"serchphone7.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015197; classtype:social-engineering; sid:6015197; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sd.unep-city-rating.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sd.unep-city-rating.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015198; classtype:social-engineering; sid:6015198; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.my-iapple-lost.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.my-iapple-lost.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015199; classtype:social-engineering; sid:6015199; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.id-mycloud.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.id-mycloud.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015200; classtype:social-engineering; sid:6015200; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sawanpanchal.github.io/Netflix1/)"; flow:established,to_server; http.uri; content:"/Netflix1/"; startswith; fast_pattern; http.host; content:"sawanpanchal.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015201; classtype:social-engineering; sid:6015201; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastwebma.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastwebma.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015202; classtype:social-engineering; sid:6015202; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail-pt-lu.github.io/webmail-todo-logout/)"; flow:established,to_server; http.uri; content:"/webmail-todo-logout/"; startswith; fast_pattern; http.host; content:"webmail-pt-lu.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015203; classtype:social-engineering; sid:6015203; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anas-spotify-clone.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"anas-spotify-clone.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015204; classtype:social-engineering; sid:6015204; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appieid-supported.com/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"appieid-supported.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015205; classtype:social-engineering; sid:6015205; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-login-page-kappa.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-login-page-kappa.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015206; classtype:social-engineering; sid:6015206; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.accounts-findmy.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.accounts-findmy.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015207; classtype:social-engineering; sid:6015207; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee-tbk888.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopee-tbk888.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015208; classtype:social-engineering; sid:6015208; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spotifyclonefirst.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spotifyclonefirst.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015209; classtype:social-engineering; sid:6015209; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (melodious-manatee-c2a637.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"melodious-manatee-c2a637.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015210; classtype:social-engineering; sid:6015210; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flndme-com.info/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"flndme-com.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015211; classtype:social-engineering; sid:6015211; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.encontrarmaps.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.encontrarmaps.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015212; classtype:social-engineering; sid:6015212; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (infohadiahtbk299.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"infohadiahtbk299.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015213; classtype:social-engineering; sid:6015213; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mydevice-support.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mydevice-support.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015214; classtype:social-engineering; sid:6015214; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.help-iapple.com/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.help-iapple.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015215; classtype:social-engineering; sid:6015215; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p9dtufdd67v.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p9dtufdd67v.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015216; classtype:social-engineering; sid:6015216; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (habeeiiyy.github.io/Netflix/)"; flow:established,to_server; http.uri; content:"/Netflix/"; startswith; fast_pattern; http.host; content:"habeeiiyy.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015217; classtype:social-engineering; sid:6015217; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (patrickmortensen986-star.github.io/roblox)"; flow:established,to_server; http.uri; content:"/roblox"; startswith; fast_pattern; http.host; content:"patrickmortensen986-star.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015218; classtype:social-engineering; sid:6015218; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (grumczak.github.io/Phishing/)"; flow:established,to_server; http.uri; content:"/Phishing/"; startswith; fast_pattern; http.host; content:"grumczak.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015219; classtype:social-engineering; sid:6015219; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kukoociinlogon.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kukoociinlogon.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015220; classtype:social-engineering; sid:6015220; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.fy-device-iapple.com/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.fy-device-iapple.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015221; classtype:social-engineering; sid:6015221; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mycomcastnet.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mycomcastnet.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015222; classtype:social-engineering; sid:6015222; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (find-phone-location.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"find-phone-location.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015223; classtype:social-engineering; sid:6015223; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.www4-findmy-lostapple.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.www4-findmy-lostapple.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015224; classtype:social-engineering; sid:6015224; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cloud-trzors.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cloud-trzors.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015225; classtype:social-engineering; sid:6015225; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sawanpanchal.github.io/NETFLIX.htps)"; flow:established,to_server; http.uri; content:"/NETFLIX.htps"; startswith; fast_pattern; http.host; content:"sawanpanchal.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015226; classtype:social-engineering; sid:6015226; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (serch-finds.life/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"serch-finds.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015227; classtype:social-engineering; sid:6015227; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeejkt195.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopeejkt195.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015228; classtype:social-engineering; sid:6015228; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (device-detect.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"device-detect.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015229; classtype:social-engineering; sid:6015229; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (supportaccount-info.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"supportaccount-info.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015230; classtype:social-engineering; sid:6015230; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.idmyfindphone.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.idmyfindphone.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015231; classtype:social-engineering; sid:6015231; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dev-goswami.github.io/dev1Project/)"; flow:established,to_server; http.uri; content:"/dev1Project/"; startswith; fast_pattern; http.host; content:"dev-goswami.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015232; classtype:social-engineering; sid:6015232; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.supportscloud.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.supportscloud.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015233; classtype:social-engineering; sid:6015233; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.applefind.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.applefind.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015234; classtype:social-engineering; sid:6015234; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (leafleafy28-design.github.io/AMAZON-CLONE/)"; flow:established,to_server; http.uri; content:"/AMAZON-CLONE/"; startswith; fast_pattern; http.host; content:"leafleafy28-design.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015235; classtype:social-engineering; sid:6015235; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (encontratmiiphone.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"encontratmiiphone.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015236; classtype:social-engineering; sid:6015236; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (habeeiiyy.github.io/Amazon/)"; flow:established,to_server; http.uri; content:"/Amazon/"; startswith; fast_pattern; http.host; content:"habeeiiyy.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015237; classtype:social-engineering; sid:6015237; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (recruitsingapore.com/two.html)"; flow:established,to_server; http.uri; content:"/two.html"; startswith; fast_pattern; http.host; content:"recruitsingapore.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015238; classtype:social-engineering; sid:6015238; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.device-ifind.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.device-ifind.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015239; classtype:social-engineering; sid:6015239; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.supportaccount-info.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.supportaccount-info.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015240; classtype:social-engineering; sid:6015240; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (crespaydnnslaterx.zxfrbg.web.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"crespaydnnslaterx.zxfrbg.web.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015241; classtype:social-engineering; sid:6015241; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (applefind.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"applefind.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015242; classtype:social-engineering; sid:6015242; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gingersnapsok.com/hx_R5FM)"; flow:established,to_server; http.uri; content:"/hx_R5FM"; startswith; fast_pattern; http.host; content:"gingersnapsok.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015243; classtype:social-engineering; sid:6015243; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.maps-icloudmy1.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.maps-icloudmy1.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015244; classtype:social-engineering; sid:6015244; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.find-phone-location.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.find-phone-location.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015245; classtype:social-engineering; sid:6015245; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (naaie.com/ap/signin)"; flow:established,to_server; http.uri; content:"/ap/signin"; startswith; fast_pattern; http.host; content:"naaie.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015246; classtype:social-engineering; sid:6015246; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rccghopehall.com/m/index.html)"; flow:established,to_server; http.uri; content:"/m/index.html"; startswith; fast_pattern; http.host; content:"rccghopehall.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015247; classtype:social-engineering; sid:6015247; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortprice.pics/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortprice.pics"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015248; classtype:social-engineering; sid:6015248; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (findmy-mapslcp.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"findmy-mapslcp.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015249; classtype:social-engineering; sid:6015249; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kellylongbooks.com/m/index.html)"; flow:established,to_server; http.uri; content:"/m/index.html"; startswith; fast_pattern; http.host; content:"kellylongbooks.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015250; classtype:social-engineering; sid:6015250; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tjshar.github.io/PROJECT-Basic_Amazon_Clone/)"; flow:established,to_server; http.uri; content:"/PROJECT-Basic_Amazon_Clone/"; startswith; fast_pattern; http.host; content:"tjshar.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015251; classtype:social-engineering; sid:6015251; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi819.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"info-resmi819.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015252; classtype:social-engineering; sid:6015252; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.soporte-apple.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.soporte-apple.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015253; classtype:social-engineering; sid:6015253; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (muhammad-rehan126.github.io/Amazon-website)"; flow:established,to_server; http.uri; content:"/Amazon-website"; startswith; fast_pattern; http.host; content:"muhammad-rehan126.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015254; classtype:social-engineering; sid:6015254; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bybitget.com/bybit-meigu.html)"; flow:established,to_server; http.uri; content:"/bybit-meigu.html"; startswith; fast_pattern; http.host; content:"www.bybitget.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015255; classtype:social-engineering; sid:6015255; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.flndme-com.info/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.flndme-com.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015256; classtype:social-engineering; sid:6015256; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (soporte-apple.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"soporte-apple.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015257; classtype:social-engineering; sid:6015257; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shahmeerkhan0724-netizen.github.io/firebase/login.html)"; flow:established,to_server; http.uri; content:"/firebase/login.html"; startswith; fast_pattern; http.host; content:"shahmeerkhan0724-netizen.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015258; classtype:social-engineering; sid:6015258; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (location-iclouds.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"location-iclouds.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015259; classtype:social-engineering; sid:6015259; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hasnainmurtaza265.github.io/Amazone-clone)"; flow:established,to_server; http.uri; content:"/Amazone-clone"; startswith; fast_pattern; http.host; content:"hasnainmurtaza265.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015260; classtype:social-engineering; sid:6015260; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tiny-subtasks-309073.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tiny-subtasks-309073.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015261; classtype:social-engineering; sid:6015261; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kleinanzeigen.gerkaufde.icu/order/aJxbdNaMW400/?plg=catchme)"; flow:established,to_server; http.uri; content:"/order/aJxbdNaMW400/?plg=catchme"; startswith; fast_pattern; http.host; content:"kleinanzeigen.gerkaufde.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015262; classtype:social-engineering; sid:6015262; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-cn.login-chat-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app-cn.login-chat-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015263; classtype:social-engineering; sid:6015263; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (io-trzor-enghelp.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"io-trzor-enghelp.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015264; classtype:social-engineering; sid:6015264; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faq-starttrezrio.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"faq-starttrezrio.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015265; classtype:social-engineering; sid:6015265; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wordpress-212664-0.cloudclusters.net/vaW1hZ2/sbbclientfix/MWhaMi9zY/)"; flow:established,to_server; http.uri; content:"/vaW1hZ2/sbbclientfix/MWhaMi9zY/"; startswith; fast_pattern; http.host; content:"wordpress-212664-0.cloudclusters.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015266; classtype:social-engineering; sid:6015266; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (global-tracking-package.vercel.app/landing)"; flow:established,to_server; http.uri; content:"/landing"; startswith; fast_pattern; http.host; content:"global-tracking-package.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015267; classtype:social-engineering; sid:6015267; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (location-mapsflp.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"location-mapsflp.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015268; classtype:social-engineering; sid:6015268; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.locations-findmy.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.locations-findmy.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015269; classtype:social-engineering; sid:6015269; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.phone-mapslop.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.phone-mapslop.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015270; classtype:social-engineering; sid:6015270; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.33-icloud.com/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.33-icloud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015271; classtype:social-engineering; sid:6015271; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (praveen25-codes.github.io/responsive-amazon-clone)"; flow:established,to_server; http.uri; content:"/responsive-amazon-clone"; startswith; fast_pattern; http.host; content:"praveen25-codes.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015272; classtype:social-engineering; sid:6015272; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth-spectrum-net-login.framer.ai/?referer=urlvanish.com%2F3ccce1a7)"; flow:established,to_server; http.uri; content:"/?referer=urlvanish.com%2F3ccce1a7"; startswith; fast_pattern; http.host; content:"auth-spectrum-net-login.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015273; classtype:social-engineering; sid:6015273; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (workshops-glock18.shop/appdata/design/skin/balance/)"; flow:established,to_server; http.uri; content:"/appdata/design/skin/balance/"; startswith; fast_pattern; http.host; content:"workshops-glock18.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015274; classtype:social-engineering; sid:6015274; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.redhencrafts.com/m/index.html)"; flow:established,to_server; http.uri; content:"/m/index.html"; startswith; fast_pattern; http.host; content:"m.redhencrafts.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015275; classtype:social-engineering; sid:6015275; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.flndmedevice.us/ICL264)"; flow:established,to_server; http.uri; content:"/ICL264"; startswith; fast_pattern; http.host; content:"mail.flndmedevice.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015276; classtype:social-engineering; sid:6015276; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fgcdzu.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.fgcdzu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015277; classtype:social-engineering; sid:6015277; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.noah-scheurer.de/BradySandahl/)"; flow:established,to_server; http.uri; content:"/BradySandahl/"; startswith; fast_pattern; http.host; content:"www.noah-scheurer.de"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015278; classtype:social-engineering; sid:6015278; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ze-deliveryonline.vercel.app/funil)"; flow:established,to_server; http.uri; content:"/funil"; startswith; fast_pattern; http.host; content:"ze-deliveryonline.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015279; classtype:social-engineering; sid:6015279; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uivasortepremiacoes.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uivasortepremiacoes.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015280; classtype:social-engineering; sid:6015280; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (23.95.173.128/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"23.95.173.128"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015281; classtype:social-engineering; sid:6015281; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s-1s10hnb.s3.us-east-2.amazonaws.com/LogMeInResolve_Unattended.msi)"; flow:established,to_server; http.uri; content:"/LogMeInResolve_Unattended.msi"; startswith; fast_pattern; http.host; content:"s-1s10hnb.s3.us-east-2.amazonaws.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015282; classtype:social-engineering; sid:6015282; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (89465167.lat/ca-government-alberta)"; flow:established,to_server; http.uri; content:"/ca-government-alberta"; startswith; fast_pattern; http.host; content:"89465167.lat"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015283; classtype:social-engineering; sid:6015283; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (seagateinternational.com/ftx/)"; flow:established,to_server; http.uri; content:"/ftx/"; startswith; fast_pattern; http.host; content:"seagateinternational.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015284; classtype:social-engineering; sid:6015284; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (odpsodo.biz/verification-bqp9b82dprek8ss1)"; flow:established,to_server; http.uri; content:"/verification-bqp9b82dprek8ss1"; startswith; fast_pattern; http.host; content:"odpsodo.biz"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015285; classtype:social-engineering; sid:6015285; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (send-usdt-05.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"send-usdt-05.netlify.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015286; classtype:social-engineering; sid:6015286; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365haodeng.com/home)"; flow:established,to_server; http.uri; content:"/home"; startswith; fast_pattern; http.host; content:"www.365haodeng.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015287; classtype:social-engineering; sid:6015287; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fyliu.com/bsTzNCnR/)"; flow:established,to_server; http.uri; content:"/bsTzNCnR/"; startswith; fast_pattern; http.host; content:"fyliu.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015288; classtype:social-engineering; sid:6015288; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (104.21.54.96/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"104.21.54.96"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015289; classtype:social-engineering; sid:6015289; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (buddhaindustries.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi)"; flow:established,to_server; http.uri; content:"/Bin/ScreenConnect.ClientSetup.msi"; startswith; fast_pattern; http.host; content:"buddhaindustries.screenconnect.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015290; classtype:social-engineering; sid:6015290; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (172.67.137.188/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"172.67.137.188"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015291; classtype:social-engineering; sid:6015291; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3cud-je09-uln1.accounting-coralridgetowerssouth-com-s-account.workers.dev/90886377e8e56786)"; flow:established,to_server; http.uri; content:"/90886377e8e56786"; startswith; fast_pattern; http.host; content:"3cud-je09-uln1.accounting-coralridgetowerssouth-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015292; classtype:social-engineering; sid:6015292; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mauliksisodia.github.io/Netflix-Clone-Project/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone-Project/"; startswith; fast_pattern; http.host; content:"mauliksisodia.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015293; classtype:social-engineering; sid:6015293; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sikandarmaurya.github.io/Netflix/)"; flow:established,to_server; http.uri; content:"/Netflix/"; startswith; fast_pattern; http.host; content:"sikandarmaurya.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015294; classtype:social-engineering; sid:6015294; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (beratozer34.github.io/instagram/)"; flow:established,to_server; http.uri; content:"/instagram/"; startswith; fast_pattern; http.host; content:"beratozer34.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015295; classtype:social-engineering; sid:6015295; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (joshi7890-creator.github.io/amazonclone/)"; flow:established,to_server; http.uri; content:"/amazonclone/"; startswith; fast_pattern; http.host; content:"joshi7890-creator.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015296; classtype:social-engineering; sid:6015296; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloud-com.co/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"icloud-com.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015297; classtype:social-engineering; sid:6015297; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.aumentatucupbancol.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.aumentatucupbancol.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015298; classtype:social-engineering; sid:6015298; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mall.fadostore.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mall.fadostore.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015299; classtype:social-engineering; sid:6015299; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cashappp.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cashappp.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015300; classtype:social-engineering; sid:6015300; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (itskelvinking1-cell.github.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"itskelvinking1-cell.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015301; classtype:social-engineering; sid:6015301; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.b3520.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.b3520.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015302; classtype:social-engineering; sid:6015302; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (confirmationportal.com/28e15578-07cb-4487-8a93-db005a781f64/a/850dd652-420c-4a90-98ec-4b86aa56d3ed/ccp?lid=ee68c3bb-830a-4a2f-87cf-c7022382654c)"; flow:established,to_server; http.uri; content:"/28e15578-07cb-4487-8a93-db005a781f64/a/850dd652-420c-4a90-98ec-4b86aa56d3ed/ccp?lid=ee68c3bb-830a-4a2f-87cf-c7022382654c"; startswith; fast_pattern; http.host; content:"confirmationportal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015303; classtype:social-engineering; sid:6015303; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tu-dresden-oabvf.4webshare.com/ephyvpwbjdomh455cmixmjgr6g2gbjdcr6mcfc62wcycgt/?FEdzyN)"; flow:established,to_server; http.uri; content:"/ephyvpwbjdomh455cmixmjgr6g2gbjdcr6mcfc62wcycgt/?FEdzyN"; startswith; fast_pattern; http.host; content:"tu-dresden-oabvf.4webshare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015304; classtype:social-engineering; sid:6015304; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwwmaxski.top/4G)"; flow:established,to_server; http.uri; content:"/4G"; startswith; fast_pattern; http.host; content:"wwwmaxski.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015305; classtype:social-engineering; sid:6015305; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wrio021.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wrio021.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015306; classtype:social-engineering; sid:6015306; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.barwatson.com/newpo/login.php)"; flow:established,to_server; http.uri; content:"/newpo/login.php"; startswith; fast_pattern; http.host; content:"www.barwatson.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015307; classtype:social-engineering; sid:6015307; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (humorous-zebra-189284.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"humorous-zebra-189284.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015308; classtype:social-engineering; sid:6015308; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pickup-track.info/pages/ban.php)"; flow:established,to_server; http.uri; content:"/pages/ban.php"; startswith; fast_pattern; http.host; content:"pickup-track.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015309; classtype:social-engineering; sid:6015309; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (movie-watching-platform.netlify.app/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"movie-watching-platform.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015310; classtype:social-engineering; sid:6015310; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shiwang11.github.io/AMAZON.github.io/)"; flow:established,to_server; http.uri; content:"/AMAZON.github.io/"; startswith; fast_pattern; http.host; content:"shiwang11.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015311; classtype:social-engineering; sid:6015311; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ynlendirdstmkrkmayav.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ynlendirdstmkrkmayav.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015312; classtype:social-engineering; sid:6015312; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hawkfs.icu/snx/pr/)"; flow:established,to_server; http.uri; content:"/snx/pr/"; startswith; fast_pattern; http.host; content:"hawkfs.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015313; classtype:social-engineering; sid:6015313; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.team-kd.com/p/fhtb-mrgw/nwjrmgwv/)"; flow:established,to_server; http.uri; content:"/p/fhtb-mrgw/nwjrmgwv/"; startswith; fast_pattern; http.host; content:"s.team-kd.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015314; classtype:social-engineering; sid:6015314; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (springboardpools.com/wp-content/McCarthy_Holdings_Inc)"; flow:established,to_server; http.uri; content:"/wp-content/McCarthy_Holdings_Inc"; startswith; fast_pattern; http.host; content:"springboardpools.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015315; classtype:social-engineering; sid:6015315; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (neha-0858.github.io/final-first-year-project)"; flow:established,to_server; http.uri; content:"/final-first-year-project"; startswith; fast_pattern; http.host; content:"neha-0858.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015316; classtype:social-engineering; sid:6015316; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sslink.one/uo8m0Y?k=108ce071693577f7)"; flow:established,to_server; http.uri; content:"/uo8m0Y?k=108ce071693577f7"; startswith; fast_pattern; http.host; content:"sslink.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015317; classtype:social-engineering; sid:6015317; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deft-melomakarona-39ea10.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"deft-melomakarona-39ea10.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015318; classtype:social-engineering; sid:6015318; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trc20z.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trc20z.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015319; classtype:social-engineering; sid:6015319; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bry.hpj.mybluehost.me/wp-includes/NwKorea.html)"; flow:established,to_server; http.uri; content:"/wp-includes/NwKorea.html"; startswith; fast_pattern; http.host; content:"bry.hpj.mybluehost.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015320; classtype:social-engineering; sid:6015320; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dienst-k.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dienst-k.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015321; classtype:social-engineering; sid:6015321; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-yo3crc8m9.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-yo3crc8m9.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015322; classtype:social-engineering; sid:6015322; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verificarcuentae2026kkks.fwh.is/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"verificarcuentae2026kkks.fwh.is"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015323; classtype:social-engineering; sid:6015323; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qarzdeals.com/steve/netflix)"; flow:established,to_server; http.uri; content:"/steve/netflix"; startswith; fast_pattern; http.host; content:"qarzdeals.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015324; classtype:social-engineering; sid:6015324; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wrio012.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wrio012.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015325; classtype:social-engineering; sid:6015325; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yte-kurds.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yte-kurds.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015326; classtype:social-engineering; sid:6015326; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tezway.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tezway.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015327; classtype:social-engineering; sid:6015327; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.by22271.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.by22271.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015328; classtype:social-engineering; sid:6015328; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (buscarmeuiphone.com/?i=pkakn)"; flow:established,to_server; http.uri; content:"/?i=pkakn"; startswith; fast_pattern; http.host; content:"buscarmeuiphone.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015329; classtype:social-engineering; sid:6015329; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkinguu.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkinguu.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015330; classtype:social-engineering; sid:6015330; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopeetbk511.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopeetbk511.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015331; classtype:social-engineering; sid:6015331; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentatucupbancol.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aumentatucupbancol.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015332; classtype:social-engineering; sid:6015332; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aniketbhujad.github.io/netfilx-clone)"; flow:established,to_server; http.uri; content:"/netfilx-clone"; startswith; fast_pattern; http.host; content:"aniketbhujad.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015333; classtype:social-engineering; sid:6015333; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwwmaxlsc.xyz/4G)"; flow:established,to_server; http.uri; content:"/4G"; startswith; fast_pattern; http.host; content:"wwwmaxlsc.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015334; classtype:social-engineering; sid:6015334; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dienst-k.com/app/index.php?view=main&id=cf2b2f09c04d5be7675be468c0b34ae0)"; flow:established,to_server; http.uri; content:"/app/index.php?view=main&id=cf2b2f09c04d5be7675be468c0b34ae0"; startswith; fast_pattern; http.host; content:"dienst-k.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015335; classtype:social-engineering; sid:6015335; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wrio006.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wrio006.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015336; classtype:social-engineering; sid:6015336; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (admin.taggz.app/assets/fb-page-ads/)"; flow:established,to_server; http.uri; content:"/assets/fb-page-ads/"; startswith; fast_pattern; http.host; content:"admin.taggz.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015337; classtype:social-engineering; sid:6015337; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prakashrajbanshi14.github.io/Netflixclone/)"; flow:established,to_server; http.uri; content:"/Netflixclone/"; startswith; fast_pattern; http.host; content:"prakashrajbanshi14.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015338; classtype:social-engineering; sid:6015338; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www._dmarc.home-money.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www._dmarc.home-money.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015339; classtype:social-engineering; sid:6015339; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.365365g.app:443/chs/)"; flow:established,to_server; http.uri; content:"/chs/"; startswith; fast_pattern; http.host; content:"m.365365g.app:443"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015340; classtype:social-engineering; sid:6015340; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ultraviolett.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"ultraviolett.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015341; classtype:social-engineering; sid:6015341; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (holy-bird-c596.ilovegeniunes.workers.dev/refa/)"; flow:established,to_server; http.uri; content:"/refa/"; startswith; fast_pattern; http.host; content:"holy-bird-c596.ilovegeniunes.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015342; classtype:social-engineering; sid:6015342; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dhldocument.pdf89.co/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dhldocument.pdf89.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015343; classtype:social-engineering; sid:6015343; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sufiyan-mujawar2006.github.io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"sufiyan-mujawar2006.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015344; classtype:social-engineering; sid:6015344; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365365g.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.365365g.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015345; classtype:social-engineering; sid:6015345; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rzty-web-whatsapp.hk.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rzty-web-whatsapp.hk.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015346; classtype:social-engineering; sid:6015346; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nt5jc-uowkl9-amo9e7-shr-6ry.pages.dev/welcome_aboard?welcome=1310386448984550)"; flow:established,to_server; http.uri; content:"/welcome_aboard?welcome=1310386448984550"; startswith; fast_pattern; http.host; content:"nt5jc-uowkl9-amo9e7-shr-6ry.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015347; classtype:social-engineering; sid:6015347; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hoteljessica.com.co/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hoteljessica.com.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015348; classtype:social-engineering; sid:6015348; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nd.komocav.shop/priceoutletarea56/)"; flow:established,to_server; http.uri; content:"/priceoutletarea56/"; startswith; fast_pattern; http.host; content:"nd.komocav.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015349; classtype:social-engineering; sid:6015349; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (buscarmeuiphone.com/expire/)"; flow:established,to_server; http.uri; content:"/expire/"; startswith; fast_pattern; http.host; content:"buscarmeuiphone.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015350; classtype:social-engineering; sid:6015350; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ynlendirdstmkrkmayav.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ynlendirdstmkrkmayav.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015351; classtype:social-engineering; sid:6015351; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hoteljessica.com.co/casino/)"; flow:established,to_server; http.uri; content:"/casino/"; startswith; fast_pattern; http.host; content:"hoteljessica.com.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015352; classtype:social-engineering; sid:6015352; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortmove.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortmove.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015353; classtype:social-engineering; sid:6015353; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9000-firebase-release-1782165814022.cluster-mdgxqvvkkbfpqrfigfiuugu5pk.cloudworkstations.dev/?monospaceUid=916586)"; flow:established,to_server; http.uri; content:"/?monospaceUid=916586"; startswith; fast_pattern; http.host; content:"9000-firebase-release-1782165814022.cluster-mdgxqvvkkbfpqrfigfiuugu5pk.cloudworkstations.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015354; classtype:social-engineering; sid:6015354; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amalba.com.br/wp-content/friday/8f1aaclaimc56.html)"; flow:established,to_server; http.uri; content:"/wp-content/friday/8f1aaclaimc56.html"; startswith; fast_pattern; http.host; content:"amalba.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015355; classtype:social-engineering; sid:6015355; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (violetmaisvoce.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"violetmaisvoce.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015356; classtype:social-engineering; sid:6015356; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ppkonline.ingtfi24.pl/ppk-ing/ing/login)"; flow:established,to_server; http.uri; content:"/ppk-ing/ing/login"; startswith; fast_pattern; http.host; content:"ppkonline.ingtfi24.pl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015357; classtype:social-engineering; sid:6015357; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (68-221-169-7.cprapid.com/de/update.php)"; flow:established,to_server; http.uri; content:"/de/update.php"; startswith; fast_pattern; http.host; content:"68-221-169-7.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015358; classtype:social-engineering; sid:6015358; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vocesemfronteiranosseussonho.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"vocesemfronteiranosseussonho.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015359; classtype:social-engineering; sid:6015359; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acmv2.global.ssl.fastly.net/sp.html)"; flow:established,to_server; http.uri; content:"/sp.html"; startswith; fast_pattern; http.host; content:"acmv2.global.ssl.fastly.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015360; classtype:social-engineering; sid:6015360; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fortchecker.one/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fortchecker.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015361; classtype:social-engineering; sid:6015361; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (click-hostopoint-ch-redirect4624571.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"click-hostopoint-ch-redirect4624571.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015362; classtype:social-engineering; sid:6015362; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (test.vm2.skeps.io/d1e9fc/d1e9fc/zeb/)"; flow:established,to_server; http.uri; content:"/d1e9fc/d1e9fc/zeb/"; startswith; fast_pattern; http.host; content:"test.vm2.skeps.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015363; classtype:social-engineering; sid:6015363; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (annasilva.com.br/wp-includes/certificates/DUVzTTavlOw/?redirection=login)"; flow:established,to_server; http.uri; content:"/wp-includes/certificates/DUVzTTavlOw/?redirection=login"; startswith; fast_pattern; http.host; content:"annasilva.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015364; classtype:social-engineering; sid:6015364; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sia.inicioseguro.com/c/p/tc/3080/eece42f9-8c69-496a-a73d-054cd8cb10bb-79f1cb36-f9af-4af7-9acd-c4579cdfaf11/)"; flow:established,to_server; http.uri; content:"/c/p/tc/3080/eece42f9-8c69-496a-a73d-054cd8cb10bb-79f1cb36-f9af-4af7-9acd-c4579cdfaf11/"; startswith; fast_pattern; http.host; content:"sia.inicioseguro.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015365; classtype:social-engineering; sid:6015365; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pickup-track.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pickup-track.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015366; classtype:social-engineering; sid:6015366; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yahoolmailweb.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yahoolmailweb.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015367; classtype:social-engineering; sid:6015367; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (intermaticos.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"intermaticos.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015368; classtype:social-engineering; sid:6015368; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pt-shopee1122.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pt-shopee1122.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015369; classtype:social-engineering; sid:6015369; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.get-the-offer.net/?dmn=scotiaabankk.com&kws=&tkn=2VRYzw1K)"; flow:established,to_server; http.uri; content:"/?dmn=scotiaabankk.com&kws=&tkn=2VRYzw1K"; startswith; fast_pattern; http.host; content:"www.get-the-offer.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015370; classtype:social-engineering; sid:6015370; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iniciar-sesionmx-2026.iceiy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"iniciar-sesionmx-2026.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015371; classtype:social-engineering; sid:6015371; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail-owa-path-mail-inbox-glowing-guide-production.up.railway.app/#norisz@26030510777a19e716196bee6814b1b46824.com)"; flow:established,to_server; http.uri; content:"/#norisz@26030510777a19e716196bee6814b1b46824.com"; startswith; fast_pattern; http.host; content:"webmail-owa-path-mail-inbox-glowing-guide-production.up.railway.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015372; classtype:social-engineering; sid:6015372; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nt5jc-uowkl9-amo9e7-shr-6ry.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nt5jc-uowkl9-amo9e7-shr-6ry.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015373; classtype:social-engineering; sid:6015373; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (raphaelaguilar.matmcc.org/netsource/)"; flow:established,to_server; http.uri; content:"/netsource/"; startswith; fast_pattern; http.host; content:"raphaelaguilar.matmcc.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015374; classtype:social-engineering; sid:6015374; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.cf995.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.cf995.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015375; classtype:social-engineering; sid:6015375; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.aumento-cupovirtual.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.aumento-cupovirtual.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015376; classtype:social-engineering; sid:6015376; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (legderlive-synch.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"legderlive-synch.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015377; classtype:social-engineering; sid:6015377; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mssa.com.br/newsletter/netting/1/1/lsesion.php?c4e0e4e3118472beeb2ae75827450f1f=)"; flow:established,to_server; http.uri; content:"/newsletter/netting/1/1/lsesion.php?c4e0e4e3118472beeb2ae75827450f1f="; startswith; fast_pattern; http.host; content:"mssa.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015378; classtype:social-engineering; sid:6015378; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ingtfi24.pl/informacja-dla-nowego-uzytkownika)"; flow:established,to_server; http.uri; content:"/informacja-dla-nowego-uzytkownika"; startswith; fast_pattern; http.host; content:"www.ingtfi24.pl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015379; classtype:social-engineering; sid:6015379; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ohiphohi.b-cdn.net/all1.html)"; flow:established,to_server; http.uri; content:"/all1.html"; startswith; fast_pattern; http.host; content:"ohiphohi.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015380; classtype:social-engineering; sid:6015380; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.v0-coinbase-login-page.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.v0-coinbase-login-page.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015381; classtype:social-engineering; sid:6015381; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jansbdjiasdas.webcindario.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jansbdjiasdas.webcindario.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015382; classtype:social-engineering; sid:6015382; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ingtfi24.pl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ingtfi24.pl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015383; classtype:social-engineering; sid:6015383; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-page-builder--sabusnana.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-page-builder--sabusnana.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015384; classtype:social-engineering; sid:6015384; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anjalikumari72998-lang.github.io/AMAZON-clone/)"; flow:established,to_server; http.uri; content:"/AMAZON-clone/"; startswith; fast_pattern; http.host; content:"anjalikumari72998-lang.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015385; classtype:social-engineering; sid:6015385; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-yrcwyxkr5.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-yrcwyxkr5.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015386; classtype:social-engineering; sid:6015386; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wrio018.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wrio018.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015387; classtype:social-engineering; sid:6015387; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.365365g.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.365365g.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015388; classtype:social-engineering; sid:6015388; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sqlsculptor.github.io/netflix_clone/)"; flow:established,to_server; http.uri; content:"/netflix_clone/"; startswith; fast_pattern; http.host; content:"sqlsculptor.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015389; classtype:social-engineering; sid:6015389; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myshop-711-com-tw.dcpz99.link/ht/kefu.php?ClickID=187&amount=0.00)"; flow:established,to_server; http.uri; content:"/ht/kefu.php?ClickID=187&amount=0.00"; startswith; fast_pattern; http.host; content:"myshop-711-com-tw.dcpz99.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015390; classtype:social-engineering; sid:6015390; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.site-yrcwyxkr5.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.site-yrcwyxkr5.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015391; classtype:social-engineering; sid:6015391; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (invited-for-bluefree.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"invited-for-bluefree.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015392; classtype:social-engineering; sid:6015392; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (masukglobalkarir.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"masukglobalkarir.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015393; classtype:social-engineering; sid:6015393; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (q8f1c8d4a6e23f9c5d1a7b0e4c8f6291.57e7egs.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"q8f1c8d4a6e23f9c5d1a7b0e4c8f6291.57e7egs.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015394; classtype:social-engineering; sid:6015394; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.icloud-com.co/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.icloud-com.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015395; classtype:social-engineering; sid:6015395; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mettmaskewallett.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mettmaskewallett.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015396; classtype:social-engineering; sid:6015396; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (v0-coinbase-login-page.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"v0-coinbase-login-page.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015397; classtype:social-engineering; sid:6015397; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgerwalletdeviceupdateweb3.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledgerwalletdeviceupdateweb3.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015398; classtype:social-engineering; sid:6015398; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wrio009.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wrio009.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015399; classtype:social-engineering; sid:6015399; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wrio016.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wrio016.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015400; classtype:social-engineering; sid:6015400; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bjbet365.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bjbet365.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015401; classtype:social-engineering; sid:6015401; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingiss.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingiss.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015402; classtype:social-engineering; sid:6015402; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prakashrajbanshi14.github.io/amazonclone/)"; flow:established,to_server; http.uri; content:"/amazonclone/"; startswith; fast_pattern; http.host; content:"prakashrajbanshi14.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015403; classtype:social-engineering; sid:6015403; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.amazon-app7.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazon-app7.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015404; classtype:social-engineering; sid:6015404; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.web-git-06-17-featwebaddportfoliopoolsanimatednu-18150b-uniswap.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.web-git-06-17-featwebaddportfoliopoolsanimatednu-18150b-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015405; classtype:social-engineering; sid:6015405; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trc20z.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trc20z.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015406; classtype:social-engineering; sid:6015406; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yaffa48-stg.nadqa.nadsoft.co/wp-content/vvsy/global/cny/GlobalSources/?email=elar@e5e71c7255ac94e64615cf46719517b05417.net)"; flow:established,to_server; http.uri; content:"/wp-content/vvsy/global/cny/GlobalSources/?email=elar@e5e71c7255ac94e64615cf46719517b05417.net"; startswith; fast_pattern; http.host; content:"yaffa48-stg.nadqa.nadsoft.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015407; classtype:social-engineering; sid:6015407; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dhruvmistry022.github.io/DM/)"; flow:established,to_server; http.uri; content:"/DM/"; startswith; fast_pattern; http.host; content:"dhruvmistry022.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015408; classtype:social-engineering; sid:6015408; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.advanced-documents.com/?rg=WEU&urid=QC2l24RF4Esa0Z5eQyzLqMhgqbp4ptyYFz2U5Hmoj2JqKQq13xXmn-LlSkUXPi7dMGSAqYCEcQkcEoeUqUZ3gLdx5fjNAReQmKLc_BTFdXNMAVuE6RG02PumSj5w-EHCJXbRbh9RpCxu0P28)"; flow:established,to_server; http.uri; content:"/?rg=WEU&urid=QC2l24RF4Esa0Z5eQyzLqMhgqbp4ptyYFz2U5Hmoj2JqKQq13xXmn-LlSkUXPi7dMGSAqYCEcQkcEoeUqUZ3gLdx5fjNAReQmKLc_BTFdXNMAVuE6RG02PumSj5w-EHCJXbRbh9RpCxu0P28"; startswith; fast_pattern; http.host; content:"www.advanced-documents.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015409; classtype:social-engineering; sid:6015409; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clientlogin.eistee-mediart.de/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"clientlogin.eistee-mediart.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015410; classtype:social-engineering; sid:6015410; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (continuacaodavidaprospera.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"continuacaodavidaprospera.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015411; classtype:social-engineering; sid:6015411; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wrio005.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wrio005.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015412; classtype:social-engineering; sid:6015412; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.haematogenesis.gtyww.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.haematogenesis.gtyww.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015413; classtype:social-engineering; sid:6015413; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (credibdv.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"credibdv.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015414; classtype:social-engineering; sid:6015414; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure.367450.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"secure.367450.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015415; classtype:social-engineering; sid:6015415; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pt-lu595.github.io/pt-lu)"; flow:established,to_server; http.uri; content:"/pt-lu"; startswith; fast_pattern; http.host; content:"pt-lu595.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015416; classtype:social-engineering; sid:6015416; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wrio017.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wrio017.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015417; classtype:social-engineering; sid:6015417; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (priceoutletarea.com/l1/arcticairultraar/m1/?lnk=34447&m=571904e0ec7fbfee&s=4OyHK6eK)"; flow:established,to_server; http.uri; content:"/l1/arcticairultraar/m1/?lnk=34447&m=571904e0ec7fbfee&s=4OyHK6eK"; startswith; fast_pattern; http.host; content:"priceoutletarea.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015418; classtype:social-engineering; sid:6015418; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (868542.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"868542.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015419; classtype:social-engineering; sid:6015419; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure.367450.com/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"secure.367450.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015420; classtype:social-engineering; sid:6015420; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (waud-ehhhh4bwhxc6dth3.z03.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"waud-ehhhh4bwhxc6dth3.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015421; classtype:social-engineering; sid:6015421; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pt-shopee1122.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pt-shopee1122.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015422; classtype:social-engineering; sid:6015422; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (muskan350.github.io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"muskan350.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015423; classtype:social-engineering; sid:6015423; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (concordedvisory.com/3oxSzWbIq8F88RnPtcD6Rhuf04Q1NwgQ_96N53m4S6yV8lKee16R5j7hQ7W9Qp2idyF5cN59n4Uw59JsNrjEL9viP39b2OT2uPR3LWPC0YFD-EBkw1Y7X6031kHPVaJKVZR_GfNx66p7oL6Mxd0dZG6b1AGaa8uj_DBHiFpj8VwOC3kriJ0R9tb3zxPRzG69F3Y2m28mKoZ95G076SeYJ5P5Lx6v22COzbQQBBVXqEd01pP5l/Zr4pqJUO42IV)"; flow:established,to_server; http.uri; content:"/3oxSzWbIq8F88RnPtcD6Rhuf04Q1NwgQ_96N53m4S6yV8lKee16R5j7hQ7W9Qp2idyF5cN59n4Uw59JsNrjEL9viP39b2OT2uPR3LWPC0YFD-EBkw1Y7X6031kHPVaJKVZR_GfNx66p7oL6Mxd0dZG6b1AGaa8uj_DBHiFpj8VwOC3kriJ0R9tb3zxPRzG69F3Y2m28mKoZ95G076SeYJ5P5Lx6v22COzbQQBBVXqEd01pP5l/Zr4pqJUO42IV"; startswith; fast_pattern; http.host; content:"concordedvisory.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015424; classtype:social-engineering; sid:6015424; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (babar-nawaz.github.io/Amazon-Layout)"; flow:established,to_server; http.uri; content:"/Amazon-Layout"; startswith; fast_pattern; http.host; content:"babar-nawaz.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015425; classtype:social-engineering; sid:6015425; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee-tbk778.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopee-tbk778.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015426; classtype:social-engineering; sid:6015426; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maxudijal.uk.cc/5g)"; flow:established,to_server; http.uri; content:"/5g"; startswith; fast_pattern; http.host; content:"maxudijal.uk.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015427; classtype:social-engineering; sid:6015427; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-manager-settings.com/continue-pages)"; flow:established,to_server; http.uri; content:"/continue-pages"; startswith; fast_pattern; http.host; content:"business-manager-settings.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015428; classtype:social-engineering; sid:6015428; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dasi303.com/wp-admin/1drive/ff5757/index.html)"; flow:established,to_server; http.uri; content:"/wp-admin/1drive/ff5757/index.html"; startswith; fast_pattern; http.host; content:"dasi303.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015429; classtype:social-engineering; sid:6015429; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.msptag.top/pay/_frame/a_shop.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_shop.html"; startswith; fast_pattern; http.host; content:"t-mobile.msptag.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015430; classtype:social-engineering; sid:6015430; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (azfit.com.br/hudson/corporation.html)"; flow:established,to_server; http.uri; content:"/hudson/corporation.html"; startswith; fast_pattern; http.host; content:"azfit.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015431; classtype:social-engineering; sid:6015431; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ubs-ch.world/login/)"; flow:established,to_server; http.uri; content:"/login/"; startswith; fast_pattern; http.host; content:"ubs-ch.world"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015432; classtype:social-engineering; sid:6015432; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pralav00chauhan1.github.io/projectSem2)"; flow:established,to_server; http.uri; content:"/projectSem2"; startswith; fast_pattern; http.host; content:"pralav00chauhan1.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015433; classtype:social-engineering; sid:6015433; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portal--trezr-suite.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"portal--trezr-suite.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015434; classtype:social-engineering; sid:6015434; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wrio010.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wrio010.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015435; classtype:social-engineering; sid:6015435; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ppkonline.ingtfi24.pl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ppkonline.ingtfi24.pl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015436; classtype:social-engineering; sid:6015436; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (arjun-gohil.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"arjun-gohil.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015437; classtype:social-engineering; sid:6015437; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.package-global-tracking.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.package-global-tracking.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015438; classtype:social-engineering; sid:6015438; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sagarpydi.github.io/clone-amazon-website/)"; flow:established,to_server; http.uri; content:"/clone-amazon-website/"; startswith; fast_pattern; http.host; content:"sagarpydi.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015439; classtype:social-engineering; sid:6015439; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reelotv.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"reelotv.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015440; classtype:social-engineering; sid:6015440; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.caierba.it/tmp/2af07bc1-c285-4062-aa86-5848cc36794b/larpackit/)"; flow:established,to_server; http.uri; content:"/tmp/2af07bc1-c285-4062-aa86-5848cc36794b/larpackit/"; startswith; fast_pattern; http.host; content:"www.caierba.it"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015441; classtype:social-engineering; sid:6015441; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ashishcodes-hub.github.io/Amazone-Clone)"; flow:established,to_server; http.uri; content:"/Amazone-Clone"; startswith; fast_pattern; http.host; content:"ashishcodes-hub.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015442; classtype:social-engineering; sid:6015442; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-git-06-17-featwebaddportfoliopoolsanimatednu-18150b-uniswap.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-git-06-17-featwebaddportfoliopoolsanimatednu-18150b-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015443; classtype:social-engineering; sid:6015443; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (demo-8fc.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"demo-8fc.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015444; classtype:social-engineering; sid:6015444; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wrio020.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wrio020.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015445; classtype:social-engineering; sid:6015445; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreidpjfnryqk3cnzlvf3cuelz6cu2hf5ggwxvuehve5ssjg5oiiytwi.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreidpjfnryqk3cnzlvf3cuelz6cu2hf5ggwxvuehve5ssjg5oiiytwi.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015446; classtype:social-engineering; sid:6015446; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee-tbk778.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopee-tbk778.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015447; classtype:social-engineering; sid:6015447; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wordpress-212754-0.cloudclusters.net/lmefix/swisspass-sbbclient/ch1190083/)"; flow:established,to_server; http.uri; content:"/lmefix/swisspass-sbbclient/ch1190083/"; startswith; fast_pattern; http.host; content:"wordpress-212754-0.cloudclusters.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015448; classtype:social-engineering; sid:6015448; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clientlogin.eistee-mediart.de/login.php?websrc=77dab160d987730dc452ffcdb621579a&dispatched=42&id=1164705785)"; flow:established,to_server; http.uri; content:"/login.php?websrc=77dab160d987730dc452ffcdb621579a&dispatched=42&id=1164705785"; startswith; fast_pattern; http.host; content:"clientlogin.eistee-mediart.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015449; classtype:social-engineering; sid:6015449; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.wrio015.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.wrio015.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015450; classtype:social-engineering; sid:6015450; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yasernew.yaser-nateghi1.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yasernew.yaser-nateghi1.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015451; classtype:social-engineering; sid:6015451; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (server-index-page--petersimeon663.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"server-index-page--petersimeon663.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015452; classtype:social-engineering; sid:6015452; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (exactaluminums.com/sharepoint/sharepoint.html)"; flow:established,to_server; http.uri; content:"/sharepoint/sharepoint.html"; startswith; fast_pattern; http.host; content:"exactaluminums.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015453; classtype:social-engineering; sid:6015453; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (annasilva.com.br/wp-includes/certificates)"; flow:established,to_server; http.uri; content:"/wp-includes/certificates"; startswith; fast_pattern; http.host; content:"annasilva.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015454; classtype:social-engineering; sid:6015454; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (muskan350.github.io/Netflix_Clone/)"; flow:established,to_server; http.uri; content:"/Netflix_Clone/"; startswith; fast_pattern; http.host; content:"muskan350.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015455; classtype:social-engineering; sid:6015455; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (azfit.com.br/sahmel/associates.html)"; flow:established,to_server; http.uri; content:"/sahmel/associates.html"; startswith; fast_pattern; http.host; content:"azfit.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015456; classtype:social-engineering; sid:6015456; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee2939.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopee2939.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015457; classtype:social-engineering; sid:6015457; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloud-com.co/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"icloud-com.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015458; classtype:social-engineering; sid:6015458; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (specific-slippery-cpu.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"specific-slippery-cpu.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015459; classtype:social-engineering; sid:6015459; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (raghav-0808.github.io/amazon_clone/)"; flow:established,to_server; http.uri; content:"/amazon_clone/"; startswith; fast_pattern; http.host; content:"raghav-0808.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015460; classtype:social-engineering; sid:6015460; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreidzucisbrwkihjcbqdjbykcvgrsqgcypgdpqdnoc3ueck7f7fk75e.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreidzucisbrwkihjcbqdjbykcvgrsqgcypgdpqdnoc3ueck7f7fk75e.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015461; classtype:social-engineering; sid:6015461; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (samradh4.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"samradh4.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015462; classtype:social-engineering; sid:6015462; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wingboard.b-cdn.net/PROOF%20OF%20PAYMENT%2022TH.html)"; flow:established,to_server; http.uri; content:"/PROOF%20OF%20PAYMENT%2022TH.html"; startswith; fast_pattern; http.host; content:"wingboard.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015463; classtype:social-engineering; sid:6015463; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iniciamazon.com.br/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"iniciamazon.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015464; classtype:social-engineering; sid:6015464; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumento-cupovirtual.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aumento-cupovirtual.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015465; classtype:social-engineering; sid:6015465; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (supportscloud.us/ICL26)"; flow:established,to_server; http.uri; content:"/ICL26"; startswith; fast_pattern; http.host; content:"supportscloud.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015466; classtype:social-engineering; sid:6015466; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (teach.laitiaozhan.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"teach.laitiaozhan.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015467; classtype:social-engineering; sid:6015467; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shiwang11.github.io/AMAZON.github.io)"; flow:established,to_server; http.uri; content:"/AMAZON.github.io"; startswith; fast_pattern; http.host; content:"shiwang11.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015468; classtype:social-engineering; sid:6015468; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chymnrmp.pages.dev/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"chymnrmp.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015469; classtype:social-engineering; sid:6015469; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wrio011.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wrio011.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015470; classtype:social-engineering; sid:6015470; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (strt-trezrio.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"strt-trezrio.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015471; classtype:social-engineering; sid:6015471; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wordpress-212781-0.cloudclusters.net/finAzld/swisspass-sbbclientccf/c3Bhc3Mtc2JiY2/)"; flow:established,to_server; http.uri; content:"/finAzld/swisspass-sbbclientccf/c3Bhc3Mtc2JiY2/"; startswith; fast_pattern; http.host; content:"wordpress-212781-0.cloudclusters.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015472; classtype:social-engineering; sid:6015472; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (doglep.com/sign-in?hash=2&language=en&op_token=JzzN2sCBRb0ik7FDOzNGxoxGedzzDoGkk5aqWHwsRG6fZY1MtjSoGycsaVgtmbzg3MRjilwqIwfGCKHWeMYOl8mzYSKbIBQJFWY&uuid=afc99a94-766f-4051-becb-fc7da2666b9d)"; flow:established,to_server; http.uri; content:"/sign-in?hash=2&language=en&op_token=JzzN2sCBRb0ik7FDOzNGxoxGedzzDoGkk5aqWHwsRG6fZY1MtjSoGycsaVgtmbzg3MRjilwqIwfGCKHWeMYOl8mzYSKbIBQJFWY&uuid=afc99a94-766f-4051-becb-fc7da2666b9d"; startswith; fast_pattern; http.host; content:"doglep.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015473; classtype:social-engineering; sid:6015473; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usdt007.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"usdt007.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015474; classtype:social-engineering; sid:6015474; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clubmilesz.com/ec)"; flow:established,to_server; http.uri; content:"/ec"; startswith; fast_pattern; http.host; content:"clubmilesz.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015475; classtype:social-engineering; sid:6015475; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (index-accesprime.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"index-accesprime.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015476; classtype:social-engineering; sid:6015476; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a2bd2b5e-4b3a-4b38-a3c4-d258ef9a215f-00-3mtbnxyp38d1f.kirk.replit.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a2bd2b5e-4b3a-4b38-a3c4-d258ef9a215f-00-3mtbnxyp38d1f.kirk.replit.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015477; classtype:social-engineering; sid:6015477; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (herrynardfulpr.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"herrynardfulpr.blogspot.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015478; classtype:social-engineering; sid:6015478; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.credit-metuell.s-host.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mail.credit-metuell.s-host.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015479; classtype:social-engineering; sid:6015479; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (primevideo-portail.com/index.php)"; flow:established,to_server; http.uri; content:"/index.php"; startswith; fast_pattern; http.host; content:"primevideo-portail.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015480; classtype:social-engineering; sid:6015480; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (garyg2131.wixsite.com/my-site-1)"; flow:established,to_server; http.uri; content:"/my-site-1"; startswith; fast_pattern; http.host; content:"garyg2131.wixsite.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015481; classtype:social-engineering; sid:6015481; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bonusamais.com/1/2/?hash=029f60f0e5f9bb7e76938984eaa60a56)"; flow:established,to_server; http.uri; content:"/1/2/?hash=029f60f0e5f9bb7e76938984eaa60a56"; startswith; fast_pattern; http.host; content:"bonusamais.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015482; classtype:social-engineering; sid:6015482; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (credit-metuell.s-host.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"credit-metuell.s-host.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015483; classtype:social-engineering; sid:6015483; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ebk-konto.com/app/)"; flow:established,to_server; http.uri; content:"/app/"; startswith; fast_pattern; http.host; content:"ebk-konto.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015484; classtype:social-engineering; sid:6015484; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nubank-iota.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nubank-iota.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015485; classtype:social-engineering; sid:6015485; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (btc230.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"btc230.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015486; classtype:social-engineering; sid:6015486; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpd-noticp.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.dpd-noticp.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015487; classtype:social-engineering; sid:6015487; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cpcontacts.20-40-57-175.cprapid.com/art?c_ds_na=nuRYZW4i61Po8YcNPGDy97RHN1vkEk0RPzDRqcinX1&c_ds_no=%2A%2F%2A)"; flow:established,to_server; http.uri; content:"/art?c_ds_na=nuRYZW4i61Po8YcNPGDy97RHN1vkEk0RPzDRqcinX1&c_ds_no=%2A%2F%2A"; startswith; fast_pattern; http.host; content:"cpcontacts.20-40-57-175.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015488; classtype:social-engineering; sid:6015488; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bodbc.cc/ph/)"; flow:established,to_server; http.uri; content:"/ph/"; startswith; fast_pattern; http.host; content:"bodbc.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015489; classtype:social-engineering; sid:6015489; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.allcardsv3.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.allcardsv3.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015490; classtype:social-engineering; sid:6015490; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-offical.buzz/profile)"; flow:established,to_server; http.uri; content:"/profile"; startswith; fast_pattern; http.host; content:"amazon-offical.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015491; classtype:social-engineering; sid:6015491; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stearncommunity.com/tradeoffr/nev/partnr=103645878947&token=m82kZD0)"; flow:established,to_server; http.uri; content:"/tradeoffr/nev/partnr=103645878947&token=m82kZD0"; startswith; fast_pattern; http.host; content:"stearncommunity.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015492; classtype:social-engineering; sid:6015492; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sluehwe8ns3d.swipepages.net/xfini/)"; flow:established,to_server; http.uri; content:"/xfini/"; startswith; fast_pattern; http.host; content:"sluehwe8ns3d.swipepages.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015493; classtype:social-engineering; sid:6015493; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rodrigomercado1808-dev.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"rodrigomercado1808-dev.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015494; classtype:social-engineering; sid:6015494; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (katalogwww.pages.dev/listings/facebook/)"; flow:established,to_server; http.uri; content:"/listings/facebook/"; startswith; fast_pattern; http.host; content:"katalogwww.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015495; classtype:social-engineering; sid:6015495; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (modeel-dpuxqwbcglha.edgeone.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"modeel-dpuxqwbcglha.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015496; classtype:social-engineering; sid:6015496; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gov.parking-fines.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"gov.parking-fines.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015497; classtype:social-engineering; sid:6015497; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.maison-orbey.de/wp-content/plugins/xleet/b/g/index2.php?email=yyuzqrlzf@rytnbuy.wpz/)"; flow:established,to_server; http.uri; content:"/wp-content/plugins/xleet/b/g/index2.php?email=yyuzqrlzf@rytnbuy.wpz/"; startswith; fast_pattern; http.host; content:"www.maison-orbey.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015498; classtype:social-engineering; sid:6015498; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toki-gov-tr-14.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"toki-gov-tr-14.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015499; classtype:social-engineering; sid:6015499; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cancelar-proceso-suspencion-en-cuenta--ultimo-aviso.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cancelar-proceso-suspencion-en-cuenta--ultimo-aviso.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015500; classtype:social-engineering; sid:6015500; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.technicalsupportdesk.pro/trst/216273c24f9905bf/)"; flow:established,to_server; http.uri; content:"/trst/216273c24f9905bf/"; startswith; fast_pattern; http.host; content:"www.technicalsupportdesk.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015501; classtype:social-engineering; sid:6015501; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sign.webaccess-alert.com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/"; startswith; fast_pattern; http.host; content:"sign.webaccess-alert.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015502; classtype:social-engineering; sid:6015502; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (worvaqel-biz-zormireta-h2t6pc94.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"worvaqel-biz-zormireta-h2t6pc94.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015503; classtype:social-engineering; sid:6015503; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faceboook.zapisy-teraz.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"faceboook.zapisy-teraz.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015504; classtype:social-engineering; sid:6015504; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gov.parking-fine.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"gov.parking-fine.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015505; classtype:social-engineering; sid:6015505; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloud-auth.info/help?7uD)"; flow:established,to_server; http.uri; content:"/help?7uD"; startswith; fast_pattern; http.host; content:"icloud-auth.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015506; classtype:social-engineering; sid:6015506; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (priyanshimathuria.github.io/Frontend-Practice-Project/)"; flow:established,to_server; http.uri; content:"/Frontend-Practice-Project/"; startswith; fast_pattern; http.host; content:"priyanshimathuria.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015507; classtype:social-engineering; sid:6015507; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kitcaferacer.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kitcaferacer.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015508; classtype:social-engineering; sid:6015508; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reqnosa.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"reqnosa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015509; classtype:social-engineering; sid:6015509; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mediache.net/AL/Login.html)"; flow:established,to_server; http.uri; content:"/AL/Login.html"; startswith; fast_pattern; http.host; content:"mediache.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015510; classtype:social-engineering; sid:6015510; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verifysignportal.net/ch/postfinance)"; flow:established,to_server; http.uri; content:"/ch/postfinance"; startswith; fast_pattern; http.host; content:"verifysignportal.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015511; classtype:social-engineering; sid:6015511; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.qbhelpscheduler.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.qbhelpscheduler.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015512; classtype:social-engineering; sid:6015512; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shaksham-ml.github.io/netflix-landing-page-clone/)"; flow:established,to_server; http.uri; content:"/netflix-landing-page-clone/"; startswith; fast_pattern; http.host; content:"shaksham-ml.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015513; classtype:social-engineering; sid:6015513; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.160tyesy.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.160tyesy.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015514; classtype:social-engineering; sid:6015514; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whats-app-applicatie-berichten54090.netlify.app/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"whats-app-applicatie-berichten54090.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015515; classtype:social-engineering; sid:6015515; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robloxmax.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"robloxmax.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015516; classtype:social-engineering; sid:6015516; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trackingservice.monday.com/tracker/link?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvcmlnaW5hbFVybCI6Imh0dHBzOi8vYXZhbnRlc2hpcHBpbmcuY29tLy0vYXBwZXNiZGsiLCJlbWFpbElkIjoiZjQ3OTUxOTEtZmU0Ni00NzdiLWJlNWMtNmEwODEyMjliNzg5IiwiaWF0IjoxNzgyMjkwMTMxfQ.beIq4G3BLkA0trHhUBShEAgP_Rceo0ainz4rbv_sRHQ&r=euc1)"; flow:established,to_server; http.uri; content:"/tracker/link?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvcmlnaW5hbFVybCI6Imh0dHBzOi8vYXZhbnRlc2hpcHBpbmcuY29tLy0vYXBwZXNiZGsiLCJlbWFpbElkIjoiZjQ3OTUxOTEtZmU0Ni00NzdiLWJlNWMtNmEwODEyMjliNzg5IiwiaWF0IjoxNzgyMjkwMTMxfQ.beIq4G3BLkA0trHhUBShEAgP_Rceo0ainz4rbv_sRHQ&r=euc1"; startswith; fast_pattern; http.host; content:"trackingservice.monday.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015517; classtype:social-engineering; sid:6015517; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.biymu.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"login.biymu.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015518; classtype:social-engineering; sid:6015518; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amna-jameel.github.io/facebook-login-clone/)"; flow:established,to_server; http.uri; content:"/facebook-login-clone/"; startswith; fast_pattern; http.host; content:"amna-jameel.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015519; classtype:social-engineering; sid:6015519; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hfmthsga.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hfmthsga.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015520; classtype:social-engineering; sid:6015520; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledhjgfdh-sdfjghd.pages.dev/index.htm/)"; flow:established,to_server; http.uri; content:"/index.htm/"; startswith; fast_pattern; http.host; content:"ledhjgfdh-sdfjghd.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015521; classtype:social-engineering; sid:6015521; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (epicgames-fortnite-org.world/id/login)"; flow:established,to_server; http.uri; content:"/id/login"; startswith; fast_pattern; http.host; content:"epicgames-fortnite-org.world"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015522; classtype:social-engineering; sid:6015522; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7922.tokenpocket.usdtweb3.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7922.tokenpocket.usdtweb3.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015523; classtype:social-engineering; sid:6015523; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-mu-hazel.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-mu-hazel.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015524; classtype:social-engineering; sid:6015524; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cpcalendars.20-40-57-175.cprapid.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cpcalendars.20-40-57-175.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015525; classtype:social-engineering; sid:6015525; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gastric-rose-hwpw4awz.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gastric-rose-hwpw4awz.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015526; classtype:social-engineering; sid:6015526; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shy-wave-b6dafe01.shabalala.workers.dev/common/oauth2/v2.0/authorize/)"; flow:established,to_server; http.uri; content:"/common/oauth2/v2.0/authorize/"; startswith; fast_pattern; http.host; content:"shy-wave-b6dafe01.shabalala.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015527; classtype:social-engineering; sid:6015527; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wikii--trezurwallet.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wikii--trezurwallet.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015528; classtype:social-engineering; sid:6015528; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (160tyesy.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"160tyesy.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015529; classtype:social-engineering; sid:6015529; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.p-diesnt.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.p-diesnt.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015530; classtype:social-engineering; sid:6015530; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingsis.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingsis.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015531; classtype:social-engineering; sid:6015531; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (early-harlequin-utnj57ge.edgeone.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"early-harlequin-utnj57ge.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015532; classtype:social-engineering; sid:6015532; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hotelsonesta.in/elon/rss/css/index)"; flow:established,to_server; http.uri; content:"/elon/rss/css/index"; startswith; fast_pattern; http.host; content:"hotelsonesta.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015533; classtype:social-engineering; sid:6015533; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (unnatisharma03.github.io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"unnatisharma03.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015534; classtype:social-engineering; sid:6015534; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (konsultoresscpkoral.com/protected-document17062026bxie983hxjos/core.html)"; flow:established,to_server; http.uri; content:"/protected-document17062026bxie983hxjos/core.html"; startswith; fast_pattern; http.host; content:"konsultoresscpkoral.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015535; classtype:social-engineering; sid:6015535; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (documentttttt.us-southeast-1.linodeobjects.com/J-Document.html)"; flow:established,to_server; http.uri; content:"/J-Document.html"; startswith; fast_pattern; http.host; content:"documentttttt.us-southeast-1.linodeobjects.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015536; classtype:social-engineering; sid:6015536; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (arshina896.github.io/instagram/)"; flow:established,to_server; http.uri; content:"/instagram/"; startswith; fast_pattern; http.host; content:"arshina896.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015537; classtype:social-engineering; sid:6015537; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nishkarsh71.github.io/Mini-Project/)"; flow:established,to_server; http.uri; content:"/Mini-Project/"; startswith; fast_pattern; http.host; content:"nishkarsh71.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015538; classtype:social-engineering; sid:6015538; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (serviceupdatevalidator.serveousercontent.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"serviceupdatevalidator.serveousercontent.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015539; classtype:social-engineering; sid:6015539; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docussign-0ca550.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"docussign-0ca550.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015540; classtype:social-engineering; sid:6015540; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (center-trezo-io-eng.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"center-trezo-io-eng.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015541; classtype:social-engineering; sid:6015541; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robinhooldogin.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"robinhooldogin.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015542; classtype:social-engineering; sid:6015542; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fortlexp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fortlexp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015543; classtype:social-engineering; sid:6015543; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fortnite-inv.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fortnite-inv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015544; classtype:social-engineering; sid:6015544; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (riciclacarta.it/wtlist/)"; flow:established,to_server; http.uri; content:"/wtlist/"; startswith; fast_pattern; http.host; content:"riciclacarta.it"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015545; classtype:social-engineering; sid:6015545; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail-spectrum-net-html.framer.website/?referer=urlvanish.com%2Fa76938ba)"; flow:established,to_server; http.uri; content:"/?referer=urlvanish.com%2Fa76938ba"; startswith; fast_pattern; http.host; content:"mail-spectrum-net-html.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015546; classtype:social-engineering; sid:6015546; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (itau-unibanco.ph/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"itau-unibanco.ph"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015547; classtype:social-engineering; sid:6015547; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cbstakes.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cbstakes.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015548; classtype:social-engineering; sid:6015548; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verticecapital.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"verticecapital.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015549; classtype:social-engineering; sid:6015549; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (selnavox-biz-zormeluta-r6t5cy91.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"selnavox-biz-zormeluta-r6t5cy91.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015550; classtype:social-engineering; sid:6015550; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sadxq.shkul.com/DHX5gHumBjuUprgB?q=Y2xpZW50LXJlcXVlc3QtaWQ9Y2RkMjUyN2QtMjI3OS00NTJjLWI3M2EtNzBiNTJhMmNiNzQ0JmNsaWVudF9pZD00NzY1NDQ1Yi0zMmM2LTQ5YjAtODNlNi0xZDkzNzY1Mjc2Y2EmbWt0PWVuLVVTJm5vbmNlPTYzOTE3OTMzNjQ2OTk0MDgxNi5NbU5oWW1NeVpEY3RZakpoTkMwMFptRm1MVGc1WmpndE16VXdNVEJrWkdabU16TmhaamhoTm1NeE1tUXRNMkZoTnkwME5qVXhMV0ZsTkdVdFpUYzFNbVptT1RBeVpXSmgmcmVkaXJlY3RfdXJpPWh0dHBzJTNBJTJGJTJGd3d3Lm9mZmljZS5jb20lMkZsYW5kaW5ndjImcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3QmcmVzcG9uc2VfdHlwZT1jb2RlK2lkX3Rva2VuJnNjb3BlPW9wZW5pZCtwcm9maWxlK2h0dHBzJTNBJTJGJTJGd3d3Lm9mZmljZS5jb20lMkZ2MiUyRk9mZmljZUhvbWUuQWxsJnN0YXRlPU1fNGpnV1JBY1NBY3VxOHBRQi16R3oyMktxaEVSdWVMdjExR0ZfSHVMcHd4Yl9wbFoyZDlUNjRndTdkOGdfUG01Q01qdXFrNGllVllhR1E4Rk5GZ2lUUVJrOVVNUG54YUZTTEdxQzY3UWhCQWs1a19taktkVS1JMmMzYmxHRnB6Nkc5YWdwMzlqTTJqMTBua0wxX0tNV3duZzk2MDhEZlkwX3VfTjFoaEJuWlY5UllsSzBTZ18xaFVBUVdITkwyX01mbUtfTWVCLVJKbmVaaWJJLVFmam1JX1Q1eU1ZM1VBdUNiLWhVRkMxcUpxdkViLXVmLUtzS05UdFVMUEFjZVZ1ZkNqd3U4MXppSFhyMS1iV3RkNEJlVWZXQ28xNjAxRW9LbjRiUTdoYVg3NUxkTGxhMmhnXzZxSmpEZzdKbFlUSHhUdEp5V1ZlckNpVHdnQVIzZnlnRVo3SG5hRVFJQnNiQ1VqUDhtT21ROUFybEtITGc0ZHhvand1eGJOc2NFZWdwV3Z5Mm9CMG5FQ3I3S2licE9ROTVqdnZxajRTU05VbXExQTZaU2hEMTgmdWlfbG9jYWxlcz1lbi1VUyZ4LWNsaWVudC1TS1U9SURfTkVUOF8wJngtY2xpZW50LXZlcj04LjE0LjAuMA%3D%3D)"; flow:established,to_server; http.uri; content:"/DHX5gHumBjuUprgB?q=Y2xpZW50LXJlcXVlc3QtaWQ9Y2RkMjUyN2QtMjI3OS00NTJjLWI3M2EtNzBiNTJhMmNiNzQ0JmNsaWVudF9pZD00NzY1NDQ1Yi0zMmM2LTQ5YjAtODNlNi0xZDkzNzY1Mjc2Y2EmbWt0PWVuLVVTJm5vbmNlPTYzOTE3OTMzNjQ2OTk0MDgxNi5NbU5oWW1NeVpEY3RZakpoTkMwMFptRm1MVGc1WmpndE16VXdNVEJrWkdabU16TmhaamhoTm1NeE1tUXRNMkZoTnkwME5qVXhMV0ZsTkdVdFpUYzFNbVptT1RBeVpXSmgmcmVkaXJlY3RfdXJpPWh0dHBzJTNBJTJGJTJGd3d3Lm9mZmljZS5jb20lMkZsYW5kaW5ndjImcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3QmcmVzcG9uc2VfdHlwZT1jb2RlK2lkX3Rva2VuJnNjb3BlPW9wZW5pZCtwcm9maWxlK2h0dHBzJTNBJTJGJTJGd3d3Lm9mZmljZS5jb20lMkZ2MiUyRk9mZmljZUhvbWUuQWxsJnN0YXRlPU1fNGpnV1JBY1NBY3VxOHBRQi16R3oyMktxaEVSdWVMdjExR0ZfSHVMcHd4Yl9wbFoyZDlUNjRndTdkOGdfUG01Q01qdXFrNGllVllhR1E4Rk5GZ2lUUVJrOVVNUG54YUZTTEdxQzY3UWhCQWs1a19taktkVS1JMmMzYmxHRnB6Nkc5YWdwMzlqTTJqMTBua0wxX0tNV3duZzk2MDhEZlkwX3VfTjFoaEJuWlY5UllsSzBTZ18xaFVBUVdITkwyX01mbUtfTWVCLVJKbmVaaWJJLVFmam1JX1Q1eU1ZM1VBdUNiLWhVRkMxcUpxdkViLXVmLUtzS05UdFVMUEFjZVZ1ZkNqd3U4MXppSFhyMS1iV3RkNEJlVWZXQ28xNjAxRW9LbjRiUTdoYVg3NUxkTGxhMmhnXzZxSmpEZzdKbFlUSHhUdEp5V1ZlckNpVHdnQVIzZnlnRVo3SG5hRVFJQnNiQ1VqUDhtT21ROUFybEtITGc0ZHhvand1eGJOc2NFZWdwV3Z5Mm9CMG5FQ3I3S2licE9ROTVqdnZxajRTU05VbXExQTZaU2hEMTgmdWlfbG9jYWxlcz1lbi1VUyZ4LWNsaWVudC1TS1U9SURfTkVUOF8wJngtY2xpZW50LXZlcj04LjE0LjAuMA%3D%3D"; startswith; fast_pattern; http.host; content:"sadxq.shkul.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015551; classtype:social-engineering; sid:6015551; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamask-scam.blogspot.com/2023/01/?m=1)"; flow:established,to_server; http.uri; content:"/2023/01/?m=1"; startswith; fast_pattern; http.host; content:"metamask-scam.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015552; classtype:social-engineering; sid:6015552; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (guia-miranda.028426.com/s/63bzgfsvbwsfcdx7y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63bzgfsvbwsfcdx7y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"guia-miranda.028426.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015553; classtype:social-engineering; sid:6015553; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafybeifz7lwau4w4z7awqjzujhgnff4lpwxrj533xk3n6skzpjmvzpyhvi.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafybeifz7lwau4w4z7awqjzujhgnff4lpwxrj533xk3n6skzpjmvzpyhvi.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015554; classtype:social-engineering; sid:6015554; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dicepencilpaper.com/project.php/)"; flow:established,to_server; http.uri; content:"/project.php/"; startswith; fast_pattern; http.host; content:"dicepencilpaper.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015555; classtype:social-engineering; sid:6015555; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gov.parking-fines.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"gov.parking-fines.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015556; classtype:social-engineering; sid:6015556; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (doanh-netflix.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"doanh-netflix.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015557; classtype:social-engineering; sid:6015557; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pestcontroluxbridge.ca/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pestcontroluxbridge.ca"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015558; classtype:social-engineering; sid:6015558; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-ledgerapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-ledgerapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015559; classtype:social-engineering; sid:6015559; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (securityawareness.cc/landing/form/e605eb51-888f-4d6d-a40d-264c04eaab07)"; flow:established,to_server; http.uri; content:"/landing/form/e605eb51-888f-4d6d-a40d-264c04eaab07"; startswith; fast_pattern; http.host; content:"securityawareness.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015560; classtype:social-engineering; sid:6015560; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lalekostum.com/doc/adobe/index.html)"; flow:established,to_server; http.uri; content:"/doc/adobe/index.html"; startswith; fast_pattern; http.host; content:"lalekostum.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015561; classtype:social-engineering; sid:6015561; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dougtallmadge.github.io/amex-platinum-clone-v2)"; flow:established,to_server; http.uri; content:"/amex-platinum-clone-v2"; startswith; fast_pattern; http.host; content:"dougtallmadge.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015562; classtype:social-engineering; sid:6015562; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.163tyesy.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.163tyesy.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015563; classtype:social-engineering; sid:6015563; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.metamaskverifyweb3.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.metamaskverifyweb3.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015564; classtype:social-engineering; sid:6015564; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cre-ditagricole-iinfotys.iceiy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cre-ditagricole-iinfotys.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015565; classtype:social-engineering; sid:6015565; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.my-facebook-blog.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.my-facebook-blog.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015566; classtype:social-engineering; sid:6015566; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.proyectosgonbi.com/wp-admin/user/loadz/body.html?js=true)"; flow:established,to_server; http.uri; content:"/wp-admin/user/loadz/body.html?js=true"; startswith; fast_pattern; http.host; content:"www.proyectosgonbi.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015567; classtype:social-engineering; sid:6015567; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blockchain-clone-lyart.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"blockchain-clone-lyart.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015568; classtype:social-engineering; sid:6015568; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toki-gov-tr-14.vercel.app/giris.php)"; flow:established,to_server; http.uri; content:"/giris.php"; startswith; fast_pattern; http.host; content:"toki-gov-tr-14.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015569; classtype:social-engineering; sid:6015569; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ifeoma200715.github.io/Netflix-Cloned-Project/)"; flow:established,to_server; http.uri; content:"/Netflix-Cloned-Project/"; startswith; fast_pattern; http.host; content:"ifeoma200715.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015570; classtype:social-engineering; sid:6015570; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.devmontannasuniswap-clone.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.devmontannasuniswap-clone.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015571; classtype:social-engineering; sid:6015571; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.packages-global-tracking.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.packages-global-tracking.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015572; classtype:social-engineering; sid:6015572; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (workspacestudioservices.com/ftx/page.html)"; flow:established,to_server; http.uri; content:"/ftx/page.html"; startswith; fast_pattern; http.host; content:"workspacestudioservices.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015573; classtype:social-engineering; sid:6015573; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortrev.co/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortrev.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015574; classtype:social-engineering; sid:6015574; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pratistaglow.com/m/login)"; flow:established,to_server; http.uri; content:"/m/login"; startswith; fast_pattern; http.host; content:"pratistaglow.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015575; classtype:social-engineering; sid:6015575; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (exciting-context-711590.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"exciting-context-711590.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015576; classtype:social-engineering; sid:6015576; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (masakkaktivasyondogrula.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"masakkaktivasyondogrula.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015577; classtype:social-engineering; sid:6015577; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ytyuyuyu.news/30p/)"; flow:established,to_server; http.uri; content:"/30p/"; startswith; fast_pattern; http.host; content:"www.ytyuyuyu.news"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015578; classtype:social-engineering; sid:6015578; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mmbxcdfg.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mmbxcdfg.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015579; classtype:social-engineering; sid:6015579; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.click-hostopoint-ch-redirect5824312.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.click-hostopoint-ch-redirect5824312.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015580; classtype:social-engineering; sid:6015580; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.adsclub.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.adsclub.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015581; classtype:social-engineering; sid:6015581; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (packages-global-tracking.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"packages-global-tracking.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015582; classtype:social-engineering; sid:6015582; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagramnsjdbdjbd.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagramnsjdbdjbd.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015583; classtype:social-engineering; sid:6015583; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rumoaosucesso.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"rumoaosucesso.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015584; classtype:social-engineering; sid:6015584; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cn.memxzf.com/home/register?code=40555)"; flow:established,to_server; http.uri; content:"/home/register?code=40555"; startswith; fast_pattern; http.host; content:"cn.memxzf.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015585; classtype:social-engineering; sid:6015585; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cpcontacts.20-40-57-175.cprapid.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cpcontacts.20-40-57-175.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015586; classtype:social-engineering; sid:6015586; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adminitracion-serviciosbhd2026.iceiy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"adminitracion-serviciosbhd2026.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015587; classtype:social-engineering; sid:6015587; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blockchain-clone-lyart.bercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"blockchain-clone-lyart.bercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015588; classtype:social-engineering; sid:6015588; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (urbaferrari-lgtm.github.io/Netflix/)"; flow:established,to_server; http.uri; content:"/Netflix/"; startswith; fast_pattern; http.host; content:"urbaferrari-lgtm.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015589; classtype:social-engineering; sid:6015589; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (163tyesy.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"163tyesy.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015590; classtype:social-engineering; sid:6015590; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpd-noticp.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpd-noticp.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015591; classtype:social-engineering; sid:6015591; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amna-jameel.github.io/login-page-ui-clone/)"; flow:established,to_server; http.uri; content:"/login-page-ui-clone/"; startswith; fast_pattern; http.host; content:"amna-jameel.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015592; classtype:social-engineering; sid:6015592; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (onlineservicetec.com/landingpages/90d69b1d-cc46-48a6-8a25-a3222e9cce64/uav_usonfsaxnvby-4z2ughpj76_dljgiidxbz7r33m)"; flow:established,to_server; http.uri; content:"/landingpages/90d69b1d-cc46-48a6-8a25-a3222e9cce64/uav_usonfsaxnvby-4z2ughpj76_dljgiidxbz7r33m"; startswith; fast_pattern; http.host; content:"onlineservicetec.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015593; classtype:social-engineering; sid:6015593; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.smartconsulate.com/wp-includes/talibansource.html)"; flow:established,to_server; http.uri; content:"/wp-includes/talibansource.html"; startswith; fast_pattern; http.host; content:"www.smartconsulate.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015594; classtype:social-engineering; sid:6015594; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mbalimasango-hue.github.io/Kindly-share-a-quotation./Please%20Quote)"; flow:established,to_server; http.uri; content:"/Kindly-share-a-quotation./Please%20Quote"; startswith; fast_pattern; http.host; content:"mbalimasango-hue.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015595; classtype:social-engineering; sid:6015595; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secureb.devrev.cardpix.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secureb.devrev.cardpix.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015596; classtype:social-engineering; sid:6015596; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.edoctransfer.com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/"; startswith; fast_pattern; http.host; content:"login.edoctransfer.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015597; classtype:social-engineering; sid:6015597; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (itauconsorcios.net.br/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"itauconsorcios.net.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015598; classtype:social-engineering; sid:6015598; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (labataquerie.com/metalworkservice/index.php)"; flow:established,to_server; http.uri; content:"/metalworkservice/index.php"; startswith; fast_pattern; http.host; content:"labataquerie.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015599; classtype:social-engineering; sid:6015599; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentatucupovirt-co.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aumentatucupovirt-co.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015600; classtype:social-engineering; sid:6015600; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (93kok.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"93kok.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015601; classtype:social-engineering; sid:6015601; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verifycuenta-email.iceiy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"verifycuenta-email.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015602; classtype:social-engineering; sid:6015602; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gooogleqgmailcom-a11y.github.io/my-roblox-site/)"; flow:established,to_server; http.uri; content:"/my-roblox-site/"; startswith; fast_pattern; http.host; content:"gooogleqgmailcom-a11y.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015603; classtype:social-engineering; sid:6015603; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cpcalendars.20-40-57-175.cprapid.com/art?c_ds_na=gaexu2XzNvOr26LorD5QhPdySiyo5RnsuuGlSD0apl&c_ds_no=%2A%2F%2A)"; flow:established,to_server; http.uri; content:"/art?c_ds_na=gaexu2XzNvOr26LorD5QhPdySiyo5RnsuuGlSD0apl&c_ds_no=%2A%2F%2A"; startswith; fast_pattern; http.host; content:"cpcalendars.20-40-57-175.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015604; classtype:social-engineering; sid:6015604; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tyftruu.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tyftruu.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015605; classtype:social-engineering; sid:6015605; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (credicardciti.com.ph/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"credicardciti.com.ph"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015606; classtype:social-engineering; sid:6015606; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.login.biymu.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.login.biymu.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015607; classtype:social-engineering; sid:6015607; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sin1.contabostorage.com/f57ca37cf63e492090e223ee89f82455:nooneknows/alldoi.html)"; flow:established,to_server; http.uri; content:"/f57ca37cf63e492090e223ee89f82455:nooneknows/alldoi.html"; startswith; fast_pattern; http.host; content:"sin1.contabostorage.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015608; classtype:social-engineering; sid:6015608; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abhishek7gowda.github.io/abhi/)"; flow:established,to_server; http.uri; content:"/abhi/"; startswith; fast_pattern; http.host; content:"abhishek7gowda.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015609; classtype:social-engineering; sid:6015609; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my-facebook-blog.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"my-facebook-blog.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015610; classtype:social-engineering; sid:6015610; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-offical.buzz/profile.php)"; flow:established,to_server; http.uri; content:"/profile.php"; startswith; fast_pattern; http.host; content:"amazon-offical.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015611; classtype:social-engineering; sid:6015611; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clubenvantagens.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"clubenvantagens.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015612; classtype:social-engineering; sid:6015612; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cembra.swiss-pageweb.com/273514/app/)"; flow:established,to_server; http.uri; content:"/273514/app/"; startswith; fast_pattern; http.host; content:"cembra.swiss-pageweb.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015613; classtype:social-engineering; sid:6015613; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ins-gram-vote.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ins-gram-vote.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015614; classtype:social-engineering; sid:6015614; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sin1.contabostorage.com/e57ee1ebbe924b2a8704a14a59f6b050:roundcoube.mail.362764629tr7922462r7e7t48278t4279t7483479t4r793/MAlL.html?eta=test@uni-muenster.de)"; flow:established,to_server; http.uri; content:"/e57ee1ebbe924b2a8704a14a59f6b050:roundcoube.mail.362764629tr7922462r7e7t48278t4279t7483479t4r793/MAlL.html?eta=test@uni-muenster.de"; startswith; fast_pattern; http.host; content:"sin1.contabostorage.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015615; classtype:social-engineering; sid:6015615; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gopalx235.github.io/Amazon_clone)"; flow:established,to_server; http.uri; content:"/Amazon_clone"; startswith; fast_pattern; http.host; content:"gopalx235.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015616; classtype:social-engineering; sid:6015616; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pancakeswap-dex.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pancakeswap-dex.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015617; classtype:social-engineering; sid:6015617; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (etspine.co.za/fell/docusign.html)"; flow:established,to_server; http.uri; content:"/fell/docusign.html"; startswith; fast_pattern; http.host; content:"etspine.co.za"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015618; classtype:social-engineering; sid:6015618; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hoomepage-ledger.zapier.app/en-live)"; flow:established,to_server; http.uri; content:"/en-live"; startswith; fast_pattern; http.host; content:"hoomepage-ledger.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015619; classtype:social-engineering; sid:6015619; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hi.vmjjxbo.com/can/)"; flow:established,to_server; http.uri; content:"/can/"; startswith; fast_pattern; http.host; content:"hi.vmjjxbo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015620; classtype:social-engineering; sid:6015620; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fortsora.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fortsora.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015621; classtype:social-engineering; sid:6015621; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shahanaznazar.github.io/Netflixclone/)"; flow:established,to_server; http.uri; content:"/Netflixclone/"; startswith; fast_pattern; http.host; content:"shahanaznazar.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015622; classtype:social-engineering; sid:6015622; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eugene59779.softr.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eugene59779.softr.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015623; classtype:social-engineering; sid:6015623; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mssdold.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mssdold.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015624; classtype:social-engineering; sid:6015624; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagrammobliepage.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagrammobliepage.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015625; classtype:social-engineering; sid:6015625; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alok2705.github.io/AmazonCloneProject)"; flow:established,to_server; http.uri; content:"/AmazonCloneProject"; startswith; fast_pattern; http.host; content:"alok2705.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015626; classtype:social-engineering; sid:6015626; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (box-file-1mer.p-2myde94o.workers.dev/l/hew6apnVFhQ)"; flow:established,to_server; http.uri; content:"/l/hew6apnVFhQ"; startswith; fast_pattern; http.host; content:"box-file-1mer.p-2myde94o.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015627; classtype:social-engineering; sid:6015627; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lzstructure.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lzstructure.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015628; classtype:social-engineering; sid:6015628; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rumoaosucessoviolet.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"rumoaosucessoviolet.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015629; classtype:social-engineering; sid:6015629; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezor.app-suite-io.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezor.app-suite-io.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015630; classtype:social-engineering; sid:6015630; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (falawebapp.x10.mx/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"falawebapp.x10.mx"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015631; classtype:social-engineering; sid:6015631; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (marinapescatori.com/tablet/css/css/Amendes2024/Amendes2024/infospage.php/)"; flow:established,to_server; http.uri; content:"/tablet/css/css/Amendes2024/Amendes2024/infospage.php/"; startswith; fast_pattern; http.host; content:"marinapescatori.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015632; classtype:social-engineering; sid:6015632; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpd-notico.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.dpd-notico.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015633; classtype:social-engineering; sid:6015633; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (62255.co/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"62255.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015634; classtype:social-engineering; sid:6015634; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (steamcommnunmity.com/tradeoffer/new/partner=783662133token=l4hhebGA21839)"; flow:established,to_server; http.uri; content:"/tradeoffer/new/partner=783662133token=l4hhebGA21839"; startswith; fast_pattern; http.host; content:"steamcommnunmity.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015635; classtype:social-engineering; sid:6015635; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toki-gov-tr-18.vercel.app/giris.php)"; flow:established,to_server; http.uri; content:"/giris.php"; startswith; fast_pattern; http.host; content:"toki-gov-tr-18.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015636; classtype:social-engineering; sid:6015636; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (epicgames-fortnite-org.world/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"epicgames-fortnite-org.world"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015637; classtype:social-engineering; sid:6015637; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ylwz05.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ylwz05.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015638; classtype:social-engineering; sid:6015638; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (databdase.b-cdn.net/2a.html)"; flow:established,to_server; http.uri; content:"/2a.html"; startswith; fast_pattern; http.host; content:"databdase.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015639; classtype:social-engineering; sid:6015639; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagrampagevotjng.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagrampagevotjng.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015640; classtype:social-engineering; sid:6015640; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myprojectdoc.online/19ec5a)"; flow:established,to_server; http.uri; content:"/19ec5a"; startswith; fast_pattern; http.host; content:"myprojectdoc.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015641; classtype:social-engineering; sid:6015641; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.pl-48918956819.sbs/oferta/20789128/kamerka-gopr)"; flow:established,to_server; http.uri; content:"/oferta/20789128/kamerka-gopr"; startswith; fast_pattern; http.host; content:"allegrolokalnie.pl-48918956819.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015642; classtype:social-engineering; sid:6015642; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dev.biymu.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dev.biymu.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015643; classtype:social-engineering; sid:6015643; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bdfofp.com/ph/personal/)"; flow:established,to_server; http.uri; content:"/ph/personal/"; startswith; fast_pattern; http.host; content:"bdfofp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015644; classtype:social-engineering; sid:6015644; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xn--wlletconnect-pob.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xn--wlletconnect-pob.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015645; classtype:social-engineering; sid:6015645; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vvebmail-ver1fication1.edgeone.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vvebmail-ver1fication1.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015646; classtype:social-engineering; sid:6015646; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (up-to1.pages.dev/%25/)"; flow:established,to_server; http.uri; content:"/%25/"; startswith; fast_pattern; http.host; content:"up-to1.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015647; classtype:social-engineering; sid:6015647; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.banco.estado-app.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.banco.estado-app.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015648; classtype:social-engineering; sid:6015648; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tu-dresden-iwgsonq.4webshare.com/ephyvpwbjdomh455cmixmjgr6g2gbjdcr6mcfc62wcycgt/?5rqpS4Rd)"; flow:established,to_server; http.uri; content:"/ephyvpwbjdomh455cmixmjgr6g2gbjdcr6mcfc62wcycgt/?5rqpS4Rd"; startswith; fast_pattern; http.host; content:"tu-dresden-iwgsonq.4webshare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015649; classtype:social-engineering; sid:6015649; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (china.cyberfish.io/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/"; startswith; fast_pattern; http.host; content:"china.cyberfish.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015650; classtype:social-engineering; sid:6015650; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dhlpaket.a7719.vip/1yzVX4z9iN)"; flow:established,to_server; http.uri; content:"/1yzVX4z9iN"; startswith; fast_pattern; http.host; content:"dhlpaket.a7719.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015651; classtype:social-engineering; sid:6015651; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingis.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingis.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015652; classtype:social-engineering; sid:6015652; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hfmthsga.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hfmthsga.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015653; classtype:social-engineering; sid:6015653; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thegreasebucket.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"thegreasebucket.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015654; classtype:social-engineering; sid:6015654; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.team-bf.com/p/fwom-djul/jhcbdkax)"; flow:established,to_server; http.uri; content:"/p/fwom-djul/jhcbdkax"; startswith; fast_pattern; http.host; content:"s.team-bf.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015655; classtype:social-engineering; sid:6015655; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my.webshar.es/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/"; startswith; fast_pattern; http.host; content:"my.webshar.es"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015656; classtype:social-engineering; sid:6015656; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sadxq.shkul.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sadxq.shkul.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015657; classtype:social-engineering; sid:6015657; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qr.link/PwvkS2)"; flow:established,to_server; http.uri; content:"/PwvkS2"; startswith; fast_pattern; http.host; content:"qr.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015658; classtype:social-engineering; sid:6015658; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roaya-elfolaz.com/Mh3d6/?id=amFuLXBoaWxpcHAubWVyeEBoZWlkZWxiZXJnLmRl)"; flow:established,to_server; http.uri; content:"/Mh3d6/?id=amFuLXBoaWxpcHAubWVyeEBoZWlkZWxiZXJnLmRl"; startswith; fast_pattern; http.host; content:"roaya-elfolaz.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015659; classtype:social-engineering; sid:6015659; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-e66b4b88b1d24aeeaf754f0ecee122c7.r2.dev/index.html?8b8ee87/)"; flow:established,to_server; http.uri; content:"/index.html?8b8ee87/"; startswith; fast_pattern; http.host; content:"pub-e66b4b88b1d24aeeaf754f0ecee122c7.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015660; classtype:social-engineering; sid:6015660; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (han-vercel.github.io/supersimple-javascript-course/)"; flow:established,to_server; http.uri; content:"/supersimple-javascript-course/"; startswith; fast_pattern; http.host; content:"han-vercel.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015661; classtype:social-engineering; sid:6015661; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eywwkm.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eywwkm.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015662; classtype:social-engineering; sid:6015662; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (h5.crypto-x-ai.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"h5.crypto-x-ai.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015663; classtype:social-engineering; sid:6015663; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (beamasdjkuh.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"beamasdjkuh.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015664; classtype:social-engineering; sid:6015664; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (g6bs.bcvftriqws.live/terbaru/6a3c0d4ea5bbc)"; flow:established,to_server; http.uri; content:"/terbaru/6a3c0d4ea5bbc"; startswith; fast_pattern; http.host; content:"g6bs.bcvftriqws.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015665; classtype:social-engineering; sid:6015665; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagrammobliepqge.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagrammobliepqge.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015666; classtype:social-engineering; sid:6015666; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (praveenkumar7505.github.io/ShopEasy-Ecommerce-Demo/)"; flow:established,to_server; http.uri; content:"/ShopEasy-Ecommerce-Demo/"; startswith; fast_pattern; http.host; content:"praveenkumar7505.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015667; classtype:social-engineering; sid:6015667; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee-day29.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopee-day29.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015668; classtype:social-engineering; sid:6015668; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vmi3130825.contaboserver.net/enload)"; flow:established,to_server; http.uri; content:"/enload"; startswith; fast_pattern; http.host; content:"vmi3130825.contaboserver.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015669; classtype:social-engineering; sid:6015669; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dnspaycreat.frea.web.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dnspaycreat.frea.web.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015670; classtype:social-engineering; sid:6015670; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lockerinfo.world/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lockerinfo.world"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015671; classtype:social-engineering; sid:6015671; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (correosprepago.bnext.es/pwd?token=XBE6vb2chqE6Tn2gpvdq5DmoGw)"; flow:established,to_server; http.uri; content:"/pwd?token=XBE6vb2chqE6Tn2gpvdq5DmoGw"; startswith; fast_pattern; http.host; content:"correosprepago.bnext.es"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015672; classtype:social-engineering; sid:6015672; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (107-175-148-253-s5.servikus.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"107-175-148-253-s5.servikus.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015673; classtype:social-engineering; sid:6015673; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloud-auth.info/7uD)"; flow:established,to_server; http.uri; content:"/7uD"; startswith; fast_pattern; http.host; content:"icloud-auth.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015674; classtype:social-engineering; sid:6015674; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth-sso-kuicon.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auth-sso-kuicon.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015675; classtype:social-engineering; sid:6015675; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shreeniwasyadav701.github.io/2nd-project)"; flow:established,to_server; http.uri; content:"/2nd-project"; startswith; fast_pattern; http.host; content:"shreeniwasyadav701.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015676; classtype:social-engineering; sid:6015676; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.p-diesnt.com/app/index.php?view=main&id=6349ca39e99bb66f688e6691879e1da9)"; flow:established,to_server; http.uri; content:"/app/index.php?view=main&id=6349ca39e99bb66f688e6691879e1da9"; startswith; fast_pattern; http.host; content:"www.p-diesnt.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015677; classtype:social-engineering; sid:6015677; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lhttps-www-roblox.co/login?returnUrl=56102644)"; flow:established,to_server; http.uri; content:"/login?returnUrl=56102644"; startswith; fast_pattern; http.host; content:"lhttps-www-roblox.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015678; classtype:social-engineering; sid:6015678; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (labataquerie.com/metalworkservice/index.php/)"; flow:established,to_server; http.uri; content:"/metalworkservice/index.php/"; startswith; fast_pattern; http.host; content:"labataquerie.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015679; classtype:social-engineering; sid:6015679; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mylittleladies.blog.verifytoken.com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"mylittleladies.blog.verifytoken.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015680; classtype:social-engineering; sid:6015680; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (click-hostopoint-ch-redirect5824312.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"click-hostopoint-ch-redirect5824312.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015681; classtype:social-engineering; sid:6015681; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bdbofp.com/ph/personal/)"; flow:established,to_server; http.uri; content:"/ph/personal/"; startswith; fast_pattern; http.host; content:"bdbofp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015682; classtype:social-engineering; sid:6015682; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shreyansksingh49.github.io/ui-project/)"; flow:established,to_server; http.uri; content:"/ui-project/"; startswith; fast_pattern; http.host; content:"shreyansksingh49.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015683; classtype:social-engineering; sid:6015683; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (z-maniac-sidd.github.io/Netflix_clone/)"; flow:established,to_server; http.uri; content:"/Netflix_clone/"; startswith; fast_pattern; http.host; content:"z-maniac-sidd.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015684; classtype:social-engineering; sid:6015684; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.joliveroi.site/nex/ion/oran/)"; flow:established,to_server; http.uri; content:"/nex/ion/oran/"; startswith; fast_pattern; http.host; content:"www.joliveroi.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015685; classtype:social-engineering; sid:6015685; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gov.fine-parking.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"gov.fine-parking.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015686; classtype:social-engineering; sid:6015686; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (review.quality-account.com/secret=xs/)"; flow:established,to_server; http.uri; content:"/secret=xs/"; startswith; fast_pattern; http.host; content:"review.quality-account.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015687; classtype:social-engineering; sid:6015687; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lopradodeportes.cl/wp-includes/css/bassam/index.html)"; flow:established,to_server; http.uri; content:"/wp-includes/css/bassam/index.html"; startswith; fast_pattern; http.host; content:"lopradodeportes.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015688; classtype:social-engineering; sid:6015688; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ku2.me/FrDPL)"; flow:established,to_server; http.uri; content:"/FrDPL"; startswith; fast_pattern; http.host; content:"ku2.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015689; classtype:social-engineering; sid:6015689; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sam00-b.github.io/amazonclone/orders.html)"; flow:established,to_server; http.uri; content:"/amazonclone/orders.html"; startswith; fast_pattern; http.host; content:"sam00-b.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015690; classtype:social-engineering; sid:6015690; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gmpvkb.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gmpvkb.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015691; classtype:social-engineering; sid:6015691; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oferta-feirao.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"oferta-feirao.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015692; classtype:social-engineering; sid:6015692; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tresswallet.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tresswallet.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015693; classtype:social-engineering; sid:6015693; rev:1; metadata: signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.9457jh745.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalnie.9457jh745.xyz"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015694; classtype:social-engineering; sid:6015694; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (broadbandee.plutio.com/p/form/sk4yzsAdM9XCR2rZS)"; flow:established,to_server; http.uri; content:"/p/form/sk4yzsAdM9XCR2rZS"; startswith; fast_pattern; http.host; content:"broadbandee.plutio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015695; classtype:social-engineering; sid:6015695; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amz.userverifyacc056t4b535.cc/leqzboh74qy678s4xw9smwql?qk1xi91xg2flsei3fxnxqkll=za0t89jd9k1ncoyb4na5ncje)"; flow:established,to_server; http.uri; content:"/leqzboh74qy678s4xw9smwql?qk1xi91xg2flsei3fxnxqkll=za0t89jd9k1ncoyb4na5ncje"; startswith; fast_pattern; http.host; content:"amz.userverifyacc056t4b535.cc"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015696; classtype:social-engineering; sid:6015696; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dicasdebemestar.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"dicasdebemestar.s3.us-east-005.backblazeb2.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015697; classtype:social-engineering; sid:6015697; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vercel.com/login?next=%2Fsso-api%3Furl%3Dhttps%253A%252F%252Finterface-uniswap.vercel.app%252F%26nonce%3Dfe628afb0f3e81523b7d02b8bc8c8f16c51d0a98e53a50372f86ad2575240134)"; flow:established,to_server; http.uri; content:"/login?next=%2Fsso-api%3Furl%3Dhttps%253A%252F%252Finterface-uniswap.vercel.app%252F%26nonce%3Dfe628afb0f3e81523b7d02b8bc8c8f16c51d0a98e53a50372f86ad2575240134"; startswith; fast_pattern; http.host; content:"vercel.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015698; classtype:social-engineering; sid:6015698; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cnt-app-c7games.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cnt-app-c7games.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015699; classtype:social-engineering; sid:6015699; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myfitnessapp.marketluxe.click/DoYoga-v2/index.php)"; flow:established,to_server; http.uri; content:"/DoYoga-v2/index.php"; startswith; fast_pattern; http.host; content:"myfitnessapp.marketluxe.click"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015700; classtype:social-engineering; sid:6015700; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myfitnessapp.marketluxe.click/DoYoga-v2/reciever.php/)"; flow:established,to_server; http.uri; content:"/DoYoga-v2/reciever.php/"; startswith; fast_pattern; http.host; content:"myfitnessapp.marketluxe.click"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015701; classtype:social-engineering; sid:6015701; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.adamadvocacia.com/acess.php?token=21446711276a4048fd6f5bc7.91813685&cliente_21446711276a4048fd6f5bc7.91813685)"; flow:established,to_server; http.uri; content:"/acess.php?token=21446711276a4048fd6f5bc7.91813685&cliente_21446711276a4048fd6f5bc7.91813685"; startswith; fast_pattern; http.host; content:"www.adamadvocacia.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015702; classtype:social-engineering; sid:6015702; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.209089883cc.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalnie.209089883cc.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015703; classtype:social-engineering; sid:6015703; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.eliaruizwork.com/portfolio)"; flow:established,to_server; http.uri; content:"/portfolio"; startswith; fast_pattern; http.host; content:"www.eliaruizwork.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015704; classtype:social-engineering; sid:6015704; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jwgl.my.m.luxurylifebrand.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jwgl.my.m.luxurylifebrand.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015705; classtype:social-engineering; sid:6015705; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-authorized-000012026324vsxc.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"business-blue-tick-authorized-000012026324vsxc.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015706; classtype:social-engineering; sid:6015706; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accounts.binanceuz.co/ru/login/password)"; flow:established,to_server; http.uri; content:"/ru/login/password"; startswith; fast_pattern; http.host; content:"accounts.binanceuz.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015707; classtype:social-engineering; sid:6015707; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoka06.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoka06.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015708; classtype:social-engineering; sid:6015708; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cryptodappsreports.com/wallet/import.html)"; flow:established,to_server; http.uri; content:"/wallet/import.html"; startswith; fast_pattern; http.host; content:"cryptodappsreports.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015709; classtype:social-engineering; sid:6015709; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (omerguzelim.github.io/Facebook)"; flow:established,to_server; http.uri; content:"/Facebook"; startswith; fast_pattern; http.host; content:"omerguzelim.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015710; classtype:social-engineering; sid:6015710; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sabiboys11211-cyber.github.io/verify-savingsinvestments/)"; flow:established,to_server; http.uri; content:"/verify-savingsinvestments/"; startswith; fast_pattern; http.host; content:"sabiboys11211-cyber.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015711; classtype:social-engineering; sid:6015711; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myxfinityclientcommunicatonlogin.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"myxfinityclientcommunicatonlogin.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015712; classtype:social-engineering; sid:6015712; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yorklonltd.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yorklonltd.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015713; classtype:social-engineering; sid:6015713; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pokerklas.yeni-lisans.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pokerklas.yeni-lisans.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015714; classtype:social-engineering; sid:6015714; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fin103.grayku.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fin103.grayku.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015715; classtype:social-engineering; sid:6015715; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (authorized-website-link.replit.app/?email=elyn8@df1b3332b039ed6674bdf9cd8419de0ed772.com)"; flow:established,to_server; http.uri; content:"/?email=elyn8@df1b3332b039ed6674bdf9cd8419de0ed772.com"; startswith; fast_pattern; http.host; content:"authorized-website-link.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015716; classtype:social-engineering; sid:6015716; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (itsoft-dkcxp.4webshare.com/jdo65cmixmjmh45fcr6g2gbjdcmcephyvpwbjdo65cmixmjmh45fcr6g2gbjdcr6g2wcycgt/?4FsgpvOb)"; flow:established,to_server; http.uri; content:"/jdo65cmixmjmh45fcr6g2gbjdcmcephyvpwbjdo65cmixmjmh45fcr6g2gbjdcr6g2wcycgt/?4FsgpvOb"; startswith; fast_pattern; http.host; content:"itsoft-dkcxp.4webshare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015717; classtype:social-engineering; sid:6015717; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tribu-tax.cl/components/com_media/upgrade)"; flow:established,to_server; http.uri; content:"/components/com_media/upgrade"; startswith; fast_pattern; http.host; content:"tribu-tax.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015718; classtype:social-engineering; sid:6015718; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8579.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8579.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015719; classtype:social-engineering; sid:6015719; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fabioldp.github.io/Rercriando-a-Pagina-inicial-do-Instagram)"; flow:established,to_server; http.uri; content:"/Rercriando-a-Pagina-inicial-do-Instagram"; startswith; fast_pattern; http.host; content:"fabioldp.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015720; classtype:social-engineering; sid:6015720; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sonomama-net.jp/Aeroplan/shaw/index.html?id=033)"; flow:established,to_server; http.uri; content:"/Aeroplan/shaw/index.html?id=033"; startswith; fast_pattern; http.host; content:"www.sonomama-net.jp"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015721; classtype:social-engineering; sid:6015721; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (novae-whatapt.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"novae-whatapt.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015722; classtype:social-engineering; sid:6015722; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sushilvatane.github.io/amazon-clone/checkout.html)"; flow:established,to_server; http.uri; content:"/amazon-clone/checkout.html"; startswith; fast_pattern; http.host; content:"sushilvatane.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015723; classtype:social-engineering; sid:6015723; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-confirmed-000102026.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"business-blue-tick-confirmed-000102026.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015724; classtype:social-engineering; sid:6015724; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eshang168.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eshang168.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015725; classtype:social-engineering; sid:6015725; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.web-git-arc-chain-support-uniswap.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.web-git-arc-chain-support-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015726; classtype:social-engineering; sid:6015726; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-testing-dev-entry-gateway-uniswap.vercel.app/explore)"; flow:established,to_server; http.uri; content:"/explore"; startswith; fast_pattern; http.host; content:"web-testing-dev-entry-gateway-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015727; classtype:social-engineering; sid:6015727; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pruebabancoltarjeta1.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pruebabancoltarjeta1.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015728; classtype:social-engineering; sid:6015728; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-authorized-000012026v34.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"business-blue-tick-authorized-000012026v34.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015729; classtype:social-engineering; sid:6015729; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sillomoo.site/wp/)"; flow:established,to_server; http.uri; content:"/wp/"; startswith; fast_pattern; http.host; content:"sillomoo.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015730; classtype:social-engineering; sid:6015730; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (payme-paypal.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"payme-paypal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015731; classtype:social-engineering; sid:6015731; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imokentv.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"imokentv.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015732; classtype:social-engineering; sid:6015732; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anshuchourasia.github.io/netflix/)"; flow:established,to_server; http.uri; content:"/netflix/"; startswith; fast_pattern; http.host; content:"anshuchourasia.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015733; classtype:social-engineering; sid:6015733; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (learnbridgetrezz.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"learnbridgetrezz.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015734; classtype:social-engineering; sid:6015734; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (axvddjww.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"axvddjww.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015735; classtype:social-engineering; sid:6015735; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (objectstorage.us-chicago-1.oraclecloud.com/n/ax3xhmwuxcne/b/bucket-securemessage-6976/o/index9836867.htm?e=janis@c3d55c7fa428f8dfdce2b9cb4cfb2b3558f0.org)"; flow:established,to_server; http.uri; content:"/n/ax3xhmwuxcne/b/bucket-securemessage-6976/o/index9836867.htm?e=janis@c3d55c7fa428f8dfdce2b9cb4cfb2b3558f0.org"; startswith; fast_pattern; http.host; content:"objectstorage.us-chicago-1.oraclecloud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015736; classtype:social-engineering; sid:6015736; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bdvenlineaw.github.io/galicia.com/)"; flow:established,to_server; http.uri; content:"/galicia.com/"; startswith; fast_pattern; http.host; content:"bdvenlineaw.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015737; classtype:social-engineering; sid:6015737; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-confirmed-000062026.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"business-blue-tick-confirmed-000062026.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015738; classtype:social-engineering; sid:6015738; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pricefn.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pricefn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015739; classtype:social-engineering; sid:6015739; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-confirmed-000262026.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"business-blue-tick-confirmed-000262026.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015740; classtype:social-engineering; sid:6015740; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (canburnlikeacigarette.github.io/vibexarr/)"; flow:established,to_server; http.uri; content:"/vibexarr/"; startswith; fast_pattern; http.host; content:"canburnlikeacigarette.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015741; classtype:social-engineering; sid:6015741; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-glurnex-biz-slatik-platem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-glurnex-biz-slatik-platem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015742; classtype:social-engineering; sid:6015742; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fnworth.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fnworth.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015743; classtype:social-engineering; sid:6015743; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-git-06-10-chorewebremovemultichaintokenuxfla-ee0b7b-uniswap.vercel.app/positions)"; flow:established,to_server; http.uri; content:"/positions"; startswith; fast_pattern; http.host; content:"web-git-06-10-chorewebremovemultichaintokenuxfla-ee0b7b-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015744; classtype:social-engineering; sid:6015744; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezorbridge-device.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezorbridge-device.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015745; classtype:social-engineering; sid:6015745; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortinatexpress.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortinatexpress.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015746; classtype:social-engineering; sid:6015746; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.paguesempararbr.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.paguesempararbr.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015747; classtype:social-engineering; sid:6015747; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vxa-ld.insidex.biz.id/cxxv/)"; flow:established,to_server; http.uri; content:"/cxxv/"; startswith; fast_pattern; http.host; content:"vxa-ld.insidex.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015748; classtype:social-engineering; sid:6015748; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hjc23.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hjc23.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015749; classtype:social-engineering; sid:6015749; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (https-www-roblox.cc/users/21713489/profile)"; flow:established,to_server; http.uri; content:"/users/21713489/profile"; startswith; fast_pattern; http.host; content:"https-www-roblox.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015750; classtype:social-engineering; sid:6015750; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-confirmed-000052026.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"business-blue-tick-confirmed-000052026.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015751; classtype:social-engineering; sid:6015751; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.svrbancolombianeg.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.svrbancolombianeg.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015752; classtype:social-engineering; sid:6015752; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rcb.cuj.temporary.site/banmro/app-vernieuwen/reader.html)"; flow:established,to_server; http.uri; content:"/banmro/app-vernieuwen/reader.html"; startswith; fast_pattern; http.host; content:"rcb.cuj.temporary.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015753; classtype:social-engineering; sid:6015753; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gokhanbyk.github.io/Netflix-loginPage-clone)"; flow:established,to_server; http.uri; content:"/Netflix-loginPage-clone"; startswith; fast_pattern; http.host; content:"gokhanbyk.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015754; classtype:social-engineering; sid:6015754; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-confirmed-000242026.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"business-blue-tick-confirmed-000242026.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015755; classtype:social-engineering; sid:6015755; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gohelpdesk.co.uk/?r=97e1f909-ba59-450b-a216-5420767f00a9&rg=eu)"; flow:established,to_server; http.uri; content:"/?r=97e1f909-ba59-450b-a216-5420767f00a9&rg=eu"; startswith; fast_pattern; http.host; content:"gohelpdesk.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015756; classtype:social-engineering; sid:6015756; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shoptkpro.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shoptkpro.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015757; classtype:social-engineering; sid:6015757; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ilpendolo.it/Alphabnakgr/Login.html)"; flow:established,to_server; http.uri; content:"/Alphabnakgr/Login.html"; startswith; fast_pattern; http.host; content:"ilpendolo.it"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015758; classtype:social-engineering; sid:6015758; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktifkaanpaylatterss.qes.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktifkaanpaylatterss.qes.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015759; classtype:social-engineering; sid:6015759; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.zedelivery-online.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.zedelivery-online.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015760; classtype:social-engineering; sid:6015760; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-git-06-10-chorewebremovemultichaintokenuxfla-ee0b7b-uniswap.vercel.app/swap)"; flow:established,to_server; http.uri; content:"/swap"; startswith; fast_pattern; http.host; content:"web-git-06-10-chorewebremovemultichaintokenuxfla-ee0b7b-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015761; classtype:social-engineering; sid:6015761; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-confirmed-000392026.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"business-blue-tick-confirmed-000392026.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015762; classtype:social-engineering; sid:6015762; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-confirmed-000252026.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"business-blue-tick-confirmed-000252026.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015763; classtype:social-engineering; sid:6015763; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiifkanpaylater.vwk.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiifkanpaylater.vwk.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015764; classtype:social-engineering; sid:6015764; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-confirmed-000332026.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"business-blue-tick-confirmed-000332026.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015765; classtype:social-engineering; sid:6015765; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-testing-dev-entry-gateway-uniswap.vercel.app/positions)"; flow:established,to_server; http.uri; content:"/positions"; startswith; fast_pattern; http.host; content:"web-testing-dev-entry-gateway-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015766; classtype:social-engineering; sid:6015766; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fortes.my/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fortes.my"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015767; classtype:social-engineering; sid:6015767; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth--apps-kucooin-sso---cdnn.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auth--apps-kucooin-sso---cdnn.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015768; classtype:social-engineering; sid:6015768; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-confirmed-000082026.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"business-blue-tick-confirmed-000082026.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015769; classtype:social-engineering; sid:6015769; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-confirmed-000092026.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"business-blue-tick-confirmed-000092026.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015770; classtype:social-engineering; sid:6015770; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pragati0405.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"pragati0405.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015771; classtype:social-engineering; sid:6015771; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-confirmed-000342026.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"business-blue-tick-confirmed-000342026.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015772; classtype:social-engineering; sid:6015772; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (svrbancolombianeg.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"svrbancolombianeg.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015773; classtype:social-engineering; sid:6015773; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-e3f0c19d1dcd408e98de83be89036299.r2.dev/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-e3f0c19d1dcd408e98de83be89036299.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015774; classtype:social-engineering; sid:6015774; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bancolaumentatucupo-net.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bancolaumentatucupo-net.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015775; classtype:social-engineering; sid:6015775; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sumitsrivastava01.github.io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"sumitsrivastava01.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015776; classtype:social-engineering; sid:6015776; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.talksurrey.org.uk/bin/y746z.php/)"; flow:established,to_server; http.uri; content:"/bin/y746z.php/"; startswith; fast_pattern; http.host; content:"www.talksurrey.org.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015777; classtype:social-engineering; sid:6015777; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toki-gov-tr-konut1.vercel.app/giris.php)"; flow:established,to_server; http.uri; content:"/giris.php"; startswith; fast_pattern; http.host; content:"toki-gov-tr-konut1.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015778; classtype:social-engineering; sid:6015778; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-authorized-0000120261x2a.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"business-blue-tick-authorized-0000120261x2a.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015779; classtype:social-engineering; sid:6015779; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.crosss.top/crs/verifycertifjcate.php)"; flow:established,to_server; http.uri; content:"/crs/verifycertifjcate.php"; startswith; fast_pattern; http.host; content:"www.crosss.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015780; classtype:social-engineering; sid:6015780; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xptspecielty.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xptspecielty.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015781; classtype:social-engineering; sid:6015781; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cloud.digitalizer.in/can/)"; flow:established,to_server; http.uri; content:"/can/"; startswith; fast_pattern; http.host; content:"cloud.digitalizer.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015782; classtype:social-engineering; sid:6015782; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.20-228-132-238.cpanel.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.20-228-132-238.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015783; classtype:social-engineering; sid:6015783; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-f8fde659e2dc4783b121a5445d3d74c0.r2.dev/wmx.html?Faurecia=galix7@af2a53fdf681ce9589746327d14fb4234cb5.com/)"; flow:established,to_server; http.uri; content:"/wmx.html?Faurecia=galix7@af2a53fdf681ce9589746327d14fb4234cb5.com/"; startswith; fast_pattern; http.host; content:"pub-f8fde659e2dc4783b121a5445d3d74c0.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015784; classtype:social-engineering; sid:6015784; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rcb.cuj.temporary.site/banmro/app-vernieuwen/loading.html)"; flow:established,to_server; http.uri; content:"/banmro/app-vernieuwen/loading.html"; startswith; fast_pattern; http.host; content:"rcb.cuj.temporary.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015785; classtype:social-engineering; sid:6015785; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-confirmed-000352026.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"business-blue-tick-confirmed-000352026.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015786; classtype:social-engineering; sid:6015786; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (martumaswallt.darlic.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"martumaswallt.darlic.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015787; classtype:social-engineering; sid:6015787; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zeqaw.xyz/KKFzS/z6hwy2nfkrAeTezUP5w2F2ifVQP1vHpSNh7TFXqjmiWIeJwGVS6RQJTD0z9id54P8990hjm7A2DYnH0HjQ-Q/1782486964766/)"; flow:established,to_server; http.uri; content:"/KKFzS/z6hwy2nfkrAeTezUP5w2F2ifVQP1vHpSNh7TFXqjmiWIeJwGVS6RQJTD0z9id54P8990hjm7A2DYnH0HjQ-Q/1782486964766/"; startswith; fast_pattern; http.host; content:"zeqaw.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015788; classtype:social-engineering; sid:6015788; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bridgeengteozr.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bridgeengteozr.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015789; classtype:social-engineering; sid:6015789; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hr-rewards.com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/"; startswith; fast_pattern; http.host; content:"hr-rewards.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015790; classtype:social-engineering; sid:6015790; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nelienaei-7837--lineasnejj2.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nelienaei-7837--lineasnejj2.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015791; classtype:social-engineering; sid:6015791; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-confirmed-000182026.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"business-blue-tick-confirmed-000182026.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015792; classtype:social-engineering; sid:6015792; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (freeflow.rodoviasabr.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"freeflow.rodoviasabr.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015793; classtype:social-engineering; sid:6015793; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.20-228-132-238.cpanel.site/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"www.20-228-132-238.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015794; classtype:social-engineering; sid:6015794; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meera-r27.github.io/netflix-frontend/)"; flow:established,to_server; http.uri; content:"/netflix-frontend/"; startswith; fast_pattern; http.host; content:"meera-r27.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015795; classtype:social-engineering; sid:6015795; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aifreebie.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aifreebie.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015796; classtype:social-engineering; sid:6015796; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kunishe.com/cic/Adobe_Installer.html)"; flow:established,to_server; http.uri; content:"/cic/Adobe_Installer.html"; startswith; fast_pattern; http.host; content:"kunishe.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015797; classtype:social-engineering; sid:6015797; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloud.com.gr/njH/lcnD)"; flow:established,to_server; http.uri; content:"/njH/lcnD"; startswith; fast_pattern; http.host; content:"icloud.com.gr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015798; classtype:social-engineering; sid:6015798; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-confirmed-000232026.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"business-blue-tick-confirmed-000232026.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015799; classtype:social-engineering; sid:6015799; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-testing-dev-entry-gateway-uniswap.vercel.app/swap)"; flow:established,to_server; http.uri; content:"/swap"; startswith; fast_pattern; http.host; content:"web-testing-dev-entry-gateway-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015800; classtype:social-engineering; sid:6015800; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (raj0854.github.io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"raj0854.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015801; classtype:social-engineering; sid:6015801; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (todored.net/blkcjaom)"; flow:established,to_server; http.uri; content:"/blkcjaom"; startswith; fast_pattern; http.host; content:"todored.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015802; classtype:social-engineering; sid:6015802; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-confirmed-000212026.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"business-blue-tick-confirmed-000212026.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015803; classtype:social-engineering; sid:6015803; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-confirmed-000192026.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"business-blue-tick-confirmed-000192026.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015804; classtype:social-engineering; sid:6015804; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-confirmed-000282026.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"business-blue-tick-confirmed-000282026.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015805; classtype:social-engineering; sid:6015805; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie.8h723810.xyz/lokalnie/?id=3Y8u9D0i7a8a4C4N8n7A4t3e7Z5X3l2t)"; flow:established,to_server; http.uri; content:"/lokalnie/?id=3Y8u9D0i7a8a4C4N8n7A4t3e7Z5X3l2t"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.8h723810.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015806; classtype:social-engineering; sid:6015806; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ssusshi.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ssusshi.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015807; classtype:social-engineering; sid:6015807; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (layer-bridgetrezr.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"layer-bridgetrezr.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015808; classtype:social-engineering; sid:6015808; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (03365pay.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"03365pay.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015809; classtype:social-engineering; sid:6015809; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-confirmed-000312026.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"business-blue-tick-confirmed-000312026.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015810; classtype:social-engineering; sid:6015810; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-authorized-000012026zxc2q.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"business-blue-tick-authorized-000012026zxc2q.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015811; classtype:social-engineering; sid:6015811; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (01sw-bdg8-oxmc.alina-ciorba-duncantoplis-co-uk-s-account.workers.dev/3a4712a9d42cd176?email=user@example.com)"; flow:established,to_server; http.uri; content:"/3a4712a9d42cd176?email=user@example.com"; startswith; fast_pattern; http.host; content:"01sw-bdg8-oxmc.alina-ciorba-duncantoplis-co-uk-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015812; classtype:social-engineering; sid:6015812; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (api.bp-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"api.bp-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015813; classtype:social-engineering; sid:6015813; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qorvanel-biz-lomvireta-k7t4pz19.pages.dev/guyywl-fdfscx-lkljhjh?welcome=223625891861766&class246=223625891861766&name_class136=Teton%20County%20Health%20Department)"; flow:established,to_server; http.uri; content:"/guyywl-fdfscx-lkljhjh?welcome=223625891861766&class246=223625891861766&name_class136=Teton%20County%20Health%20Department"; startswith; fast_pattern; http.host; content:"qorvanel-biz-lomvireta-k7t4pz19.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015814; classtype:social-engineering; sid:6015814; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pruebabancoltarjeta1.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pruebabancoltarjeta1.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015815; classtype:social-engineering; sid:6015815; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.krstoragecompare.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.krstoragecompare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015816; classtype:social-engineering; sid:6015816; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inoutlconfirmar.webcindario.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"inoutlconfirmar.webcindario.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015817; classtype:social-engineering; sid:6015817; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.amzonin.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amzonin.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015818; classtype:social-engineering; sid:6015818; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (virtualnegbancolo.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"virtualnegbancolo.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015819; classtype:social-engineering; sid:6015819; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toki-gov-tr-fatih.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"toki-gov-tr-fatih.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015820; classtype:social-engineering; sid:6015820; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (scooke-work.github.io/sc-demo-platform/)"; flow:established,to_server; http.uri; content:"/sc-demo-platform/"; startswith; fast_pattern; http.host; content:"scooke-work.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015821; classtype:social-engineering; sid:6015821; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-confirmed-000022026.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"business-blue-tick-confirmed-000022026.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015822; classtype:social-engineering; sid:6015822; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pl.funtrip360.com/wp-content/uploads/2025/?ref=a8847c04c3ed737e6146c9bd98888cee-xcjrGmf1ZhrXqJAV99ehe4VUjlRLitHGeuJvGuWuS5I3)"; flow:established,to_server; http.uri; content:"/wp-content/uploads/2025/?ref=a8847c04c3ed737e6146c9bd98888cee-xcjrGmf1ZhrXqJAV99ehe4VUjlRLitHGeuJvGuWuS5I3"; startswith; fast_pattern; http.host; content:"pl.funtrip360.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015823; classtype:social-engineering; sid:6015823; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (phgm1.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"phgm1.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015824; classtype:social-engineering; sid:6015824; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-confirmed-000112026.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"business-blue-tick-confirmed-000112026.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015825; classtype:social-engineering; sid:6015825; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.mmetaworld.com/campaigns/av595k41ghebc/track-url/eq23815asm867/4c41e60f265bdd05002225ec9e8bcfc65d53bb67/)"; flow:established,to_server; http.uri; content:"/campaigns/av595k41ghebc/track-url/eq23815asm867/4c41e60f265bdd05002225ec9e8bcfc65d53bb67/"; startswith; fast_pattern; http.host; content:"app.mmetaworld.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015826; classtype:social-engineering; sid:6015826; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docusign.documentfileappsuitesverification8877584990303094847578494.dlnllc.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"docusign.documentfileappsuitesverification8877584990303094847578494.dlnllc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015827; classtype:social-engineering; sid:6015827; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-git-06-10-chorewebremovemultichaintokenuxfla-ee0b7b-uniswap.vercel.app/portfolio)"; flow:established,to_server; http.uri; content:"/portfolio"; startswith; fast_pattern; http.host; content:"web-git-06-10-chorewebremovemultichaintokenuxfla-ee0b7b-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015828; classtype:social-engineering; sid:6015828; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (exodus-authorized.com/authentication)"; flow:established,to_server; http.uri; content:"/authentication"; startswith; fast_pattern; http.host; content:"exodus-authorized.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015829; classtype:social-engineering; sid:6015829; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.1188xinpujing.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.1188xinpujing.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015830; classtype:social-engineering; sid:6015830; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (teachersamanthasilva.github.io/CloneHomeInstagram)"; flow:established,to_server; http.uri; content:"/CloneHomeInstagram"; startswith; fast_pattern; http.host; content:"teachersamanthasilva.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015831; classtype:social-engineering; sid:6015831; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ch5-wanmeiworld.com/?DefineDeliver)"; flow:established,to_server; http.uri; content:"/?DefineDeliver"; startswith; fast_pattern; http.host; content:"ch5-wanmeiworld.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015832; classtype:social-engineering; sid:6015832; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloud.com.gr/njH/l/cnD)"; flow:established,to_server; http.uri; content:"/njH/l/cnD"; startswith; fast_pattern; http.host; content:"icloud.com.gr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015833; classtype:social-engineering; sid:6015833; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spectrumwebmail22.systeme.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spectrumwebmail22.systeme.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015834; classtype:social-engineering; sid:6015834; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (expensestatus.com/2513501.doc/18a80a/fad0f483-81b2-45c6-ad47-7272058d9cb6/)"; flow:established,to_server; http.uri; content:"/2513501.doc/18a80a/fad0f483-81b2-45c6-ad47-7272058d9cb6/"; startswith; fast_pattern; http.host; content:"expensestatus.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015835; classtype:social-engineering; sid:6015835; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bitmartlugins.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bitmartlugins.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015836; classtype:social-engineering; sid:6015836; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (barclays-grads.twineapp.com/password/invalid-tenant)"; flow:established,to_server; http.uri; content:"/password/invalid-tenant"; startswith; fast_pattern; http.host; content:"barclays-grads.twineapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015837; classtype:social-engineering; sid:6015837; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cliente-i-limpfeirao.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cliente-i-limpfeirao.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015838; classtype:social-engineering; sid:6015838; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamasklogino.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metamasklogino.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015839; classtype:social-engineering; sid:6015839; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rbxmulti.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rbxmulti.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015840; classtype:social-engineering; sid:6015840; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-authorized-0000120262x1.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"business-blue-tick-authorized-0000120262x1.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015841; classtype:social-engineering; sid:6015841; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-authorized-000012026v34.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"business-blue-tick-authorized-000012026v34.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015842; classtype:social-engineering; sid:6015842; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (01sw-bdg8-oxmc.alina-ciorba-duncantoplis-co-uk-s-account.workers.dev/b5d982ce4a6b22d3?email=user@example.com)"; flow:established,to_server; http.uri; content:"/b5d982ce4a6b22d3?email=user@example.com"; startswith; fast_pattern; http.host; content:"01sw-bdg8-oxmc.alina-ciorba-duncantoplis-co-uk-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015843; classtype:social-engineering; sid:6015843; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (areaexclusiva.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"areaexclusiva.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015844; classtype:social-engineering; sid:6015844; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fapr.mom/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fapr.mom"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015845; classtype:social-engineering; sid:6015845; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toki-gov-tr-fatih.vercel.app/giris.php)"; flow:established,to_server; http.uri; content:"/giris.php"; startswith; fast_pattern; http.host; content:"toki-gov-tr-fatih.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015846; classtype:social-engineering; sid:6015846; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enlineagalicia.github.io/personas/)"; flow:established,to_server; http.uri; content:"/personas/"; startswith; fast_pattern; http.host; content:"enlineagalicia.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015847; classtype:social-engineering; sid:6015847; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-confirmed-000362026.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"business-blue-tick-confirmed-000362026.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015848; classtype:social-engineering; sid:6015848; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-myxfinity-update.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-myxfinity-update.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015849; classtype:social-engineering; sid:6015849; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (estebangt1029.github.io/Clon-Instagram)"; flow:established,to_server; http.uri; content:"/Clon-Instagram"; startswith; fast_pattern; http.host; content:"estebangt1029.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015850; classtype:social-engineering; sid:6015850; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imztoken.com/security)"; flow:established,to_server; http.uri; content:"/security"; startswith; fast_pattern; http.host; content:"imztoken.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015851; classtype:social-engineering; sid:6015851; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.inoutlconfirmar.webcindario.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.inoutlconfirmar.webcindario.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015852; classtype:social-engineering; sid:6015852; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enlineaecuadorcredito-2026-enlinea--serviciosubii.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"enlineaecuadorcredito-2026-enlinea--serviciosubii.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015853; classtype:social-engineering; sid:6015853; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ckuygfdr.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ckuygfdr.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015854; classtype:social-engineering; sid:6015854; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kucoinaii.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kucoinaii.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015855; classtype:social-engineering; sid:6015855; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-testing-dev-entry-gateway-uniswap.vercel.app/portfolio)"; flow:established,to_server; http.uri; content:"/portfolio"; startswith; fast_pattern; http.host; content:"web-testing-dev-entry-gateway-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015856; classtype:social-engineering; sid:6015856; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mrmmhung-cpu.github.io/fictional-octo-meme/)"; flow:established,to_server; http.uri; content:"/fictional-octo-meme/"; startswith; fast_pattern; http.host; content:"mrmmhung-cpu.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015857; classtype:social-engineering; sid:6015857; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (salathebox.com/wp-content/id.handel.mobile.de-login-service/)"; flow:established,to_server; http.uri; content:"/wp-content/id.handel.mobile.de-login-service/"; startswith; fast_pattern; http.host; content:"salathebox.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015858; classtype:social-engineering; sid:6015858; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (digitalsolutionsagt.affinityc2penterpris.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"digitalsolutionsagt.affinityc2penterpris.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015859; classtype:social-engineering; sid:6015859; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cloud.digitalizer.in/men/)"; flow:established,to_server; http.uri; content:"/men/"; startswith; fast_pattern; http.host; content:"cloud.digitalizer.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015860; classtype:social-engineering; sid:6015860; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webtrafficguard2.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webtrafficguard2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015861; classtype:social-engineering; sid:6015861; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.coderhub-one.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.coderhub-one.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015862; classtype:social-engineering; sid:6015862; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clonmove.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"clonmove.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015863; classtype:social-engineering; sid:6015863; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rodovlas-freeflow-2vla.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rodovlas-freeflow-2vla.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015864; classtype:social-engineering; sid:6015864; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rroblox.wf/users/1618139589/profile)"; flow:established,to_server; http.uri; content:"/users/1618139589/profile"; startswith; fast_pattern; http.host; content:"rroblox.wf"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015865; classtype:social-engineering; sid:6015865; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coco-dog.jp/ae/index.php?id=033)"; flow:established,to_server; http.uri; content:"/ae/index.php?id=033"; startswith; fast_pattern; http.host; content:"coco-dog.jp"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015866; classtype:social-engineering; sid:6015866; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kunishe.com/yz/Adobe___Installer.html)"; flow:established,to_server; http.uri; content:"/yz/Adobe___Installer.html"; startswith; fast_pattern; http.host; content:"kunishe.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015867; classtype:social-engineering; sid:6015867; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-confirmed-000142026.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"business-blue-tick-confirmed-000142026.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015868; classtype:social-engineering; sid:6015868; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paypal.authia-rule.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paypal.authia-rule.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015869; classtype:social-engineering; sid:6015869; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iil12.my.id/Pemulihan-Akun-Dana/nohp/index.html)"; flow:established,to_server; http.uri; content:"/Pemulihan-Akun-Dana/nohp/index.html"; startswith; fast_pattern; http.host; content:"iil12.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015870; classtype:social-engineering; sid:6015870; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hulyacrk.github.io/edevlet)"; flow:established,to_server; http.uri; content:"/edevlet"; startswith; fast_pattern; http.host; content:"hulyacrk.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015871; classtype:social-engineering; sid:6015871; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (recargabundles.com/offer/?gad_source=)"; flow:established,to_server; http.uri; content:"/offer/?gad_source="; startswith; fast_pattern; http.host; content:"recargabundles.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015872; classtype:social-engineering; sid:6015872; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (koylu-bot.neocities.org/cvcvv/)"; flow:established,to_server; http.uri; content:"/cvcvv/"; startswith; fast_pattern; http.host; content:"koylu-bot.neocities.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015873; classtype:social-engineering; sid:6015873; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (learn-start-trzo-en.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"learn-start-trzo-en.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015874; classtype:social-engineering; sid:6015874; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.galaxypedals.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.galaxypedals.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015875; classtype:social-engineering; sid:6015875; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nerdstarcode.github.io/Clone-Instagram)"; flow:established,to_server; http.uri; content:"/Clone-Instagram"; startswith; fast_pattern; http.host; content:"nerdstarcode.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015876; classtype:social-engineering; sid:6015876; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toki-gov-tr-fatih.vercel.app/giris.php/)"; flow:established,to_server; http.uri; content:"/giris.php/"; startswith; fast_pattern; http.host; content:"toki-gov-tr-fatih.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015877; classtype:social-engineering; sid:6015877; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (linkedin.securityreview.casa/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"linkedin.securityreview.casa"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015878; classtype:social-engineering; sid:6015878; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bancolaumentatucupo-net.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bancolaumentatucupo-net.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015879; classtype:social-engineering; sid:6015879; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-confirmed-000272026.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"business-blue-tick-confirmed-000272026.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015880; classtype:social-engineering; sid:6015880; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bm03.ru/zxn110/pay/)"; flow:established,to_server; http.uri; content:"/zxn110/pay/"; startswith; fast_pattern; http.host; content:"bm03.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015881; classtype:social-engineering; sid:6015881; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-confirmed-000372026.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"business-blue-tick-confirmed-000372026.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015882; classtype:social-engineering; sid:6015882; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (er-priyanshishukla.github.io/netflix-clone)"; flow:established,to_server; http.uri; content:"/netflix-clone"; startswith; fast_pattern; http.host; content:"er-priyanshishukla.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015883; classtype:social-engineering; sid:6015883; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.toki-gov-tr-fatih.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.toki-gov-tr-fatih.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015884; classtype:social-engineering; sid:6015884; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7-0070hu.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7-0070hu.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015885; classtype:social-engineering; sid:6015885; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.martumaswallt.darlic.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.martumaswallt.darlic.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015886; classtype:social-engineering; sid:6015886; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-git-06-10-chorewebremovemultichaintokenuxfla-ee0b7b-uniswap.vercel.app/explore)"; flow:established,to_server; http.uri; content:"/explore"; startswith; fast_pattern; http.host; content:"web-git-06-10-chorewebremovemultichaintokenuxfla-ee0b7b-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015887; classtype:social-engineering; sid:6015887; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (freeflow.br-rodovias.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"freeflow.br-rodovias.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015888; classtype:social-engineering; sid:6015888; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-confirmed-000072026.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"business-blue-tick-confirmed-000072026.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015889; classtype:social-engineering; sid:6015889; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-confirmed-000322026.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"business-blue-tick-confirmed-000322026.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015890; classtype:social-engineering; sid:6015890; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (advana.lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"advana.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015891; classtype:social-engineering; sid:6015891; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cn-imtoken.com/download/)"; flow:established,to_server; http.uri; content:"/download/"; startswith; fast_pattern; http.host; content:"www.cn-imtoken.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015892; classtype:social-engineering; sid:6015892; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (payme-paypal.com/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"payme-paypal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015893; classtype:social-engineering; sid:6015893; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (01sw-bdg8-oxmc.alina-ciorba-duncantoplis-co-uk-s-account.workers.dev/8b7ec8c660309969?email=user@example.com)"; flow:established,to_server; http.uri; content:"/8b7ec8c660309969?email=user@example.com"; startswith; fast_pattern; http.host; content:"01sw-bdg8-oxmc.alina-ciorba-duncantoplis-co-uk-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015894; classtype:social-engineering; sid:6015894; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dejadirsbm-intereccanad.replit.app/inter~cas/dejsr/app/index.html)"; flow:established,to_server; http.uri; content:"/inter~cas/dejsr/app/index.html"; startswith; fast_pattern; http.host; content:"dejadirsbm-intereccanad.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015895; classtype:social-engineering; sid:6015895; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trazor-iiostart.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trazor-iiostart.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015896; classtype:social-engineering; sid:6015896; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (primepremium.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"primepremium.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015897; classtype:social-engineering; sid:6015897; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-confirmed-000122026.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"business-blue-tick-confirmed-000122026.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015898; classtype:social-engineering; sid:6015898; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-confirmed-000222026.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"business-blue-tick-confirmed-000222026.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015899; classtype:social-engineering; sid:6015899; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-blue-tick-confirmed-000202026.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"business-blue-tick-confirmed-000202026.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015900; classtype:social-engineering; sid:6015900; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kronosquantity.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kronosquantity.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015901; classtype:social-engineering; sid:6015901; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (extra-cyan-zfxl6ma9.edgeone.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"extra-cyan-zfxl6ma9.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015902; classtype:social-engineering; sid:6015902; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rakeshdubey4.github.io/amazonClone/)"; flow:established,to_server; http.uri; content:"/amazonClone/"; startswith; fast_pattern; http.host; content:"rakeshdubey4.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015903; classtype:social-engineering; sid:6015903; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bdvenlineaw.github.io/galicia.com)"; flow:established,to_server; http.uri; content:"/galicia.com"; startswith; fast_pattern; http.host; content:"bdvenlineaw.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015904; classtype:social-engineering; sid:6015904; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (creditoenlineaecuador-2026-w-23--ecuadorcredire.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"creditoenlineaecuador-2026-w-23--ecuadorcredire.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015905; classtype:social-engineering; sid:6015905; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aileveevlilikfonu.com/hizligirisiniz.php)"; flow:established,to_server; http.uri; content:"/hizligirisiniz.php"; startswith; fast_pattern; http.host; content:"aileveevlilikfonu.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015906; classtype:social-engineering; sid:6015906; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (20-228-132-238.cpanel.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"20-228-132-238.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015907; classtype:social-engineering; sid:6015907; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rcb.cuj.temporary.site/banmro/app-vernieuwen/card.html)"; flow:established,to_server; http.uri; content:"/banmro/app-vernieuwen/card.html"; startswith; fast_pattern; http.host; content:"rcb.cuj.temporary.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015908; classtype:social-engineering; sid:6015908; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nwp6qjrhd.kapsalontulp.nl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nwp6qjrhd.kapsalontulp.nl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015909; classtype:social-engineering; sid:6015909; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tugcekaner.github.io/movie_clone)"; flow:established,to_server; http.uri; content:"/movie_clone"; startswith; fast_pattern; http.host; content:"tugcekaner.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015910; classtype:social-engineering; sid:6015910; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (20-228-132-238.cpanel.site/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"20-228-132-238.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015911; classtype:social-engineering; sid:6015911; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (swapnil-2004.github.io/Netflix_Clone-2024/)"; flow:established,to_server; http.uri; content:"/Netflix_Clone-2024/"; startswith; fast_pattern; http.host; content:"swapnil-2004.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015912; classtype:social-engineering; sid:6015912; rev:1; metadata: signature_severity Major, created_et 2026_06_27;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.odpsodo.biz/verification-vfiwl6o2q07v020t)"; flow:established,to_server; http.uri; content:"/verification-vfiwl6o2q07v020t"; startswith; fast_pattern; http.host; content:"www.odpsodo.biz"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015913; classtype:social-engineering; sid:6015913; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgarecom.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledgarecom.zapier.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015914; classtype:social-engineering; sid:6015914; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s-g-espace02.bolt.host/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"s-g-espace02.bolt.host"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6015915; classtype:social-engineering; sid:6015915; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qq888apps.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qq888apps.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015916; classtype:social-engineering; sid:6015916; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pericena.github.io/RABooks.io/)"; flow:established,to_server; http.uri; content:"/RABooks.io/"; startswith; fast_pattern; http.host; content:"pericena.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015917; classtype:social-engineering; sid:6015917; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.snffas.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.snffas.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015918; classtype:social-engineering; sid:6015918; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uphdeiose.azurewebsites.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uphdeiose.azurewebsites.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015919; classtype:social-engineering; sid:6015919; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (y3ep-qkqx-9l1g.tnt-eb1.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"y3ep-qkqx-9l1g.tnt-eb1.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015920; classtype:social-engineering; sid:6015920; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (learn-start-trezr-us.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"learn-start-trezr-us.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015921; classtype:social-engineering; sid:6015921; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (micheleclementi2000-star.github.io/instagram-video-trending)"; flow:established,to_server; http.uri; content:"/instagram-video-trending"; startswith; fast_pattern; http.host; content:"micheleclementi2000-star.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015922; classtype:social-engineering; sid:6015922; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pericena.github.io/RABooks.io)"; flow:established,to_server; http.uri; content:"/RABooks.io"; startswith; fast_pattern; http.host; content:"pericena.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015923; classtype:social-engineering; sid:6015923; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (updatdmsntfcn.liveblog365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"updatdmsntfcn.liveblog365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015924; classtype:social-engineering; sid:6015924; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (peacefx-tulumba-4e7020-tq1204-gg-2406pem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"peacefx-tulumba-4e7020-tq1204-gg-2406pem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015925; classtype:social-engineering; sid:6015925; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1778winol.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1778winol.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015926; classtype:social-engineering; sid:6015926; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (soliciteseunovoaumentodelmt.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"soliciteseunovoaumentodelmt.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015927; classtype:social-engineering; sid:6015927; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gracapglogin.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.gracapglogin.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015928; classtype:social-engineering; sid:6015928; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (php-6ff5f.wasmer.app/login.php)"; flow:established,to_server; http.uri; content:"/login.php"; startswith; fast_pattern; http.host; content:"php-6ff5f.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015929; classtype:social-engineering; sid:6015929; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ybqiq.anaox.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"ybqiq.anaox.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015930; classtype:social-engineering; sid:6015930; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (workshop-pistols.shop/appdata/workshop/balance/)"; flow:established,to_server; http.uri; content:"/appdata/workshop/balance/"; startswith; fast_pattern; http.host; content:"workshop-pistols.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015931; classtype:social-engineering; sid:6015931; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suivi-infos-ch.com/pages/ban.php)"; flow:established,to_server; http.uri; content:"/pages/ban.php"; startswith; fast_pattern; http.host; content:"suivi-infos-ch.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015932; classtype:social-engineering; sid:6015932; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1778winoi.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1778winoi.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015933; classtype:social-engineering; sid:6015933; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6kbetpt.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6kbetpt.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015934; classtype:social-engineering; sid:6015934; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d3ath-walker.github.io/amazon)"; flow:established,to_server; http.uri; content:"/amazon"; startswith; fast_pattern; http.host; content:"d3ath-walker.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015935; classtype:social-engineering; sid:6015935; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faq-start-trezzor-io-web.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"faq-start-trezzor-io-web.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015936; classtype:social-engineering; sid:6015936; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.negociosvirtualbancolombia.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.negociosvirtualbancolombia.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015937; classtype:social-engineering; sid:6015937; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (peacefx-tulumba-4e7020-tq1204-gg-2406pem.pages.dev/welcome_aboard?welcome=100067059075094&token248=100067059075094&name_token136=PR%20GUARD%20-%20SFC%20Guzm%C3%A1n)"; flow:established,to_server; http.uri; content:"/welcome_aboard?welcome=100067059075094&token248=100067059075094&name_token136=PR%20GUARD%20-%20SFC%20Guzm%C3%A1n"; startswith; fast_pattern; http.host; content:"peacefx-tulumba-4e7020-tq1204-gg-2406pem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015938; classtype:social-engineering; sid:6015938; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amarifirmdynamic-concepts.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amarifirmdynamic-concepts.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015939; classtype:social-engineering; sid:6015939; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (elliotdevjames-max.github.io/amazing.com/)"; flow:established,to_server; http.uri; content:"/amazing.com/"; startswith; fast_pattern; http.host; content:"elliotdevjames-max.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015940; classtype:social-engineering; sid:6015940; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (viinwkwk-dot.github.io/instagram./)"; flow:established,to_server; http.uri; content:"/instagram./"; startswith; fast_pattern; http.host; content:"viinwkwk-dot.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015941; classtype:social-engineering; sid:6015941; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sucurvpan360-production.up.railway.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sucurvpan360-production.up.railway.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015942; classtype:social-engineering; sid:6015942; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-kraken-start.zapier.app/kraken)"; flow:established,to_server; http.uri; content:"/kraken"; startswith; fast_pattern; http.host; content:"web-kraken-start.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015943; classtype:social-engineering; sid:6015943; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gokul1305-web.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"gokul1305-web.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015944; classtype:social-engineering; sid:6015944; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6kbet1l.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6kbet1l.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015945; classtype:social-engineering; sid:6015945; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cdsxd.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cdsxd.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015946; classtype:social-engineering; sid:6015946; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help.valverestore.com/id/76561197960265754)"; flow:established,to_server; http.uri; content:"/id/76561197960265754"; startswith; fast_pattern; http.host; content:"help.valverestore.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015947; classtype:social-engineering; sid:6015947; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aceco.mypi.co/anmelden-page-review/login)"; flow:established,to_server; http.uri; content:"/anmelden-page-review/login"; startswith; fast_pattern; http.host; content:"aceco.mypi.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015948; classtype:social-engineering; sid:6015948; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sebet-z.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.sebet-z.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015949; classtype:social-engineering; sid:6015949; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (x63j-8zv7-vorz.jonie-points4purpose-com-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"x63j-8zv7-vorz.jonie-points4purpose-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015950; classtype:social-engineering; sid:6015950; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (conceicao-peres.github.io/recriar-pagina-login-Instagram)"; flow:established,to_server; http.uri; content:"/recriar-pagina-login-Instagram"; startswith; fast_pattern; http.host; content:"conceicao-peres.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015951; classtype:social-engineering; sid:6015951; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (negociosvirtualbancolombia.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"negociosvirtualbancolombia.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015952; classtype:social-engineering; sid:6015952; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebookaccountsmanager.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"facebookaccountsmanager.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015953; classtype:social-engineering; sid:6015953; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (disc-aqua-e56n.squarespace.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"disc-aqua-e56n.squarespace.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015954; classtype:social-engineering; sid:6015954; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (243267.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"243267.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015955; classtype:social-engineering; sid:6015955; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (z-mustafa.github.io/AAweb/)"; flow:established,to_server; http.uri; content:"/AAweb/"; startswith; fast_pattern; http.host; content:"z-mustafa.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015956; classtype:social-engineering; sid:6015956; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17712.wang/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17712.wang"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015957; classtype:social-engineering; sid:6015957; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.6299betol.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.6299betol.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015958; classtype:social-engineering; sid:6015958; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b3570.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b3570.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015959; classtype:social-engineering; sid:6015959; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (learn-trezo-io-start-cdn.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"learn-trezo-io-start-cdn.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015960; classtype:social-engineering; sid:6015960; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (https--www-roblox.co/users/93760184/profile)"; flow:established,to_server; http.uri; content:"/users/93760184/profile"; startswith; fast_pattern; http.host; content:"https--www-roblox.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015961; classtype:social-engineering; sid:6015961; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shareprofile.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shareprofile.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015962; classtype:social-engineering; sid:6015962; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.3766bet1x.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.3766bet1x.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015963; classtype:social-engineering; sid:6015963; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.freecash.com/academy/en/cashout/free-robux/)"; flow:established,to_server; http.uri; content:"/academy/en/cashout/free-robux/"; startswith; fast_pattern; http.host; content:"www.freecash.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015964; classtype:social-engineering; sid:6015964; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.243240.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.243240.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015965; classtype:social-engineering; sid:6015965; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.6655betapp3.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.6655betapp3.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015966; classtype:social-engineering; sid:6015966; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tjzju.anaox.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"tjzju.anaox.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015967; classtype:social-engineering; sid:6015967; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dregs-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dregs-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015968; classtype:social-engineering; sid:6015968; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram2101.github.io/instagram./)"; flow:established,to_server; http.uri; content:"/instagram./"; startswith; fast_pattern; http.host; content:"instagram2101.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015969; classtype:social-engineering; sid:6015969; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shruk6587-sketch.github.io/netflix-internspark-task4/)"; flow:established,to_server; http.uri; content:"/netflix-internspark-task4/"; startswith; fast_pattern; http.host; content:"shruk6587-sketch.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015970; classtype:social-engineering; sid:6015970; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s182026.github.io/Amazon-Clone.html)"; flow:established,to_server; http.uri; content:"/Amazon-Clone.html"; startswith; fast_pattern; http.host; content:"s182026.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015971; classtype:social-engineering; sid:6015971; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fidelitysupport.company/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fidelitysupport.company"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015972; classtype:social-engineering; sid:6015972; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentojaa03.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentojaa03.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015973; classtype:social-engineering; sid:6015973; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.iliouk.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.iliouk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015974; classtype:social-engineering; sid:6015974; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mrinal22307.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"mrinal22307.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015975; classtype:social-engineering; sid:6015975; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (26junverifieaqui.fwh.is/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"26junverifieaqui.fwh.is"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015976; classtype:social-engineering; sid:6015976; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (y3ep-qkqx-9l1g.tnt-eb1.workers.dev/bdf8a5e98e99e897?email=corum1@4ad47ec496aa2d2888ff1b842302eea05ccb.org)"; flow:established,to_server; http.uri; content:"/bdf8a5e98e99e897?email=corum1@4ad47ec496aa2d2888ff1b842302eea05ccb.org"; startswith; fast_pattern; http.host; content:"y3ep-qkqx-9l1g.tnt-eb1.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015977; classtype:social-engineering; sid:6015977; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bsbet-top.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bsbet-top.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015978; classtype:social-engineering; sid:6015978; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (devraj1031.github.io/Instagram-login/)"; flow:established,to_server; http.uri; content:"/Instagram-login/"; startswith; fast_pattern; http.host; content:"devraj1031.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015979; classtype:social-engineering; sid:6015979; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (raja12346.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"raja12346.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015980; classtype:social-engineering; sid:6015980; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (larn-start-trezr.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"larn-start-trezr.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015981; classtype:social-engineering; sid:6015981; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suck-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"suck-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015982; classtype:social-engineering; sid:6015982; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7931187365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7931187365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015983; classtype:social-engineering; sid:6015983; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dinghdjushs.info/PL-1466-160526/?u=97C1466)"; flow:established,to_server; http.uri; content:"/PL-1466-160526/?u=97C1466"; startswith; fast_pattern; http.host; content:"dinghdjushs.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015984; classtype:social-engineering; sid:6015984; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (unicredit-eu.one/bh/login.php/)"; flow:established,to_server; http.uri; content:"/bh/login.php/"; startswith; fast_pattern; http.host; content:"unicredit-eu.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015985; classtype:social-engineering; sid:6015985; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nhbpky.n0c.world/mrajfmdry/compresser/ch/swiss2/)"; flow:established,to_server; http.uri; content:"/mrajfmdry/compresser/ch/swiss2/"; startswith; fast_pattern; http.host; content:"nhbpky.n0c.world"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015986; classtype:social-engineering; sid:6015986; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cunbetpd.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cunbetpd.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015987; classtype:social-engineering; sid:6015987; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (php-c56th8koc87.wasmer.app/login.php)"; flow:established,to_server; http.uri; content:"/login.php"; startswith; fast_pattern; http.host; content:"php-c56th8koc87.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015988; classtype:social-engineering; sid:6015988; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (desale-chirag.github.io/Amazon_Clone)"; flow:established,to_server; http.uri; content:"/Amazon_Clone"; startswith; fast_pattern; http.host; content:"desale-chirag.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015989; classtype:social-engineering; sid:6015989; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (text-claim-esl-org.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"text-claim-esl-org.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015990; classtype:social-engineering; sid:6015990; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xuqoc.anaox.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"xuqoc.anaox.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015991; classtype:social-engineering; sid:6015991; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram2101.github.io/instagram.)"; flow:established,to_server; http.uri; content:"/instagram."; startswith; fast_pattern; http.host; content:"instagram2101.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015992; classtype:social-engineering; sid:6015992; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.roblox.com.sc/users/4394042916/profile/)"; flow:established,to_server; http.uri; content:"/users/4394042916/profile/"; startswith; fast_pattern; http.host; content:"www.roblox.com.sc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015993; classtype:social-engineering; sid:6015993; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6299betoi.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6299betoi.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015994; classtype:social-engineering; sid:6015994; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (newallgc.free.nf/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"newallgc.free.nf"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015995; classtype:social-engineering; sid:6015995; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezorsuite.wallet-app-com.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezorsuite.wallet-app-com.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015996; classtype:social-engineering; sid:6015996; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nxvc.web.id/aktiifkan-danaapayllater/login.php)"; flow:established,to_server; http.uri; content:"/aktiifkan-danaapayllater/login.php"; startswith; fast_pattern; http.host; content:"nxvc.web.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015997; classtype:social-engineering; sid:6015997; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fortnitecheck.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fortnitecheck.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015998; classtype:social-engineering; sid:6015998; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (g87tuyyh-dpk2qpy1qd9z.edgeone.dev/english.html)"; flow:established,to_server; http.uri; content:"/english.html"; startswith; fast_pattern; http.host; content:"g87tuyyh-dpk2qpy1qd9z.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015999; classtype:social-engineering; sid:6015999; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (82kkjogo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"82kkjogo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016000; classtype:social-engineering; sid:6016000; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (opensea.connectwalletdefi.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"opensea.connectwalletdefi.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016001; classtype:social-engineering; sid:6016001; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwwv-roblox.co/users/1704538081/profile)"; flow:established,to_server; http.uri; content:"/users/1704538081/profile"; startswith; fast_pattern; http.host; content:"wwwv-roblox.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016002; classtype:social-engineering; sid:6016002; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (onlinepersonasenlinea.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"onlinepersonasenlinea.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016003; classtype:social-engineering; sid:6016003; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sebetoi.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sebetoi.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016004; classtype:social-engineering; sid:6016004; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfiniinewvoicealert.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfiniinewvoicealert.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016005; classtype:social-engineering; sid:6016005; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (espin-asociados.com/wp-admin/mycss/app/ch/)"; flow:established,to_server; http.uri; content:"/wp-admin/mycss/app/ch/"; startswith; fast_pattern; http.host; content:"espin-asociados.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016006; classtype:social-engineering; sid:6016006; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (att-77.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"att-77.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016007; classtype:social-engineering; sid:6016007; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.coinbase-wallet.org.cn/coinbase/)"; flow:established,to_server; http.uri; content:"/coinbase/"; startswith; fast_pattern; http.host; content:"www.coinbase-wallet.org.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016008; classtype:social-engineering; sid:6016008; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (121z2.catex.at:443/trs/)"; flow:established,to_server; http.uri; content:"/trs/"; startswith; fast_pattern; http.host; content:"121z2.catex.at:443"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016009; classtype:social-engineering; sid:6016009; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chirag8162-droid.github.io/Netflix_Clone/)"; flow:established,to_server; http.uri; content:"/Netflix_Clone/"; startswith; fast_pattern; http.host; content:"chirag8162-droid.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016010; classtype:social-engineering; sid:6016010; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (35391986365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"35391986365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016011; classtype:social-engineering; sid:6016011; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (update-2026.webcindario.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"update-2026.webcindario.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016012; classtype:social-engineering; sid:6016012; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (unicredit-eu.one/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"unicredit-eu.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016013; classtype:social-engineering; sid:6016013; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.be95.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.be95.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016014; classtype:social-engineering; sid:6016014; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qq99.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qq99.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016015; classtype:social-engineering; sid:6016015; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lkscv.anaox.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"lkscv.anaox.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016016; classtype:social-engineering; sid:6016016; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (esl-claimalerts.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"esl-claimalerts.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016017; classtype:social-engineering; sid:6016017; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sebetol.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sebetol.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016018; classtype:social-engineering; sid:6016018; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hhttps-www-roblox.co/login?returnUrl=1789978322)"; flow:established,to_server; http.uri; content:"/login?returnUrl=1789978322"; startswith; fast_pattern; http.host; content:"hhttps-www-roblox.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016019; classtype:social-engineering; sid:6016019; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (leelasaikodeti.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"leelasaikodeti.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016020; classtype:social-engineering; sid:6016020; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (84899286365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"84899286365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016021; classtype:social-engineering; sid:6016021; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiideeliityy.7324.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fiideeliityy.7324.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016022; classtype:social-engineering; sid:6016022; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-tranor-biz-vroltek-plarnix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-tranor-biz-vroltek-plarnix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016023; classtype:social-engineering; sid:6016023; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.wangu180.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.wangu180.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016024; classtype:social-engineering; sid:6016024; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prabhangshudas81-crypto.github.io/Project-Netflix/)"; flow:established,to_server; http.uri; content:"/Project-Netflix/"; startswith; fast_pattern; http.host; content:"prabhangshudas81-crypto.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016025; classtype:social-engineering; sid:6016025; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mlllerbernd.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mlllerbernd.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016026; classtype:social-engineering; sid:6016026; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (carrefour-pass-espace.de/fr/fr/)"; flow:established,to_server; http.uri; content:"/fr/fr/"; startswith; fast_pattern; http.host; content:"carrefour-pass-espace.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016027; classtype:social-engineering; sid:6016027; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jihadislam-jr.github.io/instagram-homepage/)"; flow:established,to_server; http.uri; content:"/instagram-homepage/"; startswith; fast_pattern; http.host; content:"jihadislam-jr.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016028; classtype:social-engineering; sid:6016028; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-reset-password.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-reset-password.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016029; classtype:social-engineering; sid:6016029; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (walllet-io.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"walllet-io.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016030; classtype:social-engineering; sid:6016030; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qq88jogos.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qq88jogos.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016031; classtype:social-engineering; sid:6016031; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gls-ptsez.cfd/pts)"; flow:established,to_server; http.uri; content:"/pts"; startswith; fast_pattern; http.host; content:"gls-ptsez.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016032; classtype:social-engineering; sid:6016032; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (saiyuuuo.github.io/tiktok-coin-page)"; flow:established,to_server; http.uri; content:"/tiktok-coin-page"; startswith; fast_pattern; http.host; content:"saiyuuuo.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016033; classtype:social-engineering; sid:6016033; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (winx7com.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"winx7com.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016034; classtype:social-engineering; sid:6016034; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rmbnagpur.com/ncr)"; flow:established,to_server; http.uri; content:"/ncr"; startswith; fast_pattern; http.host; content:"rmbnagpur.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016035; classtype:social-engineering; sid:6016035; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6kbet1x.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6kbet1x.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016036; classtype:social-engineering; sid:6016036; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portalexpress.net/2fb8071a-0463-4603-8a2a-b8859236a0b1/a/94abf01b-580e-4270-bcbc-621e5fdbc476/ccp?lid=247b10e3-4efc-4357-9dc8-8b1f8ba15b2d/)"; flow:established,to_server; http.uri; content:"/2fb8071a-0463-4603-8a2a-b8859236a0b1/a/94abf01b-580e-4270-bcbc-621e5fdbc476/ccp?lid=247b10e3-4efc-4357-9dc8-8b1f8ba15b2d/"; startswith; fast_pattern; http.host; content:"portalexpress.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016037; classtype:social-engineering; sid:6016037; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fidelitydesk.company/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fidelitydesk.company"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016038; classtype:social-engineering; sid:6016038; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sucurvpan360-production.up.railway.app/espejo/landing.html)"; flow:established,to_server; http.uri; content:"/espejo/landing.html"; startswith; fast_pattern; http.host; content:"sucurvpan360-production.up.railway.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016039; classtype:social-engineering; sid:6016039; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (boydq.anaox.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"boydq.anaox.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016040; classtype:social-engineering; sid:6016040; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.wimbledon-dashboard.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.wimbledon-dashboard.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016041; classtype:social-engineering; sid:6016041; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (max-shiningfortune.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"max-shiningfortune.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016042; classtype:social-engineering; sid:6016042; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kpay.sn/wp-admin/includes/xd/zd/clients/login.php)"; flow:established,to_server; http.uri; content:"/wp-admin/includes/xd/zd/clients/login.php"; startswith; fast_pattern; http.host; content:"kpay.sn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016043; classtype:social-engineering; sid:6016043; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ladul.lat/offer/)"; flow:established,to_server; http.uri; content:"/offer/"; startswith; fast_pattern; http.host; content:"ladul.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016044; classtype:social-engineering; sid:6016044; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.vitsolution.it/supporto/components/com_modules/modules/secure/)"; flow:established,to_server; http.uri; content:"/supporto/components/com_modules/modules/secure/"; startswith; fast_pattern; http.host; content:"www.vitsolution.it"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016045; classtype:social-engineering; sid:6016045; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ocipt.anaox.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"ocipt.anaox.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016046; classtype:social-engineering; sid:6016046; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (guialimp.lat/offer/)"; flow:established,to_server; http.uri; content:"/offer/"; startswith; fast_pattern; http.host; content:"guialimp.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016047; classtype:social-engineering; sid:6016047; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abhijeetkumartiwari.github.io/Amazon-homepage--clone/)"; flow:established,to_server; http.uri; content:"/Amazon-homepage--clone/"; startswith; fast_pattern; http.host; content:"abhijeetkumartiwari.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016048; classtype:social-engineering; sid:6016048; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebookaccountsmanager.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.facebookaccountsmanager.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016049; classtype:social-engineering; sid:6016049; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.updatdmsntfcn.liveblog365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.updatdmsntfcn.liveblog365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016050; classtype:social-engineering; sid:6016050; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.yjzaxyey.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.yjzaxyey.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016051; classtype:social-engineering; sid:6016051; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (viinwkwk-dot.github.io/instagram.)"; flow:established,to_server; http.uri; content:"/instagram."; startswith; fast_pattern; http.host; content:"viinwkwk-dot.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016052; classtype:social-engineering; sid:6016052; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.to.lk/MvUTaV/)"; flow:established,to_server; http.uri; content:"/MvUTaV/"; startswith; fast_pattern; http.host; content:"www.to.lk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016053; classtype:social-engineering; sid:6016053; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (25365x.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"25365x.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016054; classtype:social-engineering; sid:6016054; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help-trzorwallet-io.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"help-trzorwallet-io.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016055; classtype:social-engineering; sid:6016055; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rdsgabriel.github.io/fb-clone)"; flow:established,to_server; http.uri; content:"/fb-clone"; startswith; fast_pattern; http.host; content:"rdsgabriel.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016056; classtype:social-engineering; sid:6016056; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coinbasesupportfixwindow.feltis.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coinbasesupportfixwindow.feltis.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016057; classtype:social-engineering; sid:6016057; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mlzlq.anaox.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"mlzlq.anaox.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016058; classtype:social-engineering; sid:6016058; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yhokvu.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yhokvu.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016059; classtype:social-engineering; sid:6016059; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezorsuite.walllet-app.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezorsuite.walllet-app.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016060; classtype:social-engineering; sid:6016060; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trc20z.cyou/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trc20z.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016061; classtype:social-engineering; sid:6016061; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nhbpky.n0c.world/ph-sys/suspended/)"; flow:established,to_server; http.uri; content:"/ph-sys/suspended/"; startswith; fast_pattern; http.host; content:"nhbpky.n0c.world"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016062; classtype:social-engineering; sid:6016062; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (saraswatikhalate11-ai.github.io/amazon-clone-html-css-BEGINNERS/)"; flow:established,to_server; http.uri; content:"/amazon-clone-html-css-BEGINNERS/"; startswith; fast_pattern; http.host; content:"saraswatikhalate11-ai.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016063; classtype:social-engineering; sid:6016063; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (74-248-32-242.cprapid.com/de/kasse.php)"; flow:established,to_server; http.uri; content:"/de/kasse.php"; startswith; fast_pattern; http.host; content:"74-248-32-242.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016064; classtype:social-engineering; sid:6016064; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pericena.github.io/RABooks.io/pokemon.html)"; flow:established,to_server; http.uri; content:"/RABooks.io/pokemon.html"; startswith; fast_pattern; http.host; content:"pericena.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016065; classtype:social-engineering; sid:6016065; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suivi-infos-ch.com/pages/login.php)"; flow:established,to_server; http.uri; content:"/pages/login.php"; startswith; fast_pattern; http.host; content:"suivi-infos-ch.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016066; classtype:social-engineering; sid:6016066; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sandanderusa.click/personal/market/)"; flow:established,to_server; http.uri; content:"/personal/market/"; startswith; fast_pattern; http.host; content:"sandanderusa.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016067; classtype:social-engineering; sid:6016067; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (y.buvi.top/page/F/rewclub/)"; flow:established,to_server; http.uri; content:"/page/F/rewclub/"; startswith; fast_pattern; http.host; content:"y.buvi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016068; classtype:social-engineering; sid:6016068; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (177betbaixar.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"177betbaixar.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016069; classtype:social-engineering; sid:6016069; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cloud-bridg-e-trezoor-cdn.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cloud-bridg-e-trezoor-cdn.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016070; classtype:social-engineering; sid:6016070; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (unicredit-eu.one/bh/login.php)"; flow:established,to_server; http.uri; content:"/bh/login.php"; startswith; fast_pattern; http.host; content:"unicredit-eu.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016071; classtype:social-engineering; sid:6016071; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suivi-infos-ch.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"suivi-infos-ch.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016072; classtype:social-engineering; sid:6016072; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bybit.filei.co.kr/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bybit.filei.co.kr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016073; classtype:social-engineering; sid:6016073; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (76189.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"76189.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016074; classtype:social-engineering; sid:6016074; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prajwalkuchewar.github.io/javascript-amazon-project/)"; flow:established,to_server; http.uri; content:"/javascript-amazon-project/"; startswith; fast_pattern; http.host; content:"prajwalkuchewar.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016075; classtype:social-engineering; sid:6016075; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qq888oi.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qq888oi.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016076; classtype:social-engineering; sid:6016076; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1778winpt.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1778winpt.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016077; classtype:social-engineering; sid:6016077; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amisl.anaox.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"amisl.anaox.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016078; classtype:social-engineering; sid:6016078; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-reset-password.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-reset-password.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016079; classtype:social-engineering; sid:6016079; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sebet1l.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.sebet1l.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016080; classtype:social-engineering; sid:6016080; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (elliotdevjames-max.github.io/amazing.com)"; flow:established,to_server; http.uri; content:"/amazing.com"; startswith; fast_pattern; http.host; content:"elliotdevjames-max.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016081; classtype:social-engineering; sid:6016081; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dieyw83levyc2.cloudfront.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dieyw83levyc2.cloudfront.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016082; classtype:social-engineering; sid:6016082; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (saudeemfoco.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"saudeemfoco.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016083; classtype:social-engineering; sid:6016083; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qq888brasil.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qq888brasil.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016084; classtype:social-engineering; sid:6016084; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.brxbetol.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.brxbetol.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016085; classtype:social-engineering; sid:6016085; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.my-whtsapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.my-whtsapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016086; classtype:social-engineering; sid:6016086; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.secu.borneoechos.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.secu.borneoechos.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016087; classtype:social-engineering; sid:6016087; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (laxman43aa.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"laxman43aa.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016088; classtype:social-engineering; sid:6016088; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rajlearner.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"rajlearner.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016089; classtype:social-engineering; sid:6016089; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.qq888ol.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.qq888ol.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016090; classtype:social-engineering; sid:6016090; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (crazy12347.github.io/protfolio)"; flow:established,to_server; http.uri; content:"/protfolio"; startswith; fast_pattern; http.host; content:"crazy12347.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016091; classtype:social-engineering; sid:6016091; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.teams-rp.com/p/fjbd-cbch/aktjboeu/)"; flow:established,to_server; http.uri; content:"/p/fjbd-cbch/aktjboeu/"; startswith; fast_pattern; http.host; content:"s.teams-rp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016092; classtype:social-engineering; sid:6016092; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalne.4892k67.lol/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalne.4892k67.lol"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016093; classtype:social-engineering; sid:6016093; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.oferta3047154859.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalnie.oferta3047154859.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016094; classtype:social-engineering; sid:6016094; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mgu.zdl.mybluehost.me/it/login/)"; flow:established,to_server; http.uri; content:"/it/login/"; startswith; fast_pattern; http.host; content:"mgu.zdl.mybluehost.me"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016095; classtype:social-engineering; sid:6016095; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pasastesintagcl.qpon/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pasastesintagcl.qpon"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016096; classtype:social-engineering; sid:6016096; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mgu.zdl.mybluehost.me/it/login/app/index.php)"; flow:established,to_server; http.uri; content:"/it/login/app/index.php"; startswith; fast_pattern; http.host; content:"mgu.zdl.mybluehost.me"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016097; classtype:social-engineering; sid:6016097; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokainie.4892k67.lol/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokainie.4892k67.lol"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016098; classtype:social-engineering; sid:6016098; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalne.121she131.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalne.121she131.xyz"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016099; classtype:social-engineering; sid:6016099; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my-pntfp.xyz/?secure_connect=uj2*fc*&_subid=32jost4.33.1nbhd&_token=39lpve1ej3j3f.1782576164.16.0cd38cd8980b97574bd536b931dac3ac)"; flow:established,to_server; http.uri; content:"/?secure_connect=uj2*fc*&_subid=32jost4.33.1nbhd&_token=39lpve1ej3j3f.1782576164.16.0cd38cd8980b97574bd536b931dac3ac"; startswith; fast_pattern; http.host; content:"my-pntfp.xyz"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016100; classtype:social-engineering; sid:6016100; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pasastesintagcl.rest/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pasastesintagcl.rest"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016101; classtype:social-engineering; sid:6016101; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my-pntfp.xyz/?secure_connect=uj2*fc*&_subid=2721skq.33.1nbh4&_token=1r9bc6u6f209.1782579001.20.a4ff8d6c20509c724c3823dc347c09d5)"; flow:established,to_server; http.uri; content:"/?secure_connect=uj2*fc*&_subid=2721skq.33.1nbh4&_token=1r9bc6u6f209.1782579001.20.a4ff8d6c20509c724c3823dc347c09d5"; startswith; fast_pattern; http.host; content:"my-pntfp.xyz"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016102; classtype:social-engineering; sid:6016102; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokainie.121she131.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokainie.121she131.xyz"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016103; classtype:social-engineering; sid:6016103; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pasastesintagas.casa/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pasastesintagas.casa"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016104; classtype:social-engineering; sid:6016104; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (activ77bhd.iceiy.com/index2.html)"; flow:established,to_server; http.uri; content:"/index2.html"; startswith; fast_pattern; http.host; content:"activ77bhd.iceiy.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016105; classtype:social-engineering; sid:6016105; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pasastesintagas.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pasastesintagas.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016106; classtype:social-engineering; sid:6016106; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokainie.121she131.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokainie.121she131.xyz"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016107; classtype:social-engineering; sid:6016107; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.lokalna-3887012.sbs/oferta/Jacuzzi-ogrodowe-ca%C5%82oroczne-HotSpring-Sovereign-USA/815724073)"; flow:established,to_server; http.uri; content:"/oferta/Jacuzzi-ogrodowe-ca%C5%82oroczne-HotSpring-Sovereign-USA/815724073"; startswith; fast_pattern; http.host; content:"allegrolokalnie.lokalna-3887012.sbs"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016108; classtype:social-engineering; sid:6016108; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pasastesintap.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pasastesintap.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016109; classtype:social-engineering; sid:6016109; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pasastesintag26.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pasastesintag26.click"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016110; classtype:social-engineering; sid:6016110; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pasastesintagionline.help/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pasastesintagionline.help"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016111; classtype:social-engineering; sid:6016111; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie.121she131.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.121she131.xyz"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016112; classtype:social-engineering; sid:6016112; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (85b090c9-750d-43df-9cd0-762e8d5dd824-00-1oea40x0eh4gz.spock.replit.dev/index2.html)"; flow:established,to_server; http.uri; content:"/index2.html"; startswith; fast_pattern; http.host; content:"85b090c9-750d-43df-9cd0-762e8d5dd824-00-1oea40x0eh4gz.spock.replit.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016113; classtype:social-engineering; sid:6016113; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (htr-fdsw.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"htr-fdsw.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016114; classtype:social-engineering; sid:6016114; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.localizadorsatelitalph.one/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"mail.localizadorsatelitalph.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016115; classtype:social-engineering; sid:6016115; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sense.kento.cfd/new/)"; flow:established,to_server; http.uri; content:"/new/"; startswith; fast_pattern; http.host; content:"sense.kento.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016116; classtype:social-engineering; sid:6016116; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentojaultra03.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentojaultra03.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016117; classtype:social-engineering; sid:6016117; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store.communitygamebuild.shop/workshop/AK47-EternalDecay/)"; flow:established,to_server; http.uri; content:"/workshop/AK47-EternalDecay/"; startswith; fast_pattern; http.host; content:"store.communitygamebuild.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016118; classtype:social-engineering; sid:6016118; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hckde4yw0y0c.swipepages.net/webmail)"; flow:established,to_server; http.uri; content:"/webmail"; startswith; fast_pattern; http.host; content:"hckde4yw0y0c.swipepages.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016119; classtype:social-engineering; sid:6016119; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store.communitydesingbuild.shop/workshop/Brassbound-Fury/)"; flow:established,to_server; http.uri; content:"/workshop/Brassbound-Fury/"; startswith; fast_pattern; http.host; content:"store.communitydesingbuild.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016120; classtype:social-engineering; sid:6016120; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.x-icloud.com/ICL26)"; flow:established,to_server; http.uri; content:"/ICL26"; startswith; fast_pattern; http.host; content:"mail.x-icloud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016121; classtype:social-engineering; sid:6016121; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-io-trezee-r.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-io-trezee-r.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016122; classtype:social-engineering; sid:6016122; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login-trezor-io-start-faq.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"login-trezor-io-start-faq.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016123; classtype:social-engineering; sid:6016123; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (servi-max.com/wp-content/uploads/wkheqpu/max/ch/capch.php)"; flow:established,to_server; http.uri; content:"/wp-content/uploads/wkheqpu/max/ch/capch.php"; startswith; fast_pattern; http.host; content:"servi-max.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016124; classtype:social-engineering; sid:6016124; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (findmy-icloud.us/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"findmy-icloud.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016125; classtype:social-engineering; sid:6016125; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hyder-rehan.github.io/Amazon-clone.)"; flow:established,to_server; http.uri; content:"/Amazon-clone."; startswith; fast_pattern; http.host; content:"hyder-rehan.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016126; classtype:social-engineering; sid:6016126; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (supportphone.help/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"supportphone.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016127; classtype:social-engineering; sid:6016127; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (overview-en-login.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"overview-en-login.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016128; classtype:social-engineering; sid:6016128; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17pj-95s06-5ks-6mua-wvptm.pages.dev/qaz-wsx-edc-rfv?welcome=901296799967512&token248=901296799967512&name_token136=SMFG%20India%20Credit/)"; flow:established,to_server; http.uri; content:"/qaz-wsx-edc-rfv?welcome=901296799967512&token248=901296799967512&name_token136=SMFG%20India%20Credit/"; startswith; fast_pattern; http.host; content:"17pj-95s06-5ks-6mua-wvptm.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016129; classtype:social-engineering; sid:6016129; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toplukonutbass.vercel.app/giris.php)"; flow:established,to_server; http.uri; content:"/giris.php"; startswith; fast_pattern; http.host; content:"toplukonutbass.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016130; classtype:social-engineering; sid:6016130; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ictd.printertroubleshoot.com/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380/)"; flow:established,to_server; http.uri; content:"/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380/"; startswith; fast_pattern; http.host; content:"ictd.printertroubleshoot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016131; classtype:social-engineering; sid:6016131; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.appe-cloud.life/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"mail.appe-cloud.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016132; classtype:social-engineering; sid:6016132; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagem.kro.kr/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagem.kro.kr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016133; classtype:social-engineering; sid:6016133; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.robloxanimalhospitalplush.com/product/animal-hospital-anomaly-plush-001/)"; flow:established,to_server; http.uri; content:"/product/animal-hospital-anomaly-plush-001/"; startswith; fast_pattern; http.host; content:"www.robloxanimalhospitalplush.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016134; classtype:social-engineering; sid:6016134; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (memorable-mindset-057912.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"memorable-mindset-057912.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016135; classtype:social-engineering; sid:6016135; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accesobhddirecto.iceiy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"accesobhddirecto.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016136; classtype:social-engineering; sid:6016136; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toplukonutbalk.vercel.app/giris.php)"; flow:established,to_server; http.uri; content:"/giris.php"; startswith; fast_pattern; http.host; content:"toplukonutbalk.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016137; classtype:social-engineering; sid:6016137; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.wechatapp.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.wechatapp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016138; classtype:social-engineering; sid:6016138; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zurchb.online/platform.html)"; flow:established,to_server; http.uri; content:"/platform.html"; startswith; fast_pattern; http.host; content:"zurchb.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016139; classtype:social-engineering; sid:6016139; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toplukonutbasvurusp.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"toplukonutbasvurusp.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016140; classtype:social-engineering; sid:6016140; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (davidyarham.github.io/blnq-neosdfgsdfgsdfgsdfgsdf)"; flow:established,to_server; http.uri; content:"/blnq-neosdfgsdfgsdfgsdfgsdf"; startswith; fast_pattern; http.host; content:"davidyarham.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016141; classtype:social-engineering; sid:6016141; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-filmes-theta.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app-filmes-theta.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016142; classtype:social-engineering; sid:6016142; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mdanu7.github.io/netflix_webpage)"; flow:established,to_server; http.uri; content:"/netflix_webpage"; startswith; fast_pattern; http.host; content:"mdanu7.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016143; classtype:social-engineering; sid:6016143; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icu-whatapp.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"icu-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016144; classtype:social-engineering; sid:6016144; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (php-3150d.wasmer.app/login.php)"; flow:established,to_server; http.uri; content:"/login.php"; startswith; fast_pattern; http.host; content:"php-3150d.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016145; classtype:social-engineering; sid:6016145; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rastreoglobal.click/ICL26)"; flow:established,to_server; http.uri; content:"/ICL26"; startswith; fast_pattern; http.host; content:"rastreoglobal.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016146; classtype:social-engineering; sid:6016146; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aliimohamedmorsi.github.io/Netflix)"; flow:established,to_server; http.uri; content:"/Netflix"; startswith; fast_pattern; http.host; content:"aliimohamedmorsi.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016147; classtype:social-engineering; sid:6016147; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (detect-idevice.us/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"detect-idevice.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016148; classtype:social-engineering; sid:6016148; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wha-whatapp.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wha-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016149; classtype:social-engineering; sid:6016149; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (00000f20-51c2-7000-b18c-ce458f11f12.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"00000f20-51c2-7000-b18c-ce458f11f12.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016150; classtype:social-engineering; sid:6016150; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kirangolada.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"kirangolada.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016151; classtype:social-engineering; sid:6016151; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (geolocalizadorsatelital.help/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"geolocalizadorsatelital.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016152; classtype:social-engineering; sid:6016152; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (treziostart.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"treziostart.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016153; classtype:social-engineering; sid:6016153; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portal-en-trezor-io-start-faq.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"portal-en-trezor-io-start-faq.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016154; classtype:social-engineering; sid:6016154; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (afreen0601.github.io/e_commerce_landing_page)"; flow:established,to_server; http.uri; content:"/e_commerce_landing_page"; startswith; fast_pattern; http.host; content:"afreen0601.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016155; classtype:social-engineering; sid:6016155; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dineshgehlot2005.github.io/Amazone_Clone)"; flow:established,to_server; http.uri; content:"/Amazone_Clone"; startswith; fast_pattern; http.host; content:"dineshgehlot2005.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016156; classtype:social-engineering; sid:6016156; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.andersonmorais.com/texto-da-curadoria)"; flow:established,to_server; http.uri; content:"/texto-da-curadoria"; startswith; fast_pattern; http.host; content:"www.andersonmorais.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016157; classtype:social-engineering; sid:6016157; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (harryjohan969-tech.github.io/Instagram-/)"; flow:established,to_server; http.uri; content:"/Instagram-/"; startswith; fast_pattern; http.host; content:"harryjohan969-tech.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016158; classtype:social-engineering; sid:6016158; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (supportdevices.help/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"supportdevices.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016159; classtype:social-engineering; sid:6016159; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mannamyagneswari14.github.io/Instagram-Landing-Page-Clone/)"; flow:established,to_server; http.uri; content:"/Instagram-Landing-Page-Clone/"; startswith; fast_pattern; http.host; content:"mannamyagneswari14.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016160; classtype:social-engineering; sid:6016160; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bet365k22.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bet365k22.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016161; classtype:social-engineering; sid:6016161; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (projectphp-4641b677s.wasmer.app/login.php)"; flow:established,to_server; http.uri; content:"/login.php"; startswith; fast_pattern; http.host; content:"projectphp-4641b677s.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016162; classtype:social-engineering; sid:6016162; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.staging.citiretailservices.citibankonlline.com/?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTc4MjY4MTQ2MywiaWF0IjoxNzgyNjc0MjYzLCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIzMnVsOWoxMjlyZjJtdG02Yzg0YWo2MDEiLCJuYmYiOjE3ODI2NzQyNjMsInRzIjoxNzgyNjc0MjYzMjM0MjA3fQ.MbtIcJXWs6Kq7pKixdfCsUL5oBXdvRJ0VvdhFbSDUYU&sid=099b8774-7326-11f1-ac2b-c44e99b1d0c1)"; flow:established,to_server; http.uri; content:"/?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTc4MjY4MTQ2MywiaWF0IjoxNzgyNjc0MjYzLCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIzMnVsOWoxMjlyZjJtdG02Yzg0YWo2MDEiLCJuYmYiOjE3ODI2NzQyNjMsInRzIjoxNzgyNjc0MjYzMjM0MjA3fQ.MbtIcJXWs6Kq7pKixdfCsUL5oBXdvRJ0VvdhFbSDUYU&sid=099b8774-7326-11f1-ac2b-c44e99b1d0c1"; startswith; fast_pattern; http.host; content:"www.staging.citiretailservices.citibankonlline.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016163; classtype:social-engineering; sid:6016163; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-faq-trezor-eng-public.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-faq-trezor-eng-public.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016164; classtype:social-engineering; sid:6016164; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.locate-idevice.us/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"www.locate-idevice.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016165; classtype:social-engineering; sid:6016165; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toplukonutbasd.vercel.app/giris.php)"; flow:established,to_server; http.uri; content:"/giris.php"; startswith; fast_pattern; http.host; content:"toplukonutbasd.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016166; classtype:social-engineering; sid:6016166; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cliente-o-limpfeirao.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cliente-o-limpfeirao.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016167; classtype:social-engineering; sid:6016167; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.idevicemyfind.us/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"mail.idevicemyfind.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016168; classtype:social-engineering; sid:6016168; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (axite-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"axite-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016169; classtype:social-engineering; sid:6016169; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rihan21hash.github.io/Netflix-UI-2023/)"; flow:established,to_server; http.uri; content:"/Netflix-UI-2023/"; startswith; fast_pattern; http.host; content:"rihan21hash.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016170; classtype:social-engineering; sid:6016170; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dfgdsfgsdfg-4129.twil.io/cvxbdghdfhdfg.html)"; flow:established,to_server; http.uri; content:"/cvxbdghdfhdfg.html"; startswith; fast_pattern; http.host; content:"dfgdsfgsdfg-4129.twil.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016171; classtype:social-engineering; sid:6016171; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suite.trezor.walletsapp.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"suite.trezor.walletsapp.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016172; classtype:social-engineering; sid:6016172; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hckde4yw0y0c.swipepages.net/net)"; flow:established,to_server; http.uri; content:"/net"; startswith; fast_pattern; http.host; content:"hckde4yw0y0c.swipepages.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016173; classtype:social-engineering; sid:6016173; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.airbnbvip.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.airbnbvip.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016174; classtype:social-engineering; sid:6016174; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.detect-devices.us/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"mail.detect-devices.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016175; classtype:social-engineering; sid:6016175; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (encontrar-iphone.us/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"encontrar-iphone.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016176; classtype:social-engineering; sid:6016176; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paypal-signin.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paypal-signin.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016177; classtype:social-engineering; sid:6016177; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (com-whatapp.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"com-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016178; classtype:social-engineering; sid:6016178; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cathe.fuse-caribbean.com/b4638c9dccaab)"; flow:established,to_server; http.uri; content:"/b4638c9dccaab"; startswith; fast_pattern; http.host; content:"cathe.fuse-caribbean.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016179; classtype:social-engineering; sid:6016179; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (x-icloud.com/ICL26)"; flow:established,to_server; http.uri; content:"/ICL26"; startswith; fast_pattern; http.host; content:"x-icloud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016180; classtype:social-engineering; sid:6016180; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (unless-initiatives-yourself-interstate.trycloudflare.com/login.html)"; flow:established,to_server; http.uri; content:"/login.html"; startswith; fast_pattern; http.host; content:"unless-initiatives-yourself-interstate.trycloudflare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016181; classtype:social-engineering; sid:6016181; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my-iccount-support.us/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"my-iccount-support.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016182; classtype:social-engineering; sid:6016182; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jnagrur.github.io/Amazon-Prototype/)"; flow:established,to_server; http.uri; content:"/Amazon-Prototype/"; startswith; fast_pattern; http.host; content:"jnagrur.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016183; classtype:social-engineering; sid:6016183; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.trezor.win/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.trezor.win"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016184; classtype:social-engineering; sid:6016184; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mindful-material-449985.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mindful-material-449985.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016185; classtype:social-engineering; sid:6016185; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wmail-zim-gov-rj-se-sp-br-63330a.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wmail-zim-gov-rj-se-sp-br-63330a.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016186; classtype:social-engineering; sid:6016186; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kaimdkdk31-spec.github.io/instagram/)"; flow:established,to_server; http.uri; content:"/instagram/"; startswith; fast_pattern; http.host; content:"kaimdkdk31-spec.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016187; classtype:social-engineering; sid:6016187; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.team-al.com/p/fhtb-mrgw/nwjrmgwv/)"; flow:established,to_server; http.uri; content:"/p/fhtb-mrgw/nwjrmgwv/"; startswith; fast_pattern; http.host; content:"s.team-al.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016188; classtype:social-engineering; sid:6016188; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (helpry.jp/jvvr-paypal-bswuzt-helpry-dqxo-paypal-spnrps)"; flow:established,to_server; http.uri; content:"/jvvr-paypal-bswuzt-helpry-dqxo-paypal-spnrps"; startswith; fast_pattern; http.host; content:"helpry.jp"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016189; classtype:social-engineering; sid:6016189; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.supportphone.help/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"mail.supportphone.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016190; classtype:social-engineering; sid:6016190; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (findlapple.us/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"findlapple.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016191; classtype:social-engineering; sid:6016191; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (post.uberweisung.help/209754052/fr)"; flow:established,to_server; http.uri; content:"/209754052/fr"; startswith; fast_pattern; http.host; content:"post.uberweisung.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016192; classtype:social-engineering; sid:6016192; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cathe.fuse-caribbean.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cathe.fuse-caribbean.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016193; classtype:social-engineering; sid:6016193; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dropbox.rev.it/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dropbox.rev.it"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016194; classtype:social-engineering; sid:6016194; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help-troziostart.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"help-troziostart.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016195; classtype:social-engineering; sid:6016195; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (encontrar-id.us/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"encontrar-id.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016196; classtype:social-engineering; sid:6016196; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spms003.github.io/2112)"; flow:established,to_server; http.uri; content:"/2112"; startswith; fast_pattern; http.host; content:"spms003.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016197; classtype:social-engineering; sid:6016197; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.geolocalizadorsatelital.help/ICL26)"; flow:established,to_server; http.uri; content:"/ICL26"; startswith; fast_pattern; http.host; content:"mail.geolocalizadorsatelital.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016198; classtype:social-engineering; sid:6016198; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kolizhyg.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kolizhyg.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016199; classtype:social-engineering; sid:6016199; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.beta.lunyiche.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.beta.lunyiche.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016200; classtype:social-engineering; sid:6016200; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.supportdevices.help/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"mail.supportdevices.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016201; classtype:social-engineering; sid:6016201; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebooklinksk.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebooklinksk.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016202; classtype:social-engineering; sid:6016202; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tksdsc.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.tksdsc.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016203; classtype:social-engineering; sid:6016203; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suteamcomlmunity.com/promo/8157919656552)"; flow:established,to_server; http.uri; content:"/promo/8157919656552"; startswith; fast_pattern; http.host; content:"suteamcomlmunity.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016204; classtype:social-engineering; sid:6016204; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.moeeto.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.moeeto.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016205; classtype:social-engineering; sid:6016205; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ssl-whatapp.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ssl-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016206; classtype:social-engineering; sid:6016206; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (356confirmacion.free.nf/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"356confirmacion.free.nf"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016207; classtype:social-engineering; sid:6016207; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secu.borneoechos.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secu.borneoechos.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016208; classtype:social-engineering; sid:6016208; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pc-hk-whatapp.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pc-hk-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016209; classtype:social-engineering; sid:6016209; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (idevicemyfind.us/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"idevicemyfind.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016210; classtype:social-engineering; sid:6016210; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (live365-outlook.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"live365-outlook.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016211; classtype:social-engineering; sid:6016211; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (saurabhtripathiii.github.io/Amazon-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-clone/"; startswith; fast_pattern; http.host; content:"saurabhtripathiii.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016212; classtype:social-engineering; sid:6016212; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (makdev85.github.io/E-commerce-clone/)"; flow:established,to_server; http.uri; content:"/E-commerce-clone/"; startswith; fast_pattern; http.host; content:"makdev85.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016213; classtype:social-engineering; sid:6016213; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (localizadorsatelital.sbs/ICL26)"; flow:established,to_server; http.uri; content:"/ICL26"; startswith; fast_pattern; http.host; content:"localizadorsatelital.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016214; classtype:social-engineering; sid:6016214; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.findicloud-my.us/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"mail.findicloud-my.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016215; classtype:social-engineering; sid:6016215; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anasqadri-dev.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"anasqadri-dev.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016216; classtype:social-engineering; sid:6016216; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store.communitycreatorwork.shop/workshop/Brassbound-Fury/)"; flow:established,to_server; http.uri; content:"/workshop/Brassbound-Fury/"; startswith; fast_pattern; http.host; content:"store.communitycreatorwork.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016217; classtype:social-engineering; sid:6016217; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (findicloud-my.us/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"findicloud-my.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016218; classtype:social-engineering; sid:6016218; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.devices-detect.us/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"mail.devices-detect.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016219; classtype:social-engineering; sid:6016219; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (utygekd.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"utygekd.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016220; classtype:social-engineering; sid:6016220; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.paypal-signin.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.paypal-signin.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016221; classtype:social-engineering; sid:6016221; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rackmontego.github.io/Netflix/)"; flow:established,to_server; http.uri; content:"/Netflix/"; startswith; fast_pattern; http.host; content:"rackmontego.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016222; classtype:social-engineering; sid:6016222; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alt-whatapp.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"alt-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016223; classtype:social-engineering; sid:6016223; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (find-mymapscloud.life/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"find-mymapscloud.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016224; classtype:social-engineering; sid:6016224; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (serverhelpsupport.com/erdsrdfjhdgsr/)"; flow:established,to_server; http.uri; content:"/erdsrdfjhdgsr/"; startswith; fast_pattern; http.host; content:"serverhelpsupport.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016225; classtype:social-engineering; sid:6016225; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebooklinksk.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebooklinksk.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016226; classtype:social-engineering; sid:6016226; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tkyshop.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tkyshop.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016227; classtype:social-engineering; sid:6016227; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.locate-idevice.us/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"mail.locate-idevice.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016228; classtype:social-engineering; sid:6016228; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toplukonutbasvurusp.vercel.app/giris.php)"; flow:established,to_server; http.uri; content:"/giris.php"; startswith; fast_pattern; http.host; content:"toplukonutbasvurusp.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016229; classtype:social-engineering; sid:6016229; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.find-mymapscloud.life/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"mail.find-mymapscloud.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016230; classtype:social-engineering; sid:6016230; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jyhbzgth.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jyhbzgth.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016231; classtype:social-engineering; sid:6016231; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (azlon-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"azlon-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016232; classtype:social-engineering; sid:6016232; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.findlapple.us/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"mail.findlapple.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016233; classtype:social-engineering; sid:6016233; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dc.cdn.adclosenn.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dc.cdn.adclosenn.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016234; classtype:social-engineering; sid:6016234; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (madhan050199.github.io/facebook-with-form-validation/)"; flow:established,to_server; http.uri; content:"/facebook-with-form-validation/"; startswith; fast_pattern; http.host; content:"madhan050199.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016235; classtype:social-engineering; sid:6016235; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pesquisabr.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pesquisabr.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016236; classtype:social-engineering; sid:6016236; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (37m.xgfc555.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"37m.xgfc555.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016237; classtype:social-engineering; sid:6016237; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fjoqj.bjad21jd-dmqpjhfqda.com:15679/?inviteCode=16148%5Cu0026cid=26)"; flow:established,to_server; http.uri; content:"/?inviteCode=16148%5Cu0026cid=26"; startswith; fast_pattern; http.host; content:"fjoqj.bjad21jd-dmqpjhfqda.com:15679"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016238; classtype:social-engineering; sid:6016238; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.localizadorsatelital.sbs/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"mail.localizadorsatelital.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016239; classtype:social-engineering; sid:6016239; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appe-cloud.life/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"appe-cloud.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016240; classtype:social-engineering; sid:6016240; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (siddheshsonje29-coder.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"siddheshsonje29-coder.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016241; classtype:social-engineering; sid:6016241; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ictd.printertroubleshoot.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"ictd.printertroubleshoot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016242; classtype:social-engineering; sid:6016242; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (beneficiosonline-2026.iceiy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"beneficiosonline-2026.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016243; classtype:social-engineering; sid:6016243; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatapp-com.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatapp-com.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016244; classtype:social-engineering; sid:6016244; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.rastreoglobal.click/ICL26)"; flow:established,to_server; http.uri; content:"/ICL26"; startswith; fast_pattern; http.host; content:"mail.rastreoglobal.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016245; classtype:social-engineering; sid:6016245; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (beta.lunyiche.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"beta.lunyiche.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016246; classtype:social-engineering; sid:6016246; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hyder-rehan.github.io/Amazon-clone./)"; flow:established,to_server; http.uri; content:"/Amazon-clone./"; startswith; fast_pattern; http.host; content:"hyder-rehan.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016247; classtype:social-engineering; sid:6016247; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fans-whatapp.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fans-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016248; classtype:social-engineering; sid:6016248; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (85b090c9-750d-43df-9cd0-762e8d5dd824-00-1oea40x0eh4gz.spock.replit.dev/index2.html)"; flow:established,to_server; http.uri; content:"/index2.html"; startswith; fast_pattern; http.host; content:"85b090c9-750d-43df-9cd0-762e8d5dd824-00-1oea40x0eh4gz.spock.replit.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016249; classtype:social-engineering; sid:6016249; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fojeye.primegrowthnetwork.com/podeseya/veki/xuzosusa/luyapa/index.php)"; flow:established,to_server; http.uri; content:"/podeseya/veki/xuzosusa/luyapa/index.php"; startswith; fast_pattern; http.host; content:"fojeye.primegrowthnetwork.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016250; classtype:social-engineering; sid:6016250; rev:1; metadata: signature_severity Major, created_et 2026_06_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreigx337topjjnlnmy6cuz7376hx2regd56m4dqqzehe7zthz3dr5eq.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreigx337topjjnlnmy6cuz7376hx2regd56m4dqqzehe7zthz3dr5eq.ipfs.dweb.link"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016251; classtype:social-engineering; sid:6016251; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spectrum-email-update.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spectrum-email-update.weeblysite.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016252; classtype:social-engineering; sid:6016252; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-smbc.vigourui.com/memx/force_goriyo/onlinecasino.jsp/dk=hp_008_0021756_hd?_eat=valid_20260630110544_faf02033139b97575ebcd2ce693ad4b4)"; flow:established,to_server; http.uri; content:"/memx/force_goriyo/onlinecasino.jsp/dk=hp_008_0021756_hd?_eat=valid_20260630110544_faf02033139b97575ebcd2ce693ad4b4"; startswith; fast_pattern; http.host; content:"web-smbc.vigourui.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016253; classtype:social-engineering; sid:6016253; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiedglq4jgcgqoxjap7rswpqoxaepcv6szm47h6koe6uhzhxnrfqhy.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiedglq4jgcgqoxjap7rswpqoxaepcv6szm47h6koe6uhzhxnrfqhy.ipfs.dweb.link"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016254; classtype:social-engineering; sid:6016254; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (renovar-perfil.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"renovar-perfil.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016255; classtype:social-engineering; sid:6016255; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (profoundwhiz.com/nhghg/bvvgg/sswbv/web/authen.php?web/auth/aru)"; flow:established,to_server; http.uri; content:"/nhghg/bvvgg/sswbv/web/authen.php?web/auth/aru"; startswith; fast_pattern; http.host; content:"profoundwhiz.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016256; classtype:social-engineering; sid:6016256; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bradesco.sistemadigitalnet.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bradesco.sistemadigitalnet.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016257; classtype:social-engineering; sid:6016257; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bradesco.netempresasvalida.digital/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bradesco.netempresasvalida.digital"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016258; classtype:social-engineering; sid:6016258; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreigpkmjxfjomhlppkwnzer2eo5z5364eivptc6znvm2nkhsolbvcjm.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreigpkmjxfjomhlppkwnzer2eo5z5364eivptc6znvm2nkhsolbvcjm.ipfs.dweb.link"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016259; classtype:social-engineering; sid:6016259; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiadxxipkfvnuf7p5wq7etjanq6e2g6xqamq6ixd4tz5spql62t3sy.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiadxxipkfvnuf7p5wq7etjanq6e2g6xqamq6ixd4tz5spql62t3sy.ipfs.dweb.link"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016260; classtype:social-engineering; sid:6016260; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiafsattndk6geedqydv357dn4tgwxl3xjxwindxg7od2xmce3tceq.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiafsattndk6geedqydv357dn4tgwxl3xjxwindxg7od2xmce3tceq.ipfs.dweb.link"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016261; classtype:social-engineering; sid:6016261; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (profoundwhiz.com/nhghg/bvvgg/sswbv/web/authen.php?web/auth/arub12#/dashboard/overviewAccounts/overview/index=cTUDl6591bDhMrgS1pgBdNu41Ux7MxDCLbZEXfkWvVa0XQTWG9gkBeZnMXG5CVuSUnKbQnPYpyvEQ8pU)"; flow:established,to_server; http.uri; content:"/nhghg/bvvgg/sswbv/web/authen.php?web/auth/arub12#/dashboard/overviewAccounts/overview/index=cTUDl6591bDhMrgS1pgBdNu41Ux7MxDCLbZEXfkWvVa0XQTWG9gkBeZnMXG5CVuSUnKbQnPYpyvEQ8pU"; startswith; fast_pattern; http.host; content:"profoundwhiz.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016262; classtype:social-engineering; sid:6016262; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (profoundwhiz.com/nhghg/bvvgg/sswbv)"; flow:established,to_server; http.uri; content:"/nhghg/bvvgg/sswbv"; startswith; fast_pattern; http.host; content:"profoundwhiz.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016263; classtype:social-engineering; sid:6016263; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-smbc.vigourui.com/memx/force_goriyo/onlinecasino.jsp/dk=hp_008_0021756_hd?_eat=valid_20260630101731_70d0301974fe6cf80dd2df7d9d30600b)"; flow:established,to_server; http.uri; content:"/memx/force_goriyo/onlinecasino.jsp/dk=hp_008_0021756_hd?_eat=valid_20260630101731_70d0301974fe6cf80dd2df7d9d30600b"; startswith; fast_pattern; http.host; content:"web-smbc.vigourui.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016264; classtype:social-engineering; sid:6016264; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clubmilesk.com/ec)"; flow:established,to_server; http.uri; content:"/ec"; startswith; fast_pattern; http.host; content:"clubmilesk.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016265; classtype:social-engineering; sid:6016265; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (centralcreditodigital.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"centralcreditodigital.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016266; classtype:social-engineering; sid:6016266; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.numatrix.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.numatrix.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016267; classtype:social-engineering; sid:6016267; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nuproxima.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nuproxima.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016268; classtype:social-engineering; sid:6016268; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ldiruttew.love/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ldiruttew.love"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016269; classtype:social-engineering; sid:6016269; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prjrv.an1zf.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"prjrv.an1zf.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016270; classtype:social-engineering; sid:6016270; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (centralfinancepro.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"centralfinancepro.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016271; classtype:social-engineering; sid:6016271; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spectrum-email-update.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spectrum-email-update.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016272; classtype:social-engineering; sid:6016272; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-powiadomienia.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-powiadomienia.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016273; classtype:social-engineering; sid:6016273; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalcreditofacil.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalcreditofacil.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016274; classtype:social-engineering; sid:6016274; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toplukonutbaff.vercel.app/giris.php)"; flow:established,to_server; http.uri; content:"/giris.php"; startswith; fast_pattern; http.host; content:"toplukonutbaff.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016275; classtype:social-engineering; sid:6016275; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (matbednarczyk.github.io/Netflix-landingpage)"; flow:established,to_server; http.uri; content:"/Netflix-landingpage"; startswith; fast_pattern; http.host; content:"matbednarczyk.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016276; classtype:social-engineering; sid:6016276; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook.hotzxgirl.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook.hotzxgirl.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016277; classtype:social-engineering; sid:6016277; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (72533.xyz/m/wp-admin/pomo/update1/)"; flow:established,to_server; http.uri; content:"/m/wp-admin/pomo/update1/"; startswith; fast_pattern; http.host; content:"72533.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016278; classtype:social-engineering; sid:6016278; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netcoins-login-x-auth.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netcoins-login-x-auth.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016279; classtype:social-engineering; sid:6016279; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kingslayer458.github.io/facebook-login-/)"; flow:established,to_server; http.uri; content:"/facebook-login-/"; startswith; fast_pattern; http.host; content:"kingslayer458.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016280; classtype:social-engineering; sid:6016280; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (onlinemailbox6347896235111php.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"onlinemailbox6347896235111php.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016281; classtype:social-engineering; sid:6016281; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.logs-smoky-psi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.logs-smoky-psi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016282; classtype:social-engineering; sid:6016282; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (crowded-smile-179970.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"crowded-smile-179970.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016283; classtype:social-engineering; sid:6016283; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tftue.an1zf.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"tftue.an1zf.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016284; classtype:social-engineering; sid:6016284; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (connect-trezor-io-start--help.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"connect-trezor-io-start--help.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016285; classtype:social-engineering; sid:6016285; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oului.an1zf.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"oului.an1zf.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016286; classtype:social-engineering; sid:6016286; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toplukonutbazp.vercel.app/giris.php)"; flow:established,to_server; http.uri; content:"/giris.php"; startswith; fast_pattern; http.host; content:"toplukonutbazp.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016287; classtype:social-engineering; sid:6016287; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsaepp.cyou/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsaepp.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016288; classtype:social-engineering; sid:6016288; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clientevision.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"clientevision.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016289; classtype:social-engineering; sid:6016289; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (areaexpress.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"areaexpress.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016290; classtype:social-engineering; sid:6016290; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xcndyteer.love/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xcndyteer.love"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016291; classtype:social-engineering; sid:6016291; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cheshihtml1.mybmtest999.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cheshihtml1.mybmtest999.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016292; classtype:social-engineering; sid:6016292; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-ndax-lginapp-auth.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sso-ndax-lginapp-auth.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016293; classtype:social-engineering; sid:6016293; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (one.fallup.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"one.fallup.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016294; classtype:social-engineering; sid:6016294; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (neon-vacherin-e0188b.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"neon-vacherin-e0188b.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016295; classtype:social-engineering; sid:6016295; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.001gamebaixar.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.001gamebaixar.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016296; classtype:social-engineering; sid:6016296; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (plenor-zemvik-b15da7-thjj-x2406abb.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"plenor-zemvik-b15da7-thjj-x2406abb.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016297; classtype:social-engineering; sid:6016297; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (begin-startezrio-en-us.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"begin-startezrio-en-us.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016298; classtype:social-engineering; sid:6016298; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.nuvertex.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.nuvertex.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016299; classtype:social-engineering; sid:6016299; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (graziellemaciel35-cmd.github.io/Clone.Facebook)"; flow:established,to_server; http.uri; content:"/Clone.Facebook"; startswith; fast_pattern; http.host; content:"graziellemaciel35-cmd.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016300; classtype:social-engineering; sid:6016300; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gsawytex.love/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gsawytex.love"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016301; classtype:social-engineering; sid:6016301; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hgsa242.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hgsa242.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016302; classtype:social-engineering; sid:6016302; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (y87f6s34a2qw-dp3fy8azkrz8.edgeone.dev/english.html)"; flow:established,to_server; http.uri; content:"/english.html"; startswith; fast_pattern; http.host; content:"y87f6s34a2qw-dp3fy8azkrz8.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016303; classtype:social-engineering; sid:6016303; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portalfinancasdigital.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"portalfinancasdigital.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016304; classtype:social-engineering; sid:6016304; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fasbook.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fasbook.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016305; classtype:social-engineering; sid:6016305; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iosmaps-d9h8cxg3f7dvakep.canadaeast-01.azurewebsites.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"iosmaps-d9h8cxg3f7dvakep.canadaeast-01.azurewebsites.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016306; classtype:social-engineering; sid:6016306; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f2r5.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f2r5.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016307; classtype:social-engineering; sid:6016307; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atomicurl.com/robloxsplittergame)"; flow:established,to_server; http.uri; content:"/robloxsplittergame"; startswith; fast_pattern; http.host; content:"atomicurl.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016308; classtype:social-engineering; sid:6016308; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (credibdhfacilito.infy.click/index2.html)"; flow:established,to_server; http.uri; content:"/index2.html"; startswith; fast_pattern; http.host; content:"credibdhfacilito.infy.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016309; classtype:social-engineering; sid:6016309; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portalpedagio-br.dynv6.net/freeflow/home.php)"; flow:established,to_server; http.uri; content:"/freeflow/home.php"; startswith; fast_pattern; http.host; content:"portalpedagio-br.dynv6.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016310; classtype:social-engineering; sid:6016310; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oqssc.an1zf.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"oqssc.an1zf.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016311; classtype:social-engineering; sid:6016311; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.icing-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.icing-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016312; classtype:social-engineering; sid:6016312; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-login-help.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-login-help.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016313; classtype:social-engineering; sid:6016313; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hellenvicente.github.io/html-css-facebook-login-page)"; flow:established,to_server; http.uri; content:"/html-css-facebook-login-page"; startswith; fast_pattern; http.host; content:"hellenvicente.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016314; classtype:social-engineering; sid:6016314; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalgestaocentral.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalgestaocentral.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016315; classtype:social-engineering; sid:6016315; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (open-bridge-trez.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"open-bridge-trez.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016316; classtype:social-engineering; sid:6016316; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uqmzdz-w7ce-947-4g1br-a3w.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uqmzdz-w7ce-947-4g1br-a3w.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016317; classtype:social-engineering; sid:6016317; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (static-orchid-743996.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"static-orchid-743996.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016318; classtype:social-engineering; sid:6016318; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nufusion.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nufusion.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016319; classtype:social-engineering; sid:6016319; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nuorigin.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nuorigin.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016320; classtype:social-engineering; sid:6016320; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (financepoint.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"financepoint.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016321; classtype:social-engineering; sid:6016321; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (steancommurnity.ru/Id/7656193558567379)"; flow:established,to_server; http.uri; content:"/Id/7656193558567379"; startswith; fast_pattern; http.host; content:"steancommurnity.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016322; classtype:social-engineering; sid:6016322; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (169tyesy.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"169tyesy.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016323; classtype:social-engineering; sid:6016323; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ziadanish2025.github.io/Login-to-facebook)"; flow:established,to_server; http.uri; content:"/Login-to-facebook"; startswith; fast_pattern; http.host; content:"ziadanish2025.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016324; classtype:social-engineering; sid:6016324; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jaiwuydr.love/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jaiwuydr.love"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016325; classtype:social-engineering; sid:6016325; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.001wintop.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.001wintop.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016326; classtype:social-engineering; sid:6016326; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.nuorbit.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.nuorbit.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016327; classtype:social-engineering; sid:6016327; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clientehubpro.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"clientehubpro.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016328; classtype:social-engineering; sid:6016328; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pdijcsuet.love/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pdijcsuet.love"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016329; classtype:social-engineering; sid:6016329; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (news.apple-cl0ud.com/?rid=Bcqbray)"; flow:established,to_server; http.uri; content:"/?rid=Bcqbray"; startswith; fast_pattern; http.host; content:"news.apple-cl0ud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016330; classtype:social-engineering; sid:6016330; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwwmaxes.top/4g/home.html)"; flow:established,to_server; http.uri; content:"/4g/home.html"; startswith; fast_pattern; http.host; content:"wwwmaxes.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016331; classtype:social-engineering; sid:6016331; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mingguanwanita.my/betty-banafe-terkilan-hak-jagaan-anak/)"; flow:established,to_server; http.uri; content:"/betty-banafe-terkilan-hak-jagaan-anak/"; startswith; fast_pattern; http.host; content:"www.mingguanwanita.my"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016332; classtype:social-engineering; sid:6016332; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clairelee-codes.github.io/react-netflix-clone/)"; flow:established,to_server; http.uri; content:"/react-netflix-clone/"; startswith; fast_pattern; http.host; content:"clairelee-codes.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016333; classtype:social-engineering; sid:6016333; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pvejo.an1zf.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"pvejo.an1zf.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016334; classtype:social-engineering; sid:6016334; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalfinancasplus.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalfinancasplus.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016335; classtype:social-engineering; sid:6016335; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (graziellemaciel35-cmd.github.io/Clone.Facebook/)"; flow:established,to_server; http.uri; content:"/Clone.Facebook/"; startswith; fast_pattern; http.host; content:"graziellemaciel35-cmd.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016336; classtype:social-engineering; sid:6016336; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instegram-max970.github.io/Instagram)"; flow:established,to_server; http.uri; content:"/Instagram"; startswith; fast_pattern; http.host; content:"instegram-max970.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016337; classtype:social-engineering; sid:6016337; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trzor-brige.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trzor-brige.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016338; classtype:social-engineering; sid:6016338; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adjuntardatosrequeridosw.iceiy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"adjuntardatosrequeridosw.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016339; classtype:social-engineering; sid:6016339; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nuventis.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nuventis.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016340; classtype:social-engineering; sid:6016340; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nunes-elloar.github.io/assuntos_testesFront-end/index.html)"; flow:established,to_server; http.uri; content:"/assuntos_testesFront-end/index.html"; startswith; fast_pattern; http.host; content:"nunes-elloar.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016341; classtype:social-engineering; sid:6016341; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sayes-weddings.de/home/core/)"; flow:established,to_server; http.uri; content:"/home/core/"; startswith; fast_pattern; http.host; content:"sayes-weddings.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016342; classtype:social-engineering; sid:6016342; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-cdn-ndax-com-auth.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sso-cdn-ndax-com-auth.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016343; classtype:social-engineering; sid:6016343; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nuatlas.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nuatlas.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016344; classtype:social-engineering; sid:6016344; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xbt8x82irz1kbcyq.hgsa242.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xbt8x82irz1kbcyq.hgsa242.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016345; classtype:social-engineering; sid:6016345; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wanshua-whatsapp.hk.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wanshua-whatsapp.hk.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016346; classtype:social-engineering; sid:6016346; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nupoint.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nupoint.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016347; classtype:social-engineering; sid:6016347; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docusign.well-done.kz/cgi-bin/Windows/utility.php)"; flow:established,to_server; http.uri; content:"/cgi-bin/Windows/utility.php"; startswith; fast_pattern; http.host; content:"docusign.well-done.kz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016348; classtype:social-engineering; sid:6016348; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smsbujbd.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"smsbujbd.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016349; classtype:social-engineering; sid:6016349; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yacfx.an1zf.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"yacfx.an1zf.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016350; classtype:social-engineering; sid:6016350; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nuprimex.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nuprimex.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016351; classtype:social-engineering; sid:6016351; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jepff.an1zf.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"jepff.an1zf.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016352; classtype:social-engineering; sid:6016352; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wyctridea.love/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wyctridea.love"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016353; classtype:social-engineering; sid:6016353; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (olgwf.an1zf.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"olgwf.an1zf.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016354; classtype:social-engineering; sid:6016354; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clientesfera.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"clientesfera.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016355; classtype:social-engineering; sid:6016355; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flowcentral.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"flowcentral.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016356; classtype:social-engineering; sid:6016356; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ficjseytea.love/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ficjseytea.love"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016357; classtype:social-engineering; sid:6016357; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (centralservicosfinanceiros.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"centralservicosfinanceiros.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016358; classtype:social-engineering; sid:6016358; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (public-bridge.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"public-bridge.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016359; classtype:social-engineering; sid:6016359; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rundwasser.de/factura/)"; flow:established,to_server; http.uri; content:"/factura/"; startswith; fast_pattern; http.host; content:"rundwasser.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016360; classtype:social-engineering; sid:6016360; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-login.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-login.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016361; classtype:social-engineering; sid:6016361; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (99yh53.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"99yh53.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016362; classtype:social-engineering; sid:6016362; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.metamaskloginu.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.metamaskloginu.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016363; classtype:social-engineering; sid:6016363; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shushi---cdn---swap.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shushi---cdn---swap.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016364; classtype:social-engineering; sid:6016364; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (delvaie.com/wrong.php/)"; flow:established,to_server; http.uri; content:"/wrong.php/"; startswith; fast_pattern; http.host; content:"delvaie.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016365; classtype:social-engineering; sid:6016365; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hsieuygrw.love/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hsieuygrw.love"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016366; classtype:social-engineering; sid:6016366; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (centralclientepro.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"centralclientepro.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016367; classtype:social-engineering; sid:6016367; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-itrust--capital-com--auth.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sso-itrust--capital-com--auth.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016368; classtype:social-engineering; sid:6016368; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blekfilogxn.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"blekfilogxn.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016369; classtype:social-engineering; sid:6016369; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalfocus.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalfocus.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016370; classtype:social-engineering; sid:6016370; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiusyevr.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fiusyevr.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016371; classtype:social-engineering; sid:6016371; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (crisouzath.github.io/ads-responsive-login-page/)"; flow:established,to_server; http.uri; content:"/ads-responsive-login-page/"; startswith; fast_pattern; http.host; content:"crisouzath.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016372; classtype:social-engineering; sid:6016372; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zsyrtcmke.love/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zsyrtcmke.love"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016373; classtype:social-engineering; sid:6016373; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nuvector.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nuvector.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016374; classtype:social-engineering; sid:6016374; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (home-sso-itrust--capital-com-auths.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"home-sso-itrust--capital-com-auths.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016375; classtype:social-engineering; sid:6016375; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (supersaverdining.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"supersaverdining.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016376; classtype:social-engineering; sid:6016376; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portalcreditodigital.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"portalcreditodigital.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016377; classtype:social-engineering; sid:6016377; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (skjsayeyd.love/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"skjsayeyd.love"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016378; classtype:social-engineering; sid:6016378; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xbt8x82irz1kbcyq.hgsa227.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xbt8x82irz1kbcyq.hgsa227.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016379; classtype:social-engineering; sid:6016379; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toplukonutbazg.vercel.app/giris.php)"; flow:established,to_server; http.uri; content:"/giris.php"; startswith; fast_pattern; http.host; content:"toplukonutbazg.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016380; classtype:social-engineering; sid:6016380; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xusdtmcdra.love/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xusdtmcdra.love"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016381; classtype:social-engineering; sid:6016381; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portal-ndax--cdn-xm-auth.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"portal-ndax--cdn-xm-auth.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016382; classtype:social-engineering; sid:6016382; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ziadanish2025.github.io/Login-to-facebook/)"; flow:established,to_server; http.uri; content:"/Login-to-facebook/"; startswith; fast_pattern; http.host; content:"ziadanish2025.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016383; classtype:social-engineering; sid:6016383; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jdshduyw.love/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jdshduyw.love"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016384; classtype:social-engineering; sid:6016384; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ambill-bantuan-danaa-gr4tiis.vhh.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ambill-bantuan-danaa-gr4tiis.vhh.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016385; classtype:social-engineering; sid:6016385; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acessonext.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"acessonext.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016386; classtype:social-engineering; sid:6016386; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (68-210-100-36.cprapid.com/de/kasse.php)"; flow:established,to_server; http.uri; content:"/de/kasse.php"; startswith; fast_pattern; http.host; content:"68-210-100-36.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016387; classtype:social-engineering; sid:6016387; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (upputurimadhuri897-hue.github.io/ui-/)"; flow:established,to_server; http.uri; content:"/ui-/"; startswith; fast_pattern; http.host; content:"upputurimadhuri897-hue.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016388; classtype:social-engineering; sid:6016388; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (controlled-harlequin-cx5tepts.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"controlled-harlequin-cx5tepts.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016389; classtype:social-engineering; sid:6016389; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (attractive-research-275363.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"attractive-research-275363.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016390; classtype:social-engineering; sid:6016390; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (servicios-unitec-validacion--pinotop21.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"servicios-unitec-validacion--pinotop21.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016391; classtype:social-engineering; sid:6016391; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ufqtp.an1zf.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"ufqtp.an1zf.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016392; classtype:social-engineering; sid:6016392; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastnet-10911550.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastnet-10911550.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016393; classtype:social-engineering; sid:6016393; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nuvisionx.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nuvisionx.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016394; classtype:social-engineering; sid:6016394; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clientelink.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"clientelink.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016395; classtype:social-engineering; sid:6016395; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (data-app-whatapp.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"data-app-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016396; classtype:social-engineering; sid:6016396; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acessopoint.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"acessopoint.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016397; classtype:social-engineering; sid:6016397; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portalservicosplus.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"portalservicosplus.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016398; classtype:social-engineering; sid:6016398; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.keisti.com/lt/)"; flow:established,to_server; http.uri; content:"/lt/"; startswith; fast_pattern; http.host; content:"dpd.keisti.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016399; classtype:social-engineering; sid:6016399; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lanobleza.com.ar/admin/5050/)"; flow:established,to_server; http.uri; content:"/admin/5050/"; startswith; fast_pattern; http.host; content:"lanobleza.com.ar"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016400; classtype:social-engineering; sid:6016400; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (587betjogos.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"587betjogos.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016401; classtype:social-engineering; sid:6016401; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (so-to--trustcapital---top-com--auth.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"so-to--trustcapital---top-com--auth.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016402; classtype:social-engineering; sid:6016402; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (unicredit-bank.info/bh/)"; flow:established,to_server; http.uri; content:"/bh/"; startswith; fast_pattern; http.host; content:"unicredit-bank.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016403; classtype:social-engineering; sid:6016403; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blog-y124235.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"blog-y124235.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016404; classtype:social-engineering; sid:6016404; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (connexion-ar24.nmuser.fr/mslce/)"; flow:established,to_server; http.uri; content:"/mslce/"; startswith; fast_pattern; http.host; content:"connexion-ar24.nmuser.fr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016405; classtype:social-engineering; sid:6016405; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (piumbtaw.love/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"piumbtaw.love"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016406; classtype:social-engineering; sid:6016406; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.keisti.im/lt/)"; flow:established,to_server; http.uri; content:"/lt/"; startswith; fast_pattern; http.host; content:"dpd.keisti.im"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016407; classtype:social-engineering; sid:6016407; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-com-stariit.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-com-stariit.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016408; classtype:social-engineering; sid:6016408; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (glovent.vu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"glovent.vu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016409; classtype:social-engineering; sid:6016409; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (customerc0mcastweb.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"customerc0mcastweb.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016410; classtype:social-engineering; sid:6016410; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sajid-wani-71.github.io/FB-clone)"; flow:established,to_server; http.uri; content:"/FB-clone"; startswith; fast_pattern; http.host; content:"sajid-wani-71.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016411; classtype:social-engineering; sid:6016411; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (getbridge-en.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"getbridge-en.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016412; classtype:social-engineering; sid:6016412; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.001game-hh.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.001game-hh.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016413; classtype:social-engineering; sid:6016413; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rctsbetaw.love/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rctsbetaw.love"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016414; classtype:social-engineering; sid:6016414; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xijbdgecr.love/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xijbdgecr.love"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016415; classtype:social-engineering; sid:6016415; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nuviahub.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nuviahub.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016416; classtype:social-engineering; sid:6016416; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (laiwnndye.love/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"laiwnndye.love"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016417; classtype:social-engineering; sid:6016417; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cs958691.tw1.ru/DSSDS/pages/region.php?lca)"; flow:established,to_server; http.uri; content:"/DSSDS/pages/region.php?lca"; startswith; fast_pattern; http.host; content:"cs958691.tw1.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016418; classtype:social-engineering; sid:6016418; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ws.page-instant-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ws.page-instant-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016419; classtype:social-engineering; sid:6016419; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hjxp.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hjxp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016420; classtype:social-engineering; sid:6016420; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enus-trez-bridge.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"enus-trez-bridge.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016421; classtype:social-engineering; sid:6016421; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsaepp.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsaepp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016422; classtype:social-engineering; sid:6016422; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (psufuyvaw.love/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"psufuyvaw.love"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016423; classtype:social-engineering; sid:6016423; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flsiuety.love/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"flsiuety.love"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016424; classtype:social-engineering; sid:6016424; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebookloginpage2.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebookloginpage2.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016425; classtype:social-engineering; sid:6016425; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebookloginaccount.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebookloginaccount.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016426; classtype:social-engineering; sid:6016426; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kiufusete.love/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kiufusete.love"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016427; classtype:social-engineering; sid:6016427; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (supersaverdining.com/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380/)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380/"; startswith; fast_pattern; http.host; content:"supersaverdining.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016428; classtype:social-engineering; sid:6016428; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iyrustcapytellogin.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"iyrustcapytellogin.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016429; classtype:social-engineering; sid:6016429; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pmrravwg.love/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pmrravwg.love"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016430; classtype:social-engineering; sid:6016430; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rrpcm.an1zf.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"rrpcm.an1zf.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016431; classtype:social-engineering; sid:6016431; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (evamostorcejuntosmascomlimitenobolso.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"evamostorcejuntosmascomlimitenobolso.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016432; classtype:social-engineering; sid:6016432; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pmlqd.an1zf.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"pmlqd.an1zf.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016433; classtype:social-engineering; sid:6016433; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clientefocus.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"clientefocus.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016434; classtype:social-engineering; sid:6016434; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth--app-cryptocom-sso---u-cdn.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auth--app-cryptocom-sso---u-cdn.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016435; classtype:social-engineering; sid:6016435; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.robx.me/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.robx.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016436; classtype:social-engineering; sid:6016436; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (731656.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"731656.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016437; classtype:social-engineering; sid:6016437; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.virtualatendimento.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.virtualatendimento.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016438; classtype:social-engineering; sid:6016438; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (centralcreditofacil.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"centralcreditofacil.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016439; classtype:social-engineering; sid:6016439; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (priorityqueue.b-cdn.net/A.html?eta=kalorpro@d41cceda426717eafbbf7323f793ddd37504.com)"; flow:established,to_server; http.uri; content:"/A.html?eta=kalorpro@d41cceda426717eafbbf7323f793ddd37504.com"; startswith; fast_pattern; http.host; content:"priorityqueue.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016440; classtype:social-engineering; sid:6016440; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flatsome.hsdtit.com/id-review-page/login/)"; flow:established,to_server; http.uri; content:"/id-review-page/login/"; startswith; fast_pattern; http.host; content:"flatsome.hsdtit.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016441; classtype:social-engineering; sid:6016441; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fh8518.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fh8518.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016442; classtype:social-engineering; sid:6016442; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imjoe77.github.io/Netflix-UI-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-UI-Clone/"; startswith; fast_pattern; http.host; content:"imjoe77.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016443; classtype:social-engineering; sid:6016443; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j105l.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j105l.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016444; classtype:social-engineering; sid:6016444; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a1.8uzq.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"a1.8uzq.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016445; classtype:social-engineering; sid:6016445; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nachocebu.hostel.town/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nachocebu.hostel.town"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016446; classtype:social-engineering; sid:6016446; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mariya9980.github.io/Netflix/)"; flow:established,to_server; http.uri; content:"/Netflix/"; startswith; fast_pattern; http.host; content:"mariya9980.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016447; classtype:social-engineering; sid:6016447; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalgestaofacil.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalgestaofacil.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016448; classtype:social-engineering; sid:6016448; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ydufwyaxe.love/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ydufwyaxe.love"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016449; classtype:social-engineering; sid:6016449; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (au4u.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"au4u.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016450; classtype:social-engineering; sid:6016450; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portalfocus.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"portalfocus.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016451; classtype:social-engineering; sid:6016451; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebooklogin-page.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebooklogin-page.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016452; classtype:social-engineering; sid:6016452; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (problematic-business.meta-helps.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"problematic-business.meta-helps.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016453; classtype:social-engineering; sid:6016453; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralvision.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralvision.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016454; classtype:social-engineering; sid:6016454; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (signalhub764-veya.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"signalhub764-veya.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016455; classtype:social-engineering; sid:6016455; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (access-divace-bridge.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"access-divace-bridge.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016456; classtype:social-engineering; sid:6016456; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yasyciuste.love/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yasyciuste.love"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016457; classtype:social-engineering; sid:6016457; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xzwcr.an1zf.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"xzwcr.an1zf.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016458; classtype:social-engineering; sid:6016458; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1fellype.github.io/Facebook-login)"; flow:established,to_server; http.uri; content:"/Facebook-login"; startswith; fast_pattern; http.host; content:"1fellype.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016459; classtype:social-engineering; sid:6016459; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ndax-en-io-cdn-auth.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ndax-en-io-cdn-auth.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016460; classtype:social-engineering; sid:6016460; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-trezoor-en-learn-login.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sso-trezoor-en-learn-login.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016461; classtype:social-engineering; sid:6016461; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rational-experiences-382422.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rational-experiences-382422.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016462; classtype:social-engineering; sid:6016462; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acessofocus.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"acessofocus.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016463; classtype:social-engineering; sid:6016463; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portalgestaopro.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"portalgestaopro.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016464; classtype:social-engineering; sid:6016464; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j101o.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j101o.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016465; classtype:social-engineering; sid:6016465; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uyfbbnstet.love/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uyfbbnstet.love"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016466; classtype:social-engineering; sid:6016466; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tbckduurs.love/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tbckduurs.love"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016467; classtype:social-engineering; sid:6016467; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kkuucooinlogiin.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kkuucooinlogiin.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016468; classtype:social-engineering; sid:6016468; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezor-login-us-start.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezor-login-us-start.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016469; classtype:social-engineering; sid:6016469; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (started-trezerio.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"started-trezerio.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016470; classtype:social-engineering; sid:6016470; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gova.pics/1.html)"; flow:established,to_server; http.uri; content:"/1.html"; startswith; fast_pattern; http.host; content:"www.gova.pics"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016471; classtype:social-engineering; sid:6016471; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (001winbaixar.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"001winbaixar.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016472; classtype:social-engineering; sid:6016472; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portalcreditomais.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"portalcreditomais.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016473; classtype:social-engineering; sid:6016473; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (minahil-webdev.github.io/facebook-login-clone/)"; flow:established,to_server; http.uri; content:"/facebook-login-clone/"; startswith; fast_pattern; http.host; content:"minahil-webdev.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016474; classtype:social-engineering; sid:6016474; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (si.team-al.com/p/fhtb-mrgw/nwjrmgwv/)"; flow:established,to_server; http.uri; content:"/p/fhtb-mrgw/nwjrmgwv/"; startswith; fast_pattern; http.host; content:"si.team-al.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016475; classtype:social-engineering; sid:6016475; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toplukonutbaby.vercel.app/giris.php)"; flow:established,to_server; http.uri; content:"/giris.php"; startswith; fast_pattern; http.host; content:"toplukonutbaby.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016476; classtype:social-engineering; sid:6016476; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (doubleksout.com/home/applok/in.php)"; flow:established,to_server; http.uri; content:"/home/applok/in.php"; startswith; fast_pattern; http.host; content:"doubleksout.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016477; classtype:social-engineering; sid:6016477; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shirosan313.github.io/FacebookFake/index.html)"; flow:established,to_server; http.uri; content:"/FacebookFake/index.html"; startswith; fast_pattern; http.host; content:"shirosan313.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016478; classtype:social-engineering; sid:6016478; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (daveridasx.fwh.is/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"daveridasx.fwh.is"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016479; classtype:social-engineering; sid:6016479; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (18143.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"18143.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016480; classtype:social-engineering; sid:6016480; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sayes-weddings.de/home)"; flow:established,to_server; http.uri; content:"/home"; startswith; fast_pattern; http.host; content:"sayes-weddings.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016481; classtype:social-engineering; sid:6016481; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en-bridge-trezor.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"en-bridge-trezor.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016482; classtype:social-engineering; sid:6016482; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3dstudiobd.com/wp-sha/tt-consulting.html)"; flow:established,to_server; http.uri; content:"/wp-sha/tt-consulting.html"; startswith; fast_pattern; http.host; content:"3dstudiobd.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016483; classtype:social-engineering; sid:6016483; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blekfilogen.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"blekfilogen.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016484; classtype:social-engineering; sid:6016484; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toplukonutbanc.vercel.app/giris.php)"; flow:established,to_server; http.uri; content:"/giris.php"; startswith; fast_pattern; http.host; content:"toplukonutbanc.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016485; classtype:social-engineering; sid:6016485; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lxcosetrs.love/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lxcosetrs.love"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016486; classtype:social-engineering; sid:6016486; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ankurverma26.github.io/netflix-homepage-clone)"; flow:established,to_server; http.uri; content:"/netflix-homepage-clone"; startswith; fast_pattern; http.host; content:"ankurverma26.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016487; classtype:social-engineering; sid:6016487; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (areavision.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"areavision.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016488; classtype:social-engineering; sid:6016488; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.169tyesy.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.169tyesy.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016489; classtype:social-engineering; sid:6016489; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (theccguydelivery464.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"theccguydelivery464.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016490; classtype:social-engineering; sid:6016490; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apple-verification.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"apple-verification.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016491; classtype:social-engineering; sid:6016491; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (w.rkzbo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"w.rkzbo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016492; classtype:social-engineering; sid:6016492; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.rbcode.net/v/6ff58f0e456d1bacf1d0ce9bca6cbf56/)"; flow:established,to_server; http.uri; content:"/v/6ff58f0e456d1bacf1d0ce9bca6cbf56/"; startswith; fast_pattern; http.host; content:"www.rbcode.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016493; classtype:social-engineering; sid:6016493; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (logs-smoky-psi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"logs-smoky-psi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016494; classtype:social-engineering; sid:6016494; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shivi-prajapati.github.io/facebook/index.html)"; flow:established,to_server; http.uri; content:"/facebook/index.html"; startswith; fast_pattern; http.host; content:"shivi-prajapati.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016495; classtype:social-engineering; sid:6016495; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aymdkese.love/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aymdkese.love"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016496; classtype:social-engineering; sid:6016496; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (akashaaleem7-dotcom.github.io/facebook-login-clone)"; flow:established,to_server; http.uri; content:"/facebook-login-clone"; startswith; fast_pattern; http.host; content:"akashaaleem7-dotcom.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016497; classtype:social-engineering; sid:6016497; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lisudted.love/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lisudted.love"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016498; classtype:social-engineering; sid:6016498; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-login-help.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-login-help.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016499; classtype:social-engineering; sid:6016499; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (postalfrmb07.servicefines.services/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"postalfrmb07.servicefines.services"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016500; classtype:social-engineering; sid:6016500; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gemeinviloging.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gemeinviloging.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016501; classtype:social-engineering; sid:6016501; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth--app--crypto--sso-web--cdn.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auth--app--crypto--sso-web--cdn.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016502; classtype:social-engineering; sid:6016502; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portalconsultafinanceira.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"portalconsultafinanceira.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016503; classtype:social-engineering; sid:6016503; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth--app-crypto-sso-web-cdn-auth.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auth--app-crypto-sso-web-cdn-auth.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016504; classtype:social-engineering; sid:6016504; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (68-210-100-36.cprapid.com/de/update.php?s4c1r0peqi62bec43r82)"; flow:established,to_server; http.uri; content:"/de/update.php?s4c1r0peqi62bec43r82"; startswith; fast_pattern; http.host; content:"68-210-100-36.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016505; classtype:social-engineering; sid:6016505; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebookloginaccount.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebookloginaccount.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016506; classtype:social-engineering; sid:6016506; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maxwss.club/rbx1000)"; flow:established,to_server; http.uri; content:"/rbx1000"; startswith; fast_pattern; http.host; content:"maxwss.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016507; classtype:social-engineering; sid:6016507; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xbt8x82irz1kbcyq.hgsa226.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xbt8x82irz1kbcyq.hgsa226.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016508; classtype:social-engineering; sid:6016508; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yd7888.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yd7888.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016509; classtype:social-engineering; sid:6016509; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pbcgsrwre.love/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pbcgsrwre.love"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016510; classtype:social-engineering; sid:6016510; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (o22x.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"o22x.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016511; classtype:social-engineering; sid:6016511; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gestaoplus.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gestaoplus.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016512; classtype:social-engineering; sid:6016512; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth--app-cryptocom-sso---en-cdn.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auth--app-cryptocom-sso---en-cdn.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016513; classtype:social-engineering; sid:6016513; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nexofinance.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nexofinance.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016514; classtype:social-engineering; sid:6016514; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (helenamamede05-prog.github.io/Projeto-Facebook-Login)"; flow:established,to_server; http.uri; content:"/Projeto-Facebook-Login"; startswith; fast_pattern; http.host; content:"helenamamede05-prog.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016515; classtype:social-engineering; sid:6016515; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ashutoshhospital.com/af02/)"; flow:established,to_server; http.uri; content:"/af02/"; startswith; fast_pattern; http.host; content:"ashutoshhospital.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016516; classtype:social-engineering; sid:6016516; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xuaywttsa.love/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xuaywttsa.love"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016517; classtype:social-engineering; sid:6016517; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.70000ylg.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.70000ylg.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016518; classtype:social-engineering; sid:6016518; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hauwtcbe.love/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hauwtcbe.love"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016519; classtype:social-engineering; sid:6016519; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (workshop-designer.shop/appdata/catalog/)"; flow:established,to_server; http.uri; content:"/appdata/catalog/"; startswith; fast_pattern; http.host; content:"workshop-designer.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016520; classtype:social-engineering; sid:6016520; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yxjackiczspdpbo.hnister.info/leds/)"; flow:established,to_server; http.uri; content:"/leds/"; startswith; fast_pattern; http.host; content:"yxjackiczspdpbo.hnister.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016521; classtype:social-engineering; sid:6016521; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (morava21323.github.io/Facebook-Login)"; flow:established,to_server; http.uri; content:"/Facebook-Login"; startswith; fast_pattern; http.host; content:"morava21323.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016522; classtype:social-engineering; sid:6016522; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zocuyuefgd.love/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zocuyuefgd.love"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016523; classtype:social-engineering; sid:6016523; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (geominilogine.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"geominilogine.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016524; classtype:social-engineering; sid:6016524; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nuespaco.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nuespaco.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016525; classtype:social-engineering; sid:6016525; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eco.latossa.pro/auth/19790724cc715a38d1eaf489235bf029/)"; flow:established,to_server; http.uri; content:"/auth/19790724cc715a38d1eaf489235bf029/"; startswith; fast_pattern; http.host; content:"eco.latossa.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016526; classtype:social-engineering; sid:6016526; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (impulsoderesultados.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"impulsoderesultados.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016527; classtype:social-engineering; sid:6016527; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-ndax-lginapp-cdn.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sso-ndax-lginapp-cdn.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016528; classtype:social-engineering; sid:6016528; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (40winta.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"40winta.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016529; classtype:social-engineering; sid:6016529; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mainpage987451.bolt.host/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mainpage987451.bolt.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016530; classtype:social-engineering; sid:6016530; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paypalus.qzz.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paypalus.qzz.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016531; classtype:social-engineering; sid:6016531; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-login-page-three.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-login-page-three.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016532; classtype:social-engineering; sid:6016532; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f36v.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f36v.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016533; classtype:social-engineering; sid:6016533; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aceleramais.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aceleramais.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016534; classtype:social-engineering; sid:6016534; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nuaxis.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nuaxis.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016535; classtype:social-engineering; sid:6016535; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hubfinance.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hubfinance.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016536; classtype:social-engineering; sid:6016536; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (migueltrilho24-hub.github.io/Projeto-13/)"; flow:established,to_server; http.uri; content:"/Projeto-13/"; startswith; fast_pattern; http.host; content:"migueltrilho24-hub.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016537; classtype:social-engineering; sid:6016537; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (visib.link/uHFIa0B)"; flow:established,to_server; http.uri; content:"/uHFIa0B"; startswith; fast_pattern; http.host; content:"visib.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016538; classtype:social-engineering; sid:6016538; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ajify.com/wp-hosted/hosted.html#CnJhbmRvbUByYW5kb20uY29t)"; flow:established,to_server; http.uri; content:"/wp-hosted/hosted.html#CnJhbmRvbUByYW5kb20uY29t"; startswith; fast_pattern; http.host; content:"ajify.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016539; classtype:social-engineering; sid:6016539; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hmuev-eibon-orblon.s3.us-east-1.amazonaws.com/iiion11and.html?cms=redacted@abuse.ionos.com)"; flow:established,to_server; http.uri; content:"/iiion11and.html?cms=redacted@abuse.ionos.com"; startswith; fast_pattern; http.host; content:"hmuev-eibon-orblon.s3.us-east-1.amazonaws.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016540; classtype:social-engineering; sid:6016540; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zhifeiji.hk.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zhifeiji.hk.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016541; classtype:social-engineering; sid:6016541; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (htysytvd.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"htysytvd.biz.id"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016542; classtype:social-engineering; sid:6016542; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (siaw.eu.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"siaw.eu.cc"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016543; classtype:social-engineering; sid:6016543; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (httzsx.eu.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"httzsx.eu.cc"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016544; classtype:social-engineering; sid:6016544; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gauteya.eu.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gauteya.eu.cc"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016545; classtype:social-engineering; sid:6016545; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shop10-delta.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shop10-delta.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016546; classtype:social-engineering; sid:6016546; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xoqu.eu.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xoqu.eu.cc"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016547; classtype:social-engineering; sid:6016547; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xteue.eu.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xteue.eu.cc"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016548; classtype:social-engineering; sid:6016548; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tayzcur.eu.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tayzcur.eu.cc"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016549; classtype:social-engineering; sid:6016549; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xoeyu.eu.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xoeyu.eu.cc"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016550; classtype:social-engineering; sid:6016550; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telegram.zj.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"telegram.zj.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016551; classtype:social-engineering; sid:6016551; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adreses.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"adreses.vip"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016552; classtype:social-engineering; sid:6016552; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (madame-tussauds---museum-dubai.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"madame-tussauds---museum-dubai.webflow.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016553; classtype:social-engineering; sid:6016553; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ghre.eu.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ghre.eu.cc"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016554; classtype:social-engineering; sid:6016554; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (taayt.eu.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"taayt.eu.cc"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016555; classtype:social-engineering; sid:6016555; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (guiaemfoco.com.br/xinfinifix/xinfini/)"; flow:established,to_server; http.uri; content:"/xinfinifix/xinfini/"; startswith; fast_pattern; http.host; content:"guiaemfoco.com.br"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016556; classtype:social-engineering; sid:6016556; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (w78as.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"w78as.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016557; classtype:social-engineering; sid:6016557; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ijhpx.an1zf.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"ijhpx.an1zf.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016558; classtype:social-engineering; sid:6016558; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwwmaxls.xyz/my)"; flow:established,to_server; http.uri; content:"/my"; startswith; fast_pattern; http.host; content:"wwwmaxls.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016559; classtype:social-engineering; sid:6016559; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.signalhub764-veya.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.signalhub764-veya.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016560; classtype:social-engineering; sid:6016560; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shubhamyadavvvv.github.io/-netflix-clone/)"; flow:established,to_server; http.uri; content:"/-netflix-clone/"; startswith; fast_pattern; http.host; content:"shubhamyadavvvv.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016561; classtype:social-engineering; sid:6016561; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fwfnctwtylozrle.dhisoaps.info/leds/)"; flow:established,to_server; http.uri; content:"/leds/"; startswith; fast_pattern; http.host; content:"fwfnctwtylozrle.dhisoaps.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016562; classtype:social-engineering; sid:6016562; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.js89908.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.js89908.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016563; classtype:social-engineering; sid:6016563; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (learn-bridge-trez-en.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"learn-bridge-trez-en.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016564; classtype:social-engineering; sid:6016564; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (255tw.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"255tw.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016565; classtype:social-engineering; sid:6016565; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.18061.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.18061.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016566; classtype:social-engineering; sid:6016566; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xpressprolabs.com/rtktt)"; flow:established,to_server; http.uri; content:"/rtktt"; startswith; fast_pattern; http.host; content:"xpressprolabs.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016567; classtype:social-engineering; sid:6016567; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sainikkr.github.io/demo/)"; flow:established,to_server; http.uri; content:"/demo/"; startswith; fast_pattern; http.host; content:"sainikkr.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016568; classtype:social-engineering; sid:6016568; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pembatalan-dana-id-paylater.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pembatalan-dana-id-paylater.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016569; classtype:social-engineering; sid:6016569; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (undian-resmi312.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"undian-resmi312.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016570; classtype:social-engineering; sid:6016570; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bx4395.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bx4395.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016571; classtype:social-engineering; sid:6016571; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.simplepathwellness.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.simplepathwellness.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016572; classtype:social-engineering; sid:6016572; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nhncontents-share.cafe/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nhncontents-share.cafe"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016573; classtype:social-engineering; sid:6016573; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vozxh.an1zf.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"vozxh.an1zf.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016574; classtype:social-engineering; sid:6016574; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (warnex-qulto-8ac913-hfbb.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"warnex-qulto-8ac913-hfbb.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016575; classtype:social-engineering; sid:6016575; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwwnnaxlsmcommy.xyz/4g/home.html)"; flow:established,to_server; http.uri; content:"/4g/home.html"; startswith; fast_pattern; http.host; content:"wwwnnaxlsmcommy.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016576; classtype:social-engineering; sid:6016576; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (taiktaikvn.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"taiktaikvn.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016577; classtype:social-engineering; sid:6016577; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ehedev.github.io/Netflix)"; flow:established,to_server; http.uri; content:"/Netflix"; startswith; fast_pattern; http.host; content:"ehedev.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016578; classtype:social-engineering; sid:6016578; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.uber-beta-ten.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.uber-beta-ten.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016579; classtype:social-engineering; sid:6016579; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagramrnumberbillingupdatedatepainstagrampemulihan.129-121-117-207.cpanel.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagramrnumberbillingupdatedatepainstagrampemulihan.129-121-117-207.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016580; classtype:social-engineering; sid:6016580; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeeid239.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopeeid239.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016581; classtype:social-engineering; sid:6016581; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trzor-io-strt-cloud.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trzor-io-strt-cloud.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016582; classtype:social-engineering; sid:6016582; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ljvkm.an1zf.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"ljvkm.an1zf.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016583; classtype:social-engineering; sid:6016583; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bz8vn.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bz8vn.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016584; classtype:social-engineering; sid:6016584; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (18815.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"18815.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016585; classtype:social-engineering; sid:6016585; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eoog.keyplusys.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eoog.keyplusys.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016586; classtype:social-engineering; sid:6016586; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.9500yh.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.9500yh.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016587; classtype:social-engineering; sid:6016587; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (majestic-ellialawson.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"majestic-ellialawson.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016588; classtype:social-engineering; sid:6016588; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bet4740.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bet4740.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016589; classtype:social-engineering; sid:6016589; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagarm-follow.github.io/login/)"; flow:established,to_server; http.uri; content:"/login/"; startswith; fast_pattern; http.host; content:"instagarm-follow.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016590; classtype:social-engineering; sid:6016590; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iahjf.an1zf.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"iahjf.an1zf.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016591; classtype:social-engineering; sid:6016591; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (danaanew-indoonesia.lifesstylenew.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"danaanew-indoonesia.lifesstylenew.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016592; classtype:social-engineering; sid:6016592; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hr.goolge-secure.com/yearenddocuments?rid=qXdhAmn)"; flow:established,to_server; http.uri; content:"/yearenddocuments?rid=qXdhAmn"; startswith; fast_pattern; http.host; content:"hr.goolge-secure.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016593; classtype:social-engineering; sid:6016593; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mainbri-dge.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mainbri-dge.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016594; classtype:social-engineering; sid:6016594; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vapedragonsquad.co.za/ztorlxx/ploo/AdobePdf.html)"; flow:established,to_server; http.uri; content:"/ztorlxx/ploo/AdobePdf.html"; startswith; fast_pattern; http.host; content:"vapedragonsquad.co.za"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016595; classtype:social-engineering; sid:6016595; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.instagramrnumberbillingupdatedatepainstagrampemulihan.129-121-117-207.cpanel.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mail.instagramrnumberbillingupdatedatepainstagrampemulihan.129-121-117-207.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016596; classtype:social-engineering; sid:6016596; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uplo-adtrzrsuit.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uplo-adtrzrsuit.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016597; classtype:social-engineering; sid:6016597; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brannahome.com.tr/dosini/au/auth/login.php)"; flow:established,to_server; http.uri; content:"/dosini/au/auth/login.php"; startswith; fast_pattern; http.host; content:"brannahome.com.tr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016598; classtype:social-engineering; sid:6016598; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (el-finances.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"el-finances.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016599; classtype:social-engineering; sid:6016599; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.18811.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.18811.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016600; classtype:social-engineering; sid:6016600; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tapiocaexpress.com/wp-content/cache/mail)"; flow:established,to_server; http.uri; content:"/wp-content/cache/mail"; startswith; fast_pattern; http.host; content:"tapiocaexpress.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016601; classtype:social-engineering; sid:6016601; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maxcse.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"maxcse.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016602; classtype:social-engineering; sid:6016602; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sdkxh.an1zf.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"sdkxh.an1zf.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016603; classtype:social-engineering; sid:6016603; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (taxcoder.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"taxcoder.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016604; classtype:social-engineering; sid:6016604; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (18903.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"18903.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016605; classtype:social-engineering; sid:6016605; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uber-project-jade.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uber-project-jade.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016606; classtype:social-engineering; sid:6016606; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (botproc827-fuat.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"botproc827-fuat.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016607; classtype:social-engineering; sid:6016607; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-static-page--clarewemyss.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-static-page--clarewemyss.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016608; classtype:social-engineering; sid:6016608; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kuccoin.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kuccoin.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016609; classtype:social-engineering; sid:6016609; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ndaxx-official.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ndaxx-official.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016610; classtype:social-engineering; sid:6016610; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (norvutela-biz-prenqutami-p5t4db62.pages.dev/tgb-yhn-ujm-ikl?welcome=1733999606847330&stt=1733999606847330&name_stt=Storm%20Guard%20Roofing%20of%20Ches-Mont)"; flow:established,to_server; http.uri; content:"/tgb-yhn-ujm-ikl?welcome=1733999606847330&stt=1733999606847330&name_stt=Storm%20Guard%20Roofing%20of%20Ches-Mont"; startswith; fast_pattern; http.host; content:"norvutela-biz-prenqutami-p5t4db62.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016611; classtype:social-engineering; sid:6016611; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (18916.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"18916.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016612; classtype:social-engineering; sid:6016612; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwwmaxls.my/5g/home.html)"; flow:established,to_server; http.uri; content:"/5g/home.html"; startswith; fast_pattern; http.host; content:"wwwmaxls.my"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016613; classtype:social-engineering; sid:6016613; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (actualizacion-1938--confirmacion365.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"actualizacion-1938--confirmacion365.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016614; classtype:social-engineering; sid:6016614; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trdgr-suat-app-en.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trdgr-suat-app-en.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016615; classtype:social-engineering; sid:6016615; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (etqcz.an1zf.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"etqcz.an1zf.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016616; classtype:social-engineering; sid:6016616; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (18813.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"18813.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016617; classtype:social-engineering; sid:6016617; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maycccxmsukmxc.uk.cc/my)"; flow:established,to_server; http.uri; content:"/my"; startswith; fast_pattern; http.host; content:"maycccxmsukmxc.uk.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016618; classtype:social-engineering; sid:6016618; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imsites-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"imsites-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016619; classtype:social-engineering; sid:6016619; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nuguia.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nuguia.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016620; classtype:social-engineering; sid:6016620; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (18915.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"18915.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016621; classtype:social-engineering; sid:6016621; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwwmamycymukk984576974573495.top/4g/home.html)"; flow:established,to_server; http.uri; content:"/4g/home.html"; startswith; fast_pattern; http.host; content:"wwwmamycymukk984576974573495.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016622; classtype:social-engineering; sid:6016622; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fabianipirio-plomberie-chauffage.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fabianipirio-plomberie-chauffage.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016623; classtype:social-engineering; sid:6016623; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meluxuryrentals.com/run/?naps)"; flow:established,to_server; http.uri; content:"/run/?naps"; startswith; fast_pattern; http.host; content:"meluxuryrentals.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016624; classtype:social-engineering; sid:6016624; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lucky-wildflower-07c9.nxejlitcfnfdlkl.workers.dev/facebook.com-1027275509)"; flow:established,to_server; http.uri; content:"/facebook.com-1027275509"; startswith; fast_pattern; http.host; content:"lucky-wildflower-07c9.nxejlitcfnfdlkl.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016625; classtype:social-engineering; sid:6016625; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwwmaxmy.top/4g/home.html)"; flow:established,to_server; http.uri; content:"/4g/home.html"; startswith; fast_pattern; http.host; content:"wwwmaxmy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016626; classtype:social-engineering; sid:6016626; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (messenger-clone-zeta-ten.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"messenger-clone-zeta-ten.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016627; classtype:social-engineering; sid:6016627; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (protect.likewize.com/rogers/fr-ca/)"; flow:established,to_server; http.uri; content:"/rogers/fr-ca/"; startswith; fast_pattern; http.host; content:"protect.likewize.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016628; classtype:social-engineering; sid:6016628; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.18930.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.18930.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016629; classtype:social-engineering; sid:6016629; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16769.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16769.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016630; classtype:social-engineering; sid:6016630; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwwmaxes.cam/4g/home.html)"; flow:established,to_server; http.uri; content:"/4g/home.html"; startswith; fast_pattern; http.host; content:"wwwmaxes.cam"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016631; classtype:social-engineering; sid:6016631; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16780.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16780.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016632; classtype:social-engineering; sid:6016632; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (18909.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"18909.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016633; classtype:social-engineering; sid:6016633; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wap.simplepathwellness.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wap.simplepathwellness.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016634; classtype:social-engineering; sid:6016634; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bet5811.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bet5811.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016635; classtype:social-engineering; sid:6016635; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.18809.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.18809.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016636; classtype:social-engineering; sid:6016636; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (legit957-wq.github.io/gmail-login/)"; flow:established,to_server; http.uri; content:"/gmail-login/"; startswith; fast_pattern; http.host; content:"legit957-wq.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016637; classtype:social-engineering; sid:6016637; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8x2e.co/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8x2e.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016638; classtype:social-engineering; sid:6016638; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rss.sayler.at/go/13c413/y274x274/)"; flow:established,to_server; http.uri; content:"/go/13c413/y274x274/"; startswith; fast_pattern; http.host; content:"rss.sayler.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016639; classtype:social-engineering; sid:6016639; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.18806.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.18806.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016640; classtype:social-engineering; sid:6016640; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (arnavvvyyy.github.io/netflix-project/)"; flow:established,to_server; http.uri; content:"/netflix-project/"; startswith; fast_pattern; http.host; content:"arnavvvyyy.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016641; classtype:social-engineering; sid:6016641; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi283.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"info-resmi283.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016642; classtype:social-engineering; sid:6016642; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icqto.an1zf.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"icqto.an1zf.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016643; classtype:social-engineering; sid:6016643; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.18818.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.18818.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016644; classtype:social-engineering; sid:6016644; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.projecturbex.eu/wp-includes/pnp/bv.html)"; flow:established,to_server; http.uri; content:"/wp-includes/pnp/bv.html"; startswith; fast_pattern; http.host; content:"www.projecturbex.eu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016645; classtype:social-engineering; sid:6016645; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (erytu.an1zf.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"erytu.an1zf.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016646; classtype:social-engineering; sid:6016646; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.taxcoder.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.taxcoder.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016647; classtype:social-engineering; sid:6016647; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zoea-agbxagb0ddbscfh7.z03.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zoea-agbxagb0ddbscfh7.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016648; classtype:social-engineering; sid:6016648; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (useasoffer.com/docusign/Mac/utility.php)"; flow:established,to_server; http.uri; content:"/docusign/Mac/utility.php"; startswith; fast_pattern; http.host; content:"useasoffer.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016649; classtype:social-engineering; sid:6016649; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kokvip2.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kokvip2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016650; classtype:social-engineering; sid:6016650; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (evitarcierreanahuacmxx.kesug.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"evitarcierreanahuacmxx.kesug.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016651; classtype:social-engineering; sid:6016651; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (asb-warn.icu/co.nz)"; flow:established,to_server; http.uri; content:"/co.nz"; startswith; fast_pattern; http.host; content:"asb-warn.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016652; classtype:social-engineering; sid:6016652; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (drty.poegvd.org/css)"; flow:established,to_server; http.uri; content:"/css"; startswith; fast_pattern; http.host; content:"drty.poegvd.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016653; classtype:social-engineering; sid:6016653; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lyygrdqsmofzrjh.thismxaps.info/leds/)"; flow:established,to_server; http.uri; content:"/leds/"; startswith; fast_pattern; http.host; content:"lyygrdqsmofzrjh.thismxaps.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016654; classtype:social-engineering; sid:6016654; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.y90f.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.y90f.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016655; classtype:social-engineering; sid:6016655; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16784.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16784.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016656; classtype:social-engineering; sid:6016656; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xxodas-app-io.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xxodas-app-io.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016657; classtype:social-engineering; sid:6016657; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.coderr-steel.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.coderr-steel.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016658; classtype:social-engineering; sid:6016658; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (linkthework.com/5abd/)"; flow:established,to_server; http.uri; content:"/5abd/"; startswith; fast_pattern; http.host; content:"linkthework.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016659; classtype:social-engineering; sid:6016659; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webchat.imsites-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webchat.imsites-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016660; classtype:social-engineering; sid:6016660; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.18923.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.18923.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016661; classtype:social-engineering; sid:6016661; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.evitarcierreanahuacmxx.kesug.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.evitarcierreanahuacmxx.kesug.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016662; classtype:social-engineering; sid:6016662; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (horizontrade.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"horizontrade.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016663; classtype:social-engineering; sid:6016663; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (105633333.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"105633333.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016664; classtype:social-engineering; sid:6016664; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faq-leger-en.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"faq-leger-en.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016665; classtype:social-engineering; sid:6016665; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lowridgeatlas.xyz/s6994-ycp87qk)"; flow:established,to_server; http.uri; content:"/s6994-ycp87qk"; startswith; fast_pattern; http.host; content:"lowridgeatlas.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016666; classtype:social-engineering; sid:6016666; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (18817.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"18817.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016667; classtype:social-engineering; sid:6016667; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.18908.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.18908.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016668; classtype:social-engineering; sid:6016668; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wollohthgiliwt.quest/s6992-qkg90lv)"; flow:established,to_server; http.uri; content:"/s6992-qkg90lv"; startswith; fast_pattern; http.host; content:"wollohthgiliwt.quest"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016669; classtype:social-engineering; sid:6016669; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (perdison.de/Kundenservice-Deutschland1/index.php)"; flow:established,to_server; http.uri; content:"/Kundenservice-Deutschland1/index.php"; startswith; fast_pattern; http.host; content:"perdison.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016670; classtype:social-engineering; sid:6016670; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (18819.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"18819.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016671; classtype:social-engineering; sid:6016671; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-login-clone-delta.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-login-clone-delta.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016672; classtype:social-engineering; sid:6016672; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bet09ja.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bet09ja.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016673; classtype:social-engineering; sid:6016673; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maxlsxm.my/5g/)"; flow:established,to_server; http.uri; content:"/5g/"; startswith; fast_pattern; http.host; content:"maxlsxm.my"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016674; classtype:social-engineering; sid:6016674; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (validationoutlookmsn.zya.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"validationoutlookmsn.zya.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016675; classtype:social-engineering; sid:6016675; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (igit.me/CZPNo)"; flow:established,to_server; http.uri; content:"/CZPNo"; startswith; fast_pattern; http.host; content:"igit.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016676; classtype:social-engineering; sid:6016676; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vgfvf.an1zf.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"vgfvf.an1zf.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016677; classtype:social-engineering; sid:6016677; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pranavyadav123.github.io/Spotify-Clone/)"; flow:established,to_server; http.uri; content:"/Spotify-Clone/"; startswith; fast_pattern; http.host; content:"pranavyadav123.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016678; classtype:social-engineering; sid:6016678; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (caiqz.an1zf.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"caiqz.an1zf.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016679; classtype:social-engineering; sid:6016679; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rcmainsvault-pages.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rcmainsvault-pages.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016680; classtype:social-engineering; sid:6016680; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.uber-project-jade.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.uber-project-jade.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016681; classtype:social-engineering; sid:6016681; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebookloginpage2.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebookloginpage2.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016682; classtype:social-engineering; sid:6016682; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (munihei.meiguobanyou.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"munihei.meiguobanyou.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016683; classtype:social-engineering; sid:6016683; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bxnzhwytdfmkqrwtgdfvczdsxwmchgtfgfynxcdzvswqgbd.rest/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bxnzhwytdfmkqrwtgdfvczdsxwmchgtfgfynxcdzvswqgbd.rest"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016684; classtype:social-engineering; sid:6016684; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.blog-y124235.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.blog-y124235.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016685; classtype:social-engineering; sid:6016685; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (findsupporticloud.click/E8E)"; flow:established,to_server; http.uri; content:"/E8E"; startswith; fast_pattern; http.host; content:"findsupporticloud.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016686; classtype:social-engineering; sid:6016686; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xgaou.an1zf.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"xgaou.an1zf.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016687; classtype:social-engineering; sid:6016687; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.xpj23357.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.xpj23357.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016688; classtype:social-engineering; sid:6016688; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (renewhub-net.com/pages/ban.php)"; flow:established,to_server; http.uri; content:"/pages/ban.php"; startswith; fast_pattern; http.host; content:"renewhub-net.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016689; classtype:social-engineering; sid:6016689; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shivanagouda19.github.io/Spotify-clone-/)"; flow:established,to_server; http.uri; content:"/Spotify-clone-/"; startswith; fast_pattern; http.host; content:"shivanagouda19.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016690; classtype:social-engineering; sid:6016690; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (json-trezor-wallet-frontend.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"json-trezor-wallet-frontend.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016691; classtype:social-engineering; sid:6016691; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (18803.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"18803.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016692; classtype:social-engineering; sid:6016692; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wallet-usd.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wallet-usd.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016693; classtype:social-engineering; sid:6016693; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsaepp.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsaepp.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016694; classtype:social-engineering; sid:6016694; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qzyfg.an1zf.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"qzyfg.an1zf.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016695; classtype:social-engineering; sid:6016695; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maxlsym.xyz/my)"; flow:established,to_server; http.uri; content:"/my"; startswith; fast_pattern; http.host; content:"maxlsym.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016696; classtype:social-engineering; sid:6016696; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.exkucoin.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.exkucoin.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016697; classtype:social-engineering; sid:6016697; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maxlsxm.my/5g/home.html)"; flow:established,to_server; http.uri; content:"/5g/home.html"; startswith; fast_pattern; http.host; content:"maxlsxm.my"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016698; classtype:social-engineering; sid:6016698; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (by3lhwre.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"by3lhwre.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016699; classtype:social-engineering; sid:6016699; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.3ss-top.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.3ss-top.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016700; classtype:social-engineering; sid:6016700; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vhassessoria.com.br/cgi/Korea-Mail.html)"; flow:established,to_server; http.uri; content:"/cgi/Korea-Mail.html"; startswith; fast_pattern; http.host; content:"vhassessoria.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016701; classtype:social-engineering; sid:6016701; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6k7mxd-pxdu7-7gfsl-yois-2uspfd.pages.dev/qaz-wsx-edc-rfv)"; flow:established,to_server; http.uri; content:"/qaz-wsx-edc-rfv"; startswith; fast_pattern; http.host; content:"6k7mxd-pxdu7-7gfsl-yois-2uspfd.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016702; classtype:social-engineering; sid:6016702; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (norakplaygo.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"norakplaygo.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016703; classtype:social-engineering; sid:6016703; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oqowy.an1zf.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"oqowy.an1zf.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016704; classtype:social-engineering; sid:6016704; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jxqsv.an1zf.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"jxqsv.an1zf.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016705; classtype:social-engineering; sid:6016705; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (asip.account-info.email/6197094-oH1faBZb-PKS9Q)"; flow:established,to_server; http.uri; content:"/6197094-oH1faBZb-PKS9Q"; startswith; fast_pattern; http.host; content:"asip.account-info.email"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016706; classtype:social-engineering; sid:6016706; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16764.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16764.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016707; classtype:social-engineering; sid:6016707; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jixi.6a54a.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jixi.6a54a.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016708; classtype:social-engineering; sid:6016708; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.18059.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.18059.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016709; classtype:social-engineering; sid:6016709; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ss777-login.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ss777-login.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016710; classtype:social-engineering; sid:6016710; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsappbutton.ru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsappbutton.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016711; classtype:social-engineering; sid:6016711; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9nbet-pp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9nbet-pp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016712; classtype:social-engineering; sid:6016712; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ip338.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ip338.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016713; classtype:social-engineering; sid:6016713; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uhzcb.an1zf.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"uhzcb.an1zf.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016714; classtype:social-engineering; sid:6016714; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wollohmsirp.fun/s6990-bwd68lh)"; flow:established,to_server; http.uri; content:"/s6990-bwd68lh"; startswith; fast_pattern; http.host; content:"wollohmsirp.fun"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016715; classtype:social-engineering; sid:6016715; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.scartezzini.it/orus_de.html)"; flow:established,to_server; http.uri; content:"/orus_de.html"; startswith; fast_pattern; http.host; content:"www.scartezzini.it"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016716; classtype:social-engineering; sid:6016716; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.educationpolicy-euff.keelingsobotka.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.educationpolicy-euff.keelingsobotka.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016717; classtype:social-engineering; sid:6016717; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hussayn-01.github.io/netflix-clone)"; flow:established,to_server; http.uri; content:"/netflix-clone"; startswith; fast_pattern; http.host; content:"hussayn-01.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016718; classtype:social-engineering; sid:6016718; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allianz-seguros.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allianz-seguros.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016719; classtype:social-engineering; sid:6016719; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spif634.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spif634.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016720; classtype:social-engineering; sid:6016720; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.ie-order.com/shipping)"; flow:established,to_server; http.uri; content:"/shipping"; startswith; fast_pattern; http.host; content:"dpd.ie-order.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016721; classtype:social-engineering; sid:6016721; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.nuonlinevip.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.nuonlinevip.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016722; classtype:social-engineering; sid:6016722; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (w78-top.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"w78-top.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016723; classtype:social-engineering; sid:6016723; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (revoltengineering.co.ke/bar.html)"; flow:established,to_server; http.uri; content:"/bar.html"; startswith; fast_pattern; http.host; content:"revoltengineering.co.ke"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016724; classtype:social-engineering; sid:6016724; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (18914.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"18914.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016725; classtype:social-engineering; sid:6016725; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (naukriinindia.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"naukriinindia.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016726; classtype:social-engineering; sid:6016726; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rzmoa.an1zf.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"rzmoa.an1zf.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016727; classtype:social-engineering; sid:6016727; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (joaojonas.com.br/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"joaojonas.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016728; classtype:social-engineering; sid:6016728; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.18053.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.18053.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016729; classtype:social-engineering; sid:6016729; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gurl.pro/wwwrobloxcom-users-372184612-profile)"; flow:established,to_server; http.uri; content:"/wwwrobloxcom-users-372184612-profile"; startswith; fast_pattern; http.host; content:"gurl.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016730; classtype:social-engineering; sid:6016730; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsaepp.eu.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsaepp.eu.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016731; classtype:social-engineering; sid:6016731; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.18920.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.18920.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016732; classtype:social-engineering; sid:6016732; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (18921.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"18921.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016733; classtype:social-engineering; sid:6016733; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (srv1774178.hstgr.cloud/wp-content/upgrade/kr/login.html)"; flow:established,to_server; http.uri; content:"/wp-content/upgrade/kr/login.html"; startswith; fast_pattern; http.host; content:"srv1774178.hstgr.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016734; classtype:social-engineering; sid:6016734; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atencionalcleinte.com/?r=938244a9-fb82-4c91-a897-10848d9b4c41)"; flow:established,to_server; http.uri; content:"/?r=938244a9-fb82-4c91-a897-10848d9b4c41"; startswith; fast_pattern; http.host; content:"atencionalcleinte.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016735; classtype:social-engineering; sid:6016735; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gsfdfdg.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.gsfdfdg.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016736; classtype:social-engineering; sid:6016736; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j87p.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j87p.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016737; classtype:social-engineering; sid:6016737; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suivi-postch-ag.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"suivi-postch-ag.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016738; classtype:social-engineering; sid:6016738; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roomlivesignalstreaming.github.io/livestreammarketanlysis/)"; flow:established,to_server; http.uri; content:"/livestreammarketanlysis/"; startswith; fast_pattern; http.host; content:"roomlivesignalstreaming.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016739; classtype:social-engineering; sid:6016739; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (piyushkumar754200-hash.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"piyushkumar754200-hash.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016740; classtype:social-engineering; sid:6016740; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (somethingweb-library.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"somethingweb-library.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016741; classtype:social-engineering; sid:6016741; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (city-hupu.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"city-hupu.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016742; classtype:social-engineering; sid:6016742; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j105q.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j105q.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016743; classtype:social-engineering; sid:6016743; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klonex-fursa-a7c109-wplm.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"klonex-fursa-a7c109-wplm.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016744; classtype:social-engineering; sid:6016744; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonlit-halva-504a52docsfilespdfxna.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonlit-halva-504a52docsfilespdfxna.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016745; classtype:social-engineering; sid:6016745; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bv8vn.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bv8vn.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016746; classtype:social-engineering; sid:6016746; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.blh9888.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.blh9888.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016747; classtype:social-engineering; sid:6016747; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vanshgarg355-boop.github.io/NETFLIX-CLONE)"; flow:established,to_server; http.uri; content:"/NETFLIX-CLONE"; startswith; fast_pattern; http.host; content:"vanshgarg355-boop.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016748; classtype:social-engineering; sid:6016748; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coderr-steel.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coderr-steel.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016749; classtype:social-engineering; sid:6016749; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwwmaxls.my/5g/)"; flow:established,to_server; http.uri; content:"/5g/"; startswith; fast_pattern; http.host; content:"wwwmaxls.my"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016750; classtype:social-engineering; sid:6016750; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16774.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16774.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016751; classtype:social-engineering; sid:6016751; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gsfdfdg.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gsfdfdg.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016752; classtype:social-engineering; sid:6016752; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chat-auth-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"chat-auth-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016753; classtype:social-engineering; sid:6016753; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (18041.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"18041.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016754; classtype:social-engineering; sid:6016754; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (18821.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"18821.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016755; classtype:social-engineering; sid:6016755; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j87o.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j87o.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016756; classtype:social-engineering; sid:6016756; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xmqqp.an1zf.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"xmqqp.an1zf.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016757; classtype:social-engineering; sid:6016757; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aaryan-musk.github.io/javascript-amazon-project-main/)"; flow:established,to_server; http.uri; content:"/javascript-amazon-project-main/"; startswith; fast_pattern; http.host; content:"aaryan-musk.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016758; classtype:social-engineering; sid:6016758; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dxcoder.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dxcoder.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016759; classtype:social-engineering; sid:6016759; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (room.homeid3423451564.info/1171092387/)"; flow:established,to_server; http.uri; content:"/1171092387/"; startswith; fast_pattern; http.host; content:"room.homeid3423451564.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016760; classtype:social-engineering; sid:6016760; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3482865.zk622872.web.hosting-test.net/webtransfer/webtransfertoutdomaine/)"; flow:established,to_server; http.uri; content:"/webtransfer/webtransfertoutdomaine/"; startswith; fast_pattern; http.host; content:"3482865.zk622872.web.hosting-test.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016761; classtype:social-engineering; sid:6016761; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vincu-segurozz.fwh.is/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vincu-segurozz.fwh.is"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016762; classtype:social-engineering; sid:6016762; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web.id-lnf0.biz.id/DANAindonesia/)"; flow:established,to_server; http.uri; content:"/DANAindonesia/"; startswith; fast_pattern; http.host; content:"web.id-lnf0.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016763; classtype:social-engineering; sid:6016763; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (subsequent-turquoise-m0nt4nww.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"subsequent-turquoise-m0nt4nww.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016764; classtype:social-engineering; sid:6016764; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (105633000.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"105633000.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016765; classtype:social-engineering; sid:6016765; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ujeyo.an1zf.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"ujeyo.an1zf.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016766; classtype:social-engineering; sid:6016766; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (live-leedgers--en-en.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"live-leedgers--en-en.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016767; classtype:social-engineering; sid:6016767; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (findsupporticloud.click/help?E8E)"; flow:established,to_server; http.uri; content:"/help?E8E"; startswith; fast_pattern; http.host; content:"findsupporticloud.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016768; classtype:social-engineering; sid:6016768; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dc4958ca.giveaway-8y3.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dc4958ca.giveaway-8y3.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016769; classtype:social-engineering; sid:6016769; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (renewhub-net.com/pages/login.php)"; flow:established,to_server; http.uri; content:"/pages/login.php"; startswith; fast_pattern; http.host; content:"renewhub-net.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016770; classtype:social-engineering; sid:6016770; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xriqo.an1zf.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"xriqo.an1zf.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016771; classtype:social-engineering; sid:6016771; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myg0vlogin.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"myg0vlogin.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016772; classtype:social-engineering; sid:6016772; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwwmaxmy.sbs/4g/home.html)"; flow:established,to_server; http.uri; content:"/4g/home.html"; startswith; fast_pattern; http.host; content:"wwwmaxmy.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016773; classtype:social-engineering; sid:6016773; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (irucg.an1zf.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"irucg.an1zf.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016774; classtype:social-engineering; sid:6016774; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeecoo.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopeecoo.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016775; classtype:social-engineering; sid:6016775; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (program-resmi859.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"program-resmi859.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016776; classtype:social-engineering; sid:6016776; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (i5ywyj-hqcf-4e39s6-t7asy.pages.dev/qaz-wsx-edc-rfv?welcome=224878724328954&token248=224878724328954&name_token136=Big%20Music%20School%20&%20Studios)"; flow:established,to_server; http.uri; content:"/qaz-wsx-edc-rfv?welcome=224878724328954&token248=224878724328954&name_token136=Big%20Music%20School%20&%20Studios"; startswith; fast_pattern; http.host; content:"i5ywyj-hqcf-4e39s6-t7asy.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016777; classtype:social-engineering; sid:6016777; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pzsqo.an1zf.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"pzsqo.an1zf.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016778; classtype:social-engineering; sid:6016778; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.18050.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.18050.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016779; classtype:social-engineering; sid:6016779; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (live--leedgers--en--en.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"live--leedgers--en--en.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016780; classtype:social-engineering; sid:6016780; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rkvuh.an1zf.xyz/dh)"; flow:established,to_server; http.uri; content:"/dh"; startswith; fast_pattern; http.host; content:"rkvuh.an1zf.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016781; classtype:social-engineering; sid:6016781; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagramrnumberbillingupdatedatepainstagrampemulihan.129-121-117-207.cpanel.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagramrnumberbillingupdatedatepainstagrampemulihan.129-121-117-207.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016782; classtype:social-engineering; sid:6016782; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (empresas-corporativacentral.lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"empresas-corporativacentral.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016783; classtype:social-engineering; sid:6016783; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brannahome.com.tr/dosini/au/)"; flow:established,to_server; http.uri; content:"/dosini/au/"; startswith; fast_pattern; http.host; content:"brannahome.com.tr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016784; classtype:social-engineering; sid:6016784; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fpfbekjgievhgal.thismxaps.info/leds/)"; flow:established,to_server; http.uri; content:"/leds/"; startswith; fast_pattern; http.host; content:"fpfbekjgievhgal.thismxaps.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016785; classtype:social-engineering; sid:6016785; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (marketkucoin.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"marketkucoin.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016786; classtype:social-engineering; sid:6016786; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dxcoder.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.dxcoder.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016787; classtype:social-engineering; sid:6016787; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (guide-trezzr.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"guide-trezzr.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016788; classtype:social-engineering; sid:6016788; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fd.meluxuryrentals.com/Contents)"; flow:established,to_server; http.uri; content:"/Contents"; startswith; fast_pattern; http.host; content:"fd.meluxuryrentals.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016789; classtype:social-engineering; sid:6016789; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dimasal-cy.github.io/login-form)"; flow:established,to_server; http.uri; content:"/login-form"; startswith; fast_pattern; http.host; content:"dimasal-cy.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016790; classtype:social-engineering; sid:6016790; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yagomouro.github.io/projeto-instagram/)"; flow:established,to_server; http.uri; content:"/projeto-instagram/"; startswith; fast_pattern; http.host; content:"yagomouro.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016791; classtype:social-engineering; sid:6016791; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (situs-undian2021.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"situs-undian2021.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016792; classtype:social-engineering; sid:6016792; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.taiktaikvn.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.taiktaikvn.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016793; classtype:social-engineering; sid:6016793; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (renoveseuaumentodelmt.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"renoveseuaumentodelmt.s3.us-east-005.backblazeb2.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016794; classtype:social-engineering; sid:6016794; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sitesecure2026.wuaze.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sitesecure2026.wuaze.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016795; classtype:social-engineering; sid:6016795; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (la-nouvelle-info-france.com/inscription.php)"; flow:established,to_server; http.uri; content:"/inscription.php"; startswith; fast_pattern; http.host; content:"la-nouvelle-info-france.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016796; classtype:social-engineering; sid:6016796; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (registro-digitales.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"registro-digitales.netlify.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016797; classtype:social-engineering; sid:6016797; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atendimento-netempresas.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"atendimento-netempresas.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016798; classtype:social-engineering; sid:6016798; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sobreporesposabilidade.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"sobreporesposabilidade.s3.us-east-005.backblazeb2.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016799; classtype:social-engineering; sid:6016799; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (formulario-digital-ahbn-2026.cr-web.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"formulario-digital-ahbn-2026.cr-web.workers.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016800; classtype:social-engineering; sid:6016800; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ma-cledigitale.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ma-cledigitale.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016801; classtype:social-engineering; sid:6016801; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xhcmm.com/jp)"; flow:established,to_server; http.uri; content:"/jp"; startswith; fast_pattern; http.host; content:"xhcmm.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016802; classtype:social-engineering; sid:6016802; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bacredomatic.onrender.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bacredomatic.onrender.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016803; classtype:social-engineering; sid:6016803; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sitesecure2026.wuaze.com/index2.html)"; flow:established,to_server; http.uri; content:"/index2.html"; startswith; fast_pattern; http.host; content:"sitesecure2026.wuaze.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016804; classtype:social-engineering; sid:6016804; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acessosnetempresas.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"acessosnetempresas.sbs"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016805; classtype:social-engineering; sid:6016805; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (winsuncorporate.co.in/cgi-sys/suspendedpage.cgi?view=main&\;id=)"; flow:established,to_server; http.uri; content:"/cgi-sys/suspendedpage.cgi?view=main&|3b|id="; startswith; fast_pattern; http.host; content:"winsuncorporate.co.in"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6016806; classtype:social-engineering; sid:6016806; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (registro-digitales.netlify.app/nacional/)"; flow:established,to_server; http.uri; content:"/nacional/"; startswith; fast_pattern; http.host; content:"registro-digitales.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016807; classtype:social-engineering; sid:6016807; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.e-owa.com/?rg=WEU&urid=woOXxyF_VMLmEehYstmSrDGgQzF1vHJY44y0d5Nucs1qWA6WTq5A86ljspR6RwS0BM27x9SvYhd0Z3DgV0YWhVcCp9G3Ue_WKUJWgWTFA0hQl7GLLAckxgC_Z17J6U9kUeCd78lkI0xuFpeW)"; flow:established,to_server; http.uri; content:"/?rg=WEU&urid=woOXxyF_VMLmEehYstmSrDGgQzF1vHJY44y0d5Nucs1qWA6WTq5A86ljspR6RwS0BM27x9SvYhd0Z3DgV0YWhVcCp9G3Ue_WKUJWgWTFA0hQl7GLLAckxgC_Z17J6U9kUeCd78lkI0xuFpeW"; startswith; fast_pattern; http.host; content:"www.e-owa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016808; classtype:social-engineering; sid:6016808; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (etisalat-mobile.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"etisalat-mobile.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016809; classtype:social-engineering; sid:6016809; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (renoveseuaumentodelmt.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"renoveseuaumentodelmt.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016810; classtype:social-engineering; sid:6016810; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (idevices-detect.us/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"idevices-detect.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016811; classtype:social-engineering; sid:6016811; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vormita-gld-lensora-p8t4dk63.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vormita-gld-lensora-p8t4dk63.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016812; classtype:social-engineering; sid:6016812; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sitesecure2026.wuaze.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sitesecure2026.wuaze.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016813; classtype:social-engineering; sid:6016813; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j105a.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j105a.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016814; classtype:social-engineering; sid:6016814; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telquni-gld-zentora-c3x5dk12.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"telquni-gld-zentora-c3x5dk12.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016815; classtype:social-engineering; sid:6016815; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zinemind.com/cmd)"; flow:established,to_server; http.uri; content:"/cmd"; startswith; fast_pattern; http.host; content:"zinemind.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016816; classtype:social-engineering; sid:6016816; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meuuserede.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meuuserede.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016817; classtype:social-engineering; sid:6016817; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.eand.ae/ecare/c/quick-pay)"; flow:established,to_server; http.uri; content:"/ecare/c/quick-pay"; startswith; fast_pattern; http.host; content:"www.eand.ae"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016818; classtype:social-engineering; sid:6016818; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dravora-gld-lentavi-p2x8fp73.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dravora-gld-lentavi-p2x8fp73.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016819; classtype:social-engineering; sid:6016819; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (krenox-filda-pl3006ijn-shrr-hfbb.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"krenox-filda-pl3006ijn-shrr-hfbb.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016820; classtype:social-engineering; sid:6016820; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faiabella.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"faiabella.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016821; classtype:social-engineering; sid:6016821; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rooms-stayhub209.com/myreservation.html?label=gen173bo-10CA4oggI46AdIIVgDaFKIAQGYATO4ARfIAQzYAQPoAQH4AQGIAgGYAiGoAgG4Ac9d1d1422f88ab4d&sid=8114fe787aeee0e1e0f97464552adb45&aid=304142&auth_key=CDI3NzA5OTU4kJ8_&source=mytrips)"; flow:established,to_server; http.uri; content:"/myreservation.html?label=gen173bo-10CA4oggI46AdIIVgDaFKIAQGYATO4ARfIAQzYAQPoAQH4AQGIAgGYAiGoAgG4Ac9d1d1422f88ab4d&sid=8114fe787aeee0e1e0f97464552adb45&aid=304142&auth_key=CDI3NzA5OTU4kJ8_&source=mytrips"; startswith; fast_pattern; http.host; content:"rooms-stayhub209.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016822; classtype:social-engineering; sid:6016822; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j105t.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j105t.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016823; classtype:social-engineering; sid:6016823; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.isupport-lcloudshop.us/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"mail.isupport-lcloudshop.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016824; classtype:social-engineering; sid:6016824; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j106q.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j106q.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016825; classtype:social-engineering; sid:6016825; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cpredem.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cpredem.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016826; classtype:social-engineering; sid:6016826; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gnivok-orelna-zc3006tgb-fjbyh-6gl712.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gnivok-orelna-zc3006tgb-fjbyh-6gl712.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016827; classtype:social-engineering; sid:6016827; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-uphweld.framer.media/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sso-uphweld.framer.media"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016828; classtype:social-engineering; sid:6016828; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (china-wendingonline.com/?ExportExtend&Expire=)"; flow:established,to_server; http.uri; content:"/?ExportExtend&Expire="; startswith; fast_pattern; http.host; content:"china-wendingonline.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016829; classtype:social-engineering; sid:6016829; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j105k.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j105k.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016830; classtype:social-engineering; sid:6016830; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tk-shop.tk-shop-1.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tk-shop.tk-shop-1.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016831; classtype:social-engineering; sid:6016831; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ujjawal6988.github.io/Ledger/)"; flow:established,to_server; http.uri; content:"/Ledger/"; startswith; fast_pattern; http.host; content:"ujjawal6988.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016832; classtype:social-engineering; sid:6016832; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rbcode.net/v/f41ba31751c1a025f71654ad6bbfeb59)"; flow:established,to_server; http.uri; content:"/v/f41ba31751c1a025f71654ad6bbfeb59"; startswith; fast_pattern; http.host; content:"rbcode.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016833; classtype:social-engineering; sid:6016833; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (admin.n19tk.app/index/)"; flow:established,to_server; http.uri; content:"/index/"; startswith; fast_pattern; http.host; content:"admin.n19tk.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016834; classtype:social-engineering; sid:6016834; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fintech-l4pi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fintech-l4pi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016835; classtype:social-engineering; sid:6016835; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (etisalat-mobile.click/ecare/quick-pay/?locale=en)"; flow:established,to_server; http.uri; content:"/ecare/quick-pay/?locale=en"; startswith; fast_pattern; http.host; content:"etisalat-mobile.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016836; classtype:social-engineering; sid:6016836; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chamarthipranithacp.github.io/instagram_clone)"; flow:established,to_server; http.uri; content:"/instagram_clone"; startswith; fast_pattern; http.host; content:"chamarthipranithacp.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016837; classtype:social-engineering; sid:6016837; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (etisalat-offers.click/ecare/quick-pay/?locale=en)"; flow:established,to_server; http.uri; content:"/ecare/quick-pay/?locale=en"; startswith; fast_pattern; http.host; content:"etisalat-offers.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016838; classtype:social-engineering; sid:6016838; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clwzp-rt9-ka7gw-861w2-mro.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"clwzp-rt9-ka7gw-861w2-mro.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016839; classtype:social-engineering; sid:6016839; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.easyalert.ae/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.easyalert.ae"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016840; classtype:social-engineering; sid:6016840; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maj-capp.bolt.host/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"maj-capp.bolt.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016841; classtype:social-engineering; sid:6016841; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoli01.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoli01.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016842; classtype:social-engineering; sid:6016842; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-page-builder--somalley8.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-page-builder--somalley8.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016843; classtype:social-engineering; sid:6016843; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (etisalat-offers.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"etisalat-offers.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016844; classtype:social-engineering; sid:6016844; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (manage-trezoor-en-login.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"manage-trezoor-en-login.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016845; classtype:social-engineering; sid:6016845; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (18134.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"18134.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016846; classtype:social-engineering; sid:6016846; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (norquma-gld-belmora-r5x1fc26.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"norquma-gld-belmora-r5x1fc26.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016847; classtype:social-engineering; sid:6016847; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anjalijha-23.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"anjalijha-23.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016848; classtype:social-engineering; sid:6016848; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lucius-ops.github.io/Trojan-Netflix)"; flow:established,to_server; http.uri; content:"/Trojan-Netflix"; startswith; fast_pattern; http.host; content:"lucius-ops.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016849; classtype:social-engineering; sid:6016849; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.toplu-konut-idaresi-basvurusu.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.toplu-konut-idaresi-basvurusu.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016850; classtype:social-engineering; sid:6016850; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tk-sp-1.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tk-sp-1.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016851; classtype:social-engineering; sid:6016851; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (playerclaim.com/codma3/index.html)"; flow:established,to_server; http.uri; content:"/codma3/index.html"; startswith; fast_pattern; http.host; content:"playerclaim.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016852; classtype:social-engineering; sid:6016852; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (arubaspidspa.buzz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"arubaspidspa.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016853; classtype:social-engineering; sid:6016853; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (france-espace07.bolt.host/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"france-espace07.bolt.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016854; classtype:social-engineering; sid:6016854; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.codmprize.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.codmprize.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016855; classtype:social-engineering; sid:6016855; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qrivok-ilnar-fv3006wsx-sjygh-1hi238.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qrivok-ilnar-fv3006wsx-sjygh-1hi238.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016856; classtype:social-engineering; sid:6016856; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (arubaloginspidspa.bar/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"arubaloginspidspa.bar"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016857; classtype:social-engineering; sid:6016857; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (idevice-detect.us/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"idevice-detect.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016858; classtype:social-engineering; sid:6016858; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mapsflnda.us/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"mapsflnda.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016859; classtype:social-engineering; sid:6016859; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonvote.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonvote.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016860; classtype:social-engineering; sid:6016860; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (v9hnez-mfwj4-h9yn-vhe0-17xr.pages.dev/send_appeal_request)"; flow:established,to_server; http.uri; content:"/send_appeal_request"; startswith; fast_pattern; http.host; content:"v9hnez-mfwj4-h9yn-vhe0-17xr.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016861; classtype:social-engineering; sid:6016861; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mapsflnd.us/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"mapsflnd.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016862; classtype:social-engineering; sid:6016862; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (559196.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"559196.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016863; classtype:social-engineering; sid:6016863; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (korvix.ru.com/v8/home.php)"; flow:established,to_server; http.uri; content:"/v8/home.php"; startswith; fast_pattern; http.host; content:"korvix.ru.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016864; classtype:social-engineering; sid:6016864; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lucifersdevils488-ui.github.io/viveelmundialtricolor.bancolombia.com/)"; flow:established,to_server; http.uri; content:"/viveelmundialtricolor.bancolombia.com/"; startswith; fast_pattern; http.host; content:"lucifersdevils488-ui.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016865; classtype:social-engineering; sid:6016865; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qbappointmentbook.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qbappointmentbook.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016866; classtype:social-engineering; sid:6016866; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (18054.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"18054.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016867; classtype:social-engineering; sid:6016867; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (18046.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"18046.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016868; classtype:social-engineering; sid:6016868; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (govbr-oficial.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"govbr-oficial.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016869; classtype:social-engineering; sid:6016869; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ksaservicesarl.com/edenalt)"; flow:established,to_server; http.uri; content:"/edenalt"; startswith; fast_pattern; http.host; content:"ksaservicesarl.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016870; classtype:social-engineering; sid:6016870; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eand-recharge.net/ecare/quick-pay/?locale=en)"; flow:established,to_server; http.uri; content:"/ecare/quick-pay/?locale=en"; startswith; fast_pattern; http.host; content:"eand-recharge.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016871; classtype:social-engineering; sid:6016871; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (security.breachsecurenow.com/youve-been-caught/)"; flow:established,to_server; http.uri; content:"/youve-been-caught/"; startswith; fast_pattern; http.host; content:"security.breachsecurenow.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016872; classtype:social-engineering; sid:6016872; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.asurion.com/legal/privacy-notice/)"; flow:established,to_server; http.uri; content:"/legal/privacy-notice/"; startswith; fast_pattern; http.host; content:"www.asurion.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016873; classtype:social-engineering; sid:6016873; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wh-whatapp.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wh-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016874; classtype:social-engineering; sid:6016874; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zakpearson1.github.io/budget-tracker)"; flow:established,to_server; http.uri; content:"/budget-tracker"; startswith; fast_pattern; http.host; content:"zakpearson1.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016875; classtype:social-engineering; sid:6016875; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tiktokmarcosleandro.github.io/fb-viaje/)"; flow:established,to_server; http.uri; content:"/fb-viaje/"; startswith; fast_pattern; http.host; content:"tiktokmarcosleandro.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016876; classtype:social-engineering; sid:6016876; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (itzthesandy.github.io/javascript-amazon-project/)"; flow:established,to_server; http.uri; content:"/javascript-amazon-project/"; startswith; fast_pattern; http.host; content:"itzthesandy.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016877; classtype:social-engineering; sid:6016877; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (domskirtt.github.io/EA5/)"; flow:established,to_server; http.uri; content:"/EA5/"; startswith; fast_pattern; http.host; content:"domskirtt.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016878; classtype:social-engineering; sid:6016878; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (etisalte-a.click/ecare/quick-pay/?locale=en)"; flow:established,to_server; http.uri; content:"/ecare/quick-pay/?locale=en"; startswith; fast_pattern; http.host; content:"etisalte-a.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016879; classtype:social-engineering; sid:6016879; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (interactive-whatapp.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"interactive-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016880; classtype:social-engineering; sid:6016880; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (distruibuidora-delivery.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"distruibuidora-delivery.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016881; classtype:social-engineering; sid:6016881; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (codprize.com/podo/index.html)"; flow:established,to_server; http.uri; content:"/podo/index.html"; startswith; fast_pattern; http.host; content:"codprize.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016882; classtype:social-engineering; sid:6016882; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (isupport-lcloudshop.us/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"isupport-lcloudshop.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016883; classtype:social-engineering; sid:6016883; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jeremykakumba.github.io/google-login)"; flow:established,to_server; http.uri; content:"/google-login"; startswith; fast_pattern; http.host; content:"jeremykakumba.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016884; classtype:social-engineering; sid:6016884; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (upgradenuseulimiteja.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"upgradenuseulimiteja.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016885; classtype:social-engineering; sid:6016885; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accessible-whatapp.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"accessible-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016886; classtype:social-engineering; sid:6016886; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ze-bebidas.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ze-bebidas.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016887; classtype:social-engineering; sid:6016887; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t77i.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"t77i.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016888; classtype:social-engineering; sid:6016888; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (admin.n19tk.app/index)"; flow:established,to_server; http.uri; content:"/index"; startswith; fast_pattern; http.host; content:"admin.n19tk.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016889; classtype:social-engineering; sid:6016889; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (18120.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"18120.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016890; classtype:social-engineering; sid:6016890; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eand-accounts.click/ecare/quick-pay/?locale=en)"; flow:established,to_server; http.uri; content:"/ecare/quick-pay/?locale=en"; startswith; fast_pattern; http.host; content:"eand-accounts.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016891; classtype:social-engineering; sid:6016891; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9247870365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9247870365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016892; classtype:social-engineering; sid:6016892; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentojamais01.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentojamais01.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016893; classtype:social-engineering; sid:6016893; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (redi-agencies.one/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"redi-agencies.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016894; classtype:social-engineering; sid:6016894; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trzurs-login.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trzurs-login.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016895; classtype:social-engineering; sid:6016895; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ce82-lz21nc-1xr8f-3hnmis.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ce82-lz21nc-1xr8f-3hnmis.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016896; classtype:social-engineering; sid:6016896; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (giftfreecp.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"giftfreecp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016897; classtype:social-engineering; sid:6016897; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.nailfree.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.nailfree.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016898; classtype:social-engineering; sid:6016898; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (360967365756.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"360967365756.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016899; classtype:social-engineering; sid:6016899; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vpchinmay.github.io/aclone/)"; flow:established,to_server; http.uri; content:"/aclone/"; startswith; fast_pattern; http.host; content:"vpchinmay.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016900; classtype:social-engineering; sid:6016900; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (distruibuidora24h.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"distruibuidora24h.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016901; classtype:social-engineering; sid:6016901; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.os.md/NTWZM/)"; flow:established,to_server; http.uri; content:"/NTWZM/"; startswith; fast_pattern; http.host; content:"www.os.md"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016902; classtype:social-engineering; sid:6016902; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trending-whatapp.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trending-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016903; classtype:social-engineering; sid:6016903; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (actividad-inusual2026.fwh.is/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"actividad-inusual2026.fwh.is"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016904; classtype:social-engineering; sid:6016904; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bigbluewaves.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bigbluewaves.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016905; classtype:social-engineering; sid:6016905; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonshot-app.one/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonshot-app.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016906; classtype:social-engineering; sid:6016906; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telnavi-gld-zarqumi-a8t5fq42.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"telnavi-gld-zarqumi-a8t5fq42.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016907; classtype:social-engineering; sid:6016907; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.by8662.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.by8662.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016908; classtype:social-engineering; sid:6016908; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eand-recharge.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eand-recharge.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016909; classtype:social-engineering; sid:6016909; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en-treezer-us-logins.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"en-treezer-us-logins.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016910; classtype:social-engineering; sid:6016910; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f37o.top/m/home)"; flow:established,to_server; http.uri; content:"/m/home"; startswith; fast_pattern; http.host; content:"f37o.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016911; classtype:social-engineering; sid:6016911; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (y36m.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"y36m.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016912; classtype:social-engineering; sid:6016912; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (click-ledgr-walet.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"click-ledgr-walet.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016913; classtype:social-engineering; sid:6016913; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dravora-gld-belquni-r5t7hp21.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dravora-gld-belquni-r5t7hp21.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016914; classtype:social-engineering; sid:6016914; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (korvix.ru.com/v8/)"; flow:established,to_server; http.uri; content:"/v8/"; startswith; fast_pattern; http.host; content:"korvix.ru.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016915; classtype:social-engineering; sid:6016915; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hgu.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hgu.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016916; classtype:social-engineering; sid:6016916; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (18121.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"18121.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016917; classtype:social-engineering; sid:6016917; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oficial-govbrasil.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"oficial-govbrasil.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016918; classtype:social-engineering; sid:6016918; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j109r.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j109r.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016919; classtype:social-engineering; sid:6016919; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (activisionvip.top/callofduty)"; flow:established,to_server; http.uri; content:"/callofduty"; startswith; fast_pattern; http.host; content:"activisionvip.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016920; classtype:social-engineering; sid:6016920; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adega-ze24h.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"adega-ze24h.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016921; classtype:social-engineering; sid:6016921; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tk-shop.tk-sp-2.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tk-shop.tk-sp-2.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016922; classtype:social-engineering; sid:6016922; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (activisionvip.top/callofduty/offline.php)"; flow:established,to_server; http.uri; content:"/callofduty/offline.php"; startswith; fast_pattern; http.host; content:"activisionvip.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016923; classtype:social-engineering; sid:6016923; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c-a-espace01.bolt.host/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c-a-espace01.bolt.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016924; classtype:social-engineering; sid:6016924; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-karnex-biz-volpra-jedmu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-karnex-biz-volpra-jedmu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016925; classtype:social-engineering; sid:6016925; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (professional-whatapp.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"professional-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016926; classtype:social-engineering; sid:6016926; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (optimized-whatapp.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"optimized-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016927; classtype:social-engineering; sid:6016927; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-irnexa-biz-plavik-zomdu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-irnexa-biz-plavik-zomdu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016928; classtype:social-engineering; sid:6016928; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dravelo-gld-ventari-r2t7qp34.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dravelo-gld-ventari-r2t7qp34.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016929; classtype:social-engineering; sid:6016929; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (berzora-gld-larqumi-c5t4hc62.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"berzora-gld-larqumi-c5t4hc62.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016930; classtype:social-engineering; sid:6016930; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (18123.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"18123.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016931; classtype:social-engineering; sid:6016931; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (leonardoroyallondoncitytoweroflondon.spahotel.guru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"leonardoroyallondoncitytoweroflondon.spahotel.guru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016932; classtype:social-engineering; sid:6016932; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jeremykakumba.github.io/google.com)"; flow:established,to_server; http.uri; content:"/google.com"; startswith; fast_pattern; http.host; content:"jeremykakumba.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016933; classtype:social-engineering; sid:6016933; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (giftcodm.top/full.php)"; flow:established,to_server; http.uri; content:"/full.php"; startswith; fast_pattern; http.host; content:"giftcodm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016934; classtype:social-engineering; sid:6016934; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prizecod.com/callofduty)"; flow:established,to_server; http.uri; content:"/callofduty"; startswith; fast_pattern; http.host; content:"prizecod.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016935; classtype:social-engineering; sid:6016935; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (morlen-qastor-f97c20-nyhh-njy2406yta.pages.dev/welcome_aboard?welcome=100067059075094)"; flow:established,to_server; http.uri; content:"/welcome_aboard?welcome=100067059075094"; startswith; fast_pattern; http.host; content:"morlen-qastor-f97c20-nyhh-njy2406yta.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016936; classtype:social-engineering; sid:6016936; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j105w.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j105w.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016937; classtype:social-engineering; sid:6016937; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-clone-inky-nine.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-clone-inky-nine.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016938; classtype:social-engineering; sid:6016938; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (supporta-aflnd.us/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"supporta-aflnd.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016939; classtype:social-engineering; sid:6016939; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verificar-netflix-suscription.com/pages/captcha.php)"; flow:established,to_server; http.uri; content:"/pages/captcha.php"; startswith; fast_pattern; http.host; content:"verificar-netflix-suscription.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016940; classtype:social-engineering; sid:6016940; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cpevent.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cpevent.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016941; classtype:social-engineering; sid:6016941; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pick-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pick-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016942; classtype:social-engineering; sid:6016942; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anythinghub.github.io/Students/)"; flow:established,to_server; http.uri; content:"/Students/"; startswith; fast_pattern; http.host; content:"anythinghub.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016943; classtype:social-engineering; sid:6016943; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonvote.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonvote.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016944; classtype:social-engineering; sid:6016944; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dh0s-5l9vv2-1hn9-bl2-dpu7.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dh0s-5l9vv2-1hn9-bl2-dpu7.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016945; classtype:social-engineering; sid:6016945; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pemulihan-akun-lnstagram.129-121-117-207.cpanel.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pemulihan-akun-lnstagram.129-121-117-207.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016946; classtype:social-engineering; sid:6016946; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eand-connect.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eand-connect.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016947; classtype:social-engineering; sid:6016947; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mreme-drive-secure-pdf.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mreme-drive-secure-pdf.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016948; classtype:social-engineering; sid:6016948; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tes-ttesttest-test-2.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.tes-ttesttest-test-2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016949; classtype:social-engineering; sid:6016949; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-suporte.dynv6.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-suporte.dynv6.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016950; classtype:social-engineering; sid:6016950; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sv-yashwanth.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"sv-yashwanth.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016951; classtype:social-engineering; sid:6016951; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j105e.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j105e.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016952; classtype:social-engineering; sid:6016952; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vormavi-gld-felmora-p2t7hd68.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vormavi-gld-felmora-p2t7hd68.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016953; classtype:social-engineering; sid:6016953; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.eand.ae/ecare/quick-pay/)"; flow:established,to_server; http.uri; content:"/ecare/quick-pay/"; startswith; fast_pattern; http.host; content:"www.eand.ae"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016954; classtype:social-engineering; sid:6016954; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anue-hmbmh6etebhbbyer.z03.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"anue-hmbmh6etebhbbyer.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016955; classtype:social-engineering; sid:6016955; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-marnix-biz-qulvek-torfa.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-marnix-biz-qulvek-torfa.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016956; classtype:social-engineering; sid:6016956; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (detect-idevices.us/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"detect-idevices.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016957; classtype:social-engineering; sid:6016957; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (freecpworld.com/codma3/index.html)"; flow:established,to_server; http.uri; content:"/codma3/index.html"; startswith; fast_pattern; http.host; content:"freecpworld.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016958; classtype:social-engineering; sid:6016958; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (freecpworld.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"freecpworld.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016959; classtype:social-engineering; sid:6016959; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (n19tk.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"n19tk.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016960; classtype:social-engineering; sid:6016960; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nwfella.github.io/coinbase-referral/)"; flow:established,to_server; http.uri; content:"/coinbase-referral/"; startswith; fast_pattern; http.host; content:"nwfella.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016961; classtype:social-engineering; sid:6016961; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (etisalat-support.click/ecare/quick-pay/?locale=en)"; flow:established,to_server; http.uri; content:"/ecare/quick-pay/?locale=en"; startswith; fast_pattern; http.host; content:"etisalat-support.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016962; classtype:social-engineering; sid:6016962; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (57365y.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"57365y.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016963; classtype:social-engineering; sid:6016963; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sobreporesposabilidade.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"sobreporesposabilidade.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016964; classtype:social-engineering; sid:6016964; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ksaservicesarl.com/JASPERPLASTICS)"; flow:established,to_server; http.uri; content:"/JASPERPLASTICS"; startswith; fast_pattern; http.host; content:"ksaservicesarl.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016965; classtype:social-engineering; sid:6016965; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verifyemail.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"verifyemail.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016966; classtype:social-engineering; sid:6016966; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (airdropcp.com/codma3/index.html)"; flow:established,to_server; http.uri; content:"/codma3/index.html"; startswith; fast_pattern; http.host; content:"airdropcp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016967; classtype:social-engineering; sid:6016967; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.idevice-detect.us/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"mail.idevice-detect.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016968; classtype:social-engineering; sid:6016968; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (557758.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"557758.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016969; classtype:social-engineering; sid:6016969; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.idevices-detect.us/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"mail.idevices-detect.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016970; classtype:social-engineering; sid:6016970; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (valorrostertwilight.s3.ap-northeast-2.amazonaws.com/sodium)"; flow:established,to_server; http.uri; content:"/sodium"; startswith; fast_pattern; http.host; content:"valorrostertwilight.s3.ap-northeast-2.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016971; classtype:social-engineering; sid:6016971; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abarrotodo.com/nick/ncl/home)"; flow:established,to_server; http.uri; content:"/nick/ncl/home"; startswith; fast_pattern; http.host; content:"abarrotodo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016972; classtype:social-engineering; sid:6016972; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s35g.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"s35g.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016973; classtype:social-engineering; sid:6016973; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (more-lily-891330.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"more-lily-891330.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016974; classtype:social-engineering; sid:6016974; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.18097.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.18097.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016975; classtype:social-engineering; sid:6016975; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (educationpolicy-euff.keelingsobotka.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"educationpolicy-euff.keelingsobotka.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016976; classtype:social-engineering; sid:6016976; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toplu-konut-idaresi-basvurunuzu.vercel.app/giris.php)"; flow:established,to_server; http.uri; content:"/giris.php"; startswith; fast_pattern; http.host; content:"toplu-konut-idaresi-basvurunuzu.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016977; classtype:social-engineering; sid:6016977; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mcsotssdgefaqjp.oklsoasx.info/leds/)"; flow:established,to_server; http.uri; content:"/leds/"; startswith; fast_pattern; http.host; content:"mcsotssdgefaqjp.oklsoasx.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016978; classtype:social-engineering; sid:6016978; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qbappointmentpro.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qbappointmentpro.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016979; classtype:social-engineering; sid:6016979; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-jorqal-biz-menfro-tusvi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-jorqal-biz-menfro-tusvi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016980; classtype:social-engineering; sid:6016980; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (16581.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"16581.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016981; classtype:social-engineering; sid:6016981; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.secure-bankofamerica-com-silk.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.secure-bankofamerica-com-silk.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016982; classtype:social-engineering; sid:6016982; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xelquna-gld-belquro-a3x5hc47.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xelquna-gld-belquro-a3x5hc47.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016983; classtype:social-engineering; sid:6016983; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.iapple-recovery.com/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"mail.iapple-recovery.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016984; classtype:social-engineering; sid:6016984; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spxprojetospe-ui.github.io/Entrevista-Operacional--Adecco/)"; flow:established,to_server; http.uri; content:"/Entrevista-Operacional--Adecco/"; startswith; fast_pattern; http.host; content:"spxprojetospe-ui.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016985; classtype:social-engineering; sid:6016985; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (govpendencias.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"govpendencias.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016986; classtype:social-engineering; sid:6016986; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (morlavo-gld-belquni-r1x2dk84.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"morlavo-gld-belquni-r1x2dk84.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016987; classtype:social-engineering; sid:6016987; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (proximaetapaexclusiva.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"proximaetapaexclusiva.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016988; classtype:social-engineering; sid:6016988; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toplu-konut-idaresi-basvurunuzu.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"toplu-konut-idaresi-basvurunuzu.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016989; classtype:social-engineering; sid:6016989; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cpdrop.top/callofduty)"; flow:established,to_server; http.uri; content:"/callofduty"; startswith; fast_pattern; http.host; content:"cpdrop.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016990; classtype:social-engineering; sid:6016990; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sucursal-personas-colombia.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.sucursal-personas-colombia.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016991; classtype:social-engineering; sid:6016991; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (etisalat-home.click/ecare/quick-pay/?locale=en)"; flow:established,to_server; http.uri; content:"/ecare/quick-pay/?locale=en"; startswith; fast_pattern; http.host; content:"etisalat-home.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016992; classtype:social-engineering; sid:6016992; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (companypolicy.com.au/?r=15398be9-cbfd-481b-b1d9-3bf3308dbfd3&rg=us)"; flow:established,to_server; http.uri; content:"/?r=15398be9-cbfd-481b-b1d9-3bf3308dbfd3&rg=us"; startswith; fast_pattern; http.host; content:"companypolicy.com.au"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016993; classtype:social-engineering; sid:6016993; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.registroconfirmado.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.registroconfirmado.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016994; classtype:social-engineering; sid:6016994; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.mapsflnd.us/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"mail.mapsflnd.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016995; classtype:social-engineering; sid:6016995; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.supports-flnd.us/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"mail.supports-flnd.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016996; classtype:social-engineering; sid:6016996; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (automated-whatapp.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"automated-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016997; classtype:social-engineering; sid:6016997; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uni-lab-rosy.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uni-lab-rosy.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016998; classtype:social-engineering; sid:6016998; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.zh-data-douyu.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.zh-data-douyu.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6016999; classtype:social-engineering; sid:6016999; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (distribuidora-24h.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"distribuidora-24h.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017000; classtype:social-engineering; sid:6017000; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (57365h.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"57365h.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017001; classtype:social-engineering; sid:6017001; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bookkeeper.co.tz/1/bWFydGluckBlaHRjLmNvbQ==)"; flow:established,to_server; http.uri; content:"/1/bWFydGluckBlaHRjLmNvbQ=="; startswith; fast_pattern; http.host; content:"bookkeeper.co.tz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017002; classtype:social-engineering; sid:6017002; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (23276936365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"23276936365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017003; classtype:social-engineering; sid:6017003; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonsgetv.surf/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonsgetv.surf"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017004; classtype:social-engineering; sid:6017004; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reactivationpass-ca.bolt.host/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"reactivationpass-ca.bolt.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017005; classtype:social-engineering; sid:6017005; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (forsakens-crew-teman-facebook.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"forsakens-crew-teman-facebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017006; classtype:social-engineering; sid:6017006; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cpfreegifts.com/callofduty)"; flow:established,to_server; http.uri; content:"/callofduty"; startswith; fast_pattern; http.host; content:"cpfreegifts.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017007; classtype:social-engineering; sid:6017007; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cpredeem.com/codma3/index.html)"; flow:established,to_server; http.uri; content:"/codma3/index.html"; startswith; fast_pattern; http.host; content:"cpredeem.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017008; classtype:social-engineering; sid:6017008; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vpchinmay.github.io/amzonclone/)"; flow:established,to_server; http.uri; content:"/amzonclone/"; startswith; fast_pattern; http.host; content:"vpchinmay.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017009; classtype:social-engineering; sid:6017009; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j99p.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j99p.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017010; classtype:social-engineering; sid:6017010; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.luxchainholdings.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.luxchainholdings.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017011; classtype:social-engineering; sid:6017011; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en-treezer-logins-cdns.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"en-treezer-logins-cdns.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017012; classtype:social-engineering; sid:6017012; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pfa8p.wwwwjili.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pfa8p.wwwwjili.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017013; classtype:social-engineering; sid:6017013; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (angelic-food-523097.framer.app/?referer=urlvanish.com%2Febaa918a)"; flow:established,to_server; http.uri; content:"/?referer=urlvanish.com%2Febaa918a"; startswith; fast_pattern; http.host; content:"angelic-food-523097.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017014; classtype:social-engineering; sid:6017014; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (torvaxuta-biz-pramqeluta-a6x1db82.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"torvaxuta-biz-pramqeluta-a6x1db82.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017015; classtype:social-engineering; sid:6017015; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (epoch.motwazy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"epoch.motwazy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017016; classtype:social-engineering; sid:6017016; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (arsrv239c1d0e77d1.s3.us-east-1.amazonaws.com/index.html#martinr@ehtc.com)"; flow:established,to_server; http.uri; content:"/index.html#martinr@ehtc.com"; startswith; fast_pattern; http.host; content:"arsrv239c1d0e77d1.s3.us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017017; classtype:social-engineering; sid:6017017; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (limpandoagora.shop/inicio/?gad_source=)"; flow:established,to_server; http.uri; content:"/inicio/?gad_source="; startswith; fast_pattern; http.host; content:"limpandoagora.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017018; classtype:social-engineering; sid:6017018; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cpredem.com/podoo/index.html)"; flow:established,to_server; http.uri; content:"/podoo/index.html"; startswith; fast_pattern; http.host; content:"cpredem.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017019; classtype:social-engineering; sid:6017019; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shagunsingh367.github.io/Amazon_Clone/)"; flow:established,to_server; http.uri; content:"/Amazon_Clone/"; startswith; fast_pattern; http.host; content:"shagunsingh367.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017020; classtype:social-engineering; sid:6017020; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreifnt7kgukydysz4ijbl76fnbubewiqetzsqnrayhj6bmeqdgbmlx4.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreifnt7kgukydysz4ijbl76fnbubewiqetzsqnrayhj6bmeqdgbmlx4.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017021; classtype:social-engineering; sid:6017021; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iapple-recovery.com/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"iapple-recovery.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017022; classtype:social-engineering; sid:6017022; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (distribuidora-bebidas.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"distribuidora-bebidas.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017023; classtype:social-engineering; sid:6017023; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.supporta-aflnd.us/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"mail.supporta-aflnd.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017024; classtype:social-engineering; sid:6017024; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store.communitysourcebuild.shop/workshop/AK47-EternalDecay/)"; flow:established,to_server; http.uri; content:"/workshop/AK47-EternalDecay/"; startswith; fast_pattern; http.host; content:"store.communitysourcebuild.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017025; classtype:social-engineering; sid:6017025; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (manage-trezoor-es-login.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"manage-trezoor-es-login.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017026; classtype:social-engineering; sid:6017026; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gwv3-jdq7-ifz2.whiteboardpdff-outlook-com-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gwv3-jdq7-ifz2.whiteboardpdff-outlook-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017027; classtype:social-engineering; sid:6017027; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gautamandgautam-byizfzvunb.edgeone.dev/file/)"; flow:established,to_server; http.uri; content:"/file/"; startswith; fast_pattern; http.host; content:"gautamandgautam-byizfzvunb.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017028; classtype:social-engineering; sid:6017028; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abarrotodo.com/nick/ncl/home/nkl-log.php)"; flow:established,to_server; http.uri; content:"/nick/ncl/home/nkl-log.php"; startswith; fast_pattern; http.host; content:"abarrotodo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017029; classtype:social-engineering; sid:6017029; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j106u.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j106u.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017030; classtype:social-engineering; sid:6017030; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gangtaizs.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gangtaizs.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017031; classtype:social-engineering; sid:6017031; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.mapsflnda.us/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"mail.mapsflnda.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017032; classtype:social-engineering; sid:6017032; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bvifxc.com/rewardcenters/?tk=dXzwbYvKwHu)"; flow:established,to_server; http.uri; content:"/rewardcenters/?tk=dXzwbYvKwHu"; startswith; fast_pattern; http.host; content:"t-mobile.bvifxc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017033; classtype:social-engineering; sid:6017033; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dravemi-gld-lentora-r8t9hp55.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dravemi-gld-lentora-r8t9hp55.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017034; classtype:social-engineering; sid:6017034; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zilotti.com/vm.microsoft/auth/add.php)"; flow:established,to_server; http.uri; content:"/vm.microsoft/auth/add.php"; startswith; fast_pattern; http.host; content:"zilotti.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017035; classtype:social-engineering; sid:6017035; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suaschanceaindamaioraproveite.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"suaschanceaindamaioraproveite.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017036; classtype:social-engineering; sid:6017036; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezzr-suite-sso.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezzr-suite-sso.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017037; classtype:social-engineering; sid:6017037; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (supports-flnd.us/ICL26/)"; flow:established,to_server; http.uri; content:"/ICL26/"; startswith; fast_pattern; http.host; content:"supports-flnd.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017038; classtype:social-engineering; sid:6017038; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abarrotodo.com/nick/ncl/home/)"; flow:established,to_server; http.uri; content:"/nick/ncl/home/"; startswith; fast_pattern; http.host; content:"abarrotodo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017039; classtype:social-engineering; sid:6017039; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (exclusive-whatapp.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"exclusive-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017040; classtype:social-engineering; sid:6017040; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fnscan.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fnscan.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017041; classtype:social-engineering; sid:6017041; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (efrtuozp.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"efrtuozp.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017042; classtype:social-engineering; sid:6017042; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (confiirmar-cuenta2026.iceiy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"confiirmar-cuenta2026.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017043; classtype:social-engineering; sid:6017043; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kucoiinloginus.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kucoiinloginus.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017044; classtype:social-engineering; sid:6017044; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-ulvren-biz-pradik-mexzo.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-ulvren-biz-pradik-mexzo.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017045; classtype:social-engineering; sid:6017045; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreifyg4k3cbyzxktgjfne37ywt5hll2oh3blz36s7thw7xvrjkdhsf4.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreifyg4k3cbyzxktgjfne37ywt5hll2oh3blz36s7thw7xvrjkdhsf4.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017046; classtype:social-engineering; sid:6017046; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (v9hnez-mfwj4-h9yn-vhe0-17xr.pages.dev/qaz-wsx-edc-rfv?welcome=260584057611002&token248=260584057611002&name_token136=C%20&%20M%20Hayes%20Ltd)"; flow:established,to_server; http.uri; content:"/qaz-wsx-edc-rfv?welcome=260584057611002&token248=260584057611002&name_token136=C%20&%20M%20Hayes%20Ltd"; startswith; fast_pattern; http.host; content:"v9hnez-mfwj4-h9yn-vhe0-17xr.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017047; classtype:social-engineering; sid:6017047; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ontarioacelpart.us-mia-1.linodeobjects.com/validate.html)"; flow:established,to_server; http.uri; content:"/validate.html"; startswith; fast_pattern; http.host; content:"ontarioacelpart.us-mia-1.linodeobjects.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017048; classtype:social-engineering; sid:6017048; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adega-ze.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"adega-ze.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017049; classtype:social-engineering; sid:6017049; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xelqumi-gld-zartora-r8x1hz46.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xelqumi-gld-zartora-r8x1hz46.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017050; classtype:social-engineering; sid:6017050; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eand-accounts.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eand-accounts.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017051; classtype:social-engineering; sid:6017051; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zain1490.github.io/Amazon-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-clone/"; startswith; fast_pattern; http.host; content:"zain1490.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017052; classtype:social-engineering; sid:6017052; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (devraj-sisodiya.github.io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"devraj-sisodiya.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017053; classtype:social-engineering; sid:6017053; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (etisalte-a.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"etisalte-a.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017054; classtype:social-engineering; sid:6017054; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eand-connect.click/ecare/quick-pay/?locale=en)"; flow:established,to_server; http.uri; content:"/ecare/quick-pay/?locale=en"; startswith; fast_pattern; http.host; content:"eand-connect.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017055; classtype:social-engineering; sid:6017055; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sweksha-git.github.io/Amazon.css.clone/index.html/)"; flow:established,to_server; http.uri; content:"/Amazon.css.clone/index.html/"; startswith; fast_pattern; http.host; content:"sweksha-git.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017056; classtype:social-engineering; sid:6017056; rev:1; metadata: signature_severity Major, created_et 2026_07_02;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (airstreamwebmain.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"airstreamwebmain.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017057; classtype:social-engineering; sid:6017057; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atshm2025.firebaseapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"atshm2025.firebaseapp.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017058; classtype:social-engineering; sid:6017058; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mcwjomx.com/?fZQe70hFjj0zviQBBq4LjJJL)"; flow:established,to_server; http.uri; content:"/?fZQe70hFjj0zviQBBq4LjJJL"; startswith; fast_pattern; http.host; content:"www.mcwjomx.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017059; classtype:social-engineering; sid:6017059; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pianetacasami.it/ur/ur/)"; flow:established,to_server; http.uri; content:"/ur/ur/"; startswith; fast_pattern; http.host; content:"www.pianetacasami.it"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017060; classtype:social-engineering; sid:6017060; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maxismail.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"maxismail.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017061; classtype:social-engineering; sid:6017061; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.cxlejb.homes/track-it)"; flow:established,to_server; http.uri; content:"/track-it"; startswith; fast_pattern; http.host; content:"brt.cxlejb.homes"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017062; classtype:social-engineering; sid:6017062; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wilfriedngounnou75-byte.github.io/posi/)"; flow:established,to_server; http.uri; content:"/posi/"; startswith; fast_pattern; http.host; content:"wilfriedngounnou75-byte.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017063; classtype:social-engineering; sid:6017063; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.ckwceo.com/?0ZjZJUMWfcdYzHrMUwlmpZD4)"; flow:established,to_server; http.uri; content:"/?0ZjZJUMWfcdYzHrMUwlmpZD4"; startswith; fast_pattern; http.host; content:"login.ckwceo.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017064; classtype:social-engineering; sid:6017064; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gorgeupdatesevrer4.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gorgeupdatesevrer4.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017065; classtype:social-engineering; sid:6017065; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.siluomeitaoci.com/?WFAbAusOz0lNFvOIZYiexpeC)"; flow:established,to_server; http.uri; content:"/?WFAbAusOz0lNFvOIZYiexpeC"; startswith; fast_pattern; http.host; content:"www.siluomeitaoci.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017066; classtype:social-engineering; sid:6017066; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rowtl.com/?type=verify&\;key=csdkubxveh)"; flow:established,to_server; http.uri; content:"/?type=verify&|3b|key=csdkubxveh"; startswith; fast_pattern; http.host; content:"rowtl.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017067; classtype:social-engineering; sid:6017067; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hawaiiantel2025.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hawaiiantel2025.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017068; classtype:social-engineering; sid:6017068; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (convergencesfracbesancon.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"convergencesfracbesancon.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017069; classtype:social-engineering; sid:6017069; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.czgaoyu.com/?F1YQXArji9J8lg5eyGlIKiTv)"; flow:established,to_server; http.uri; content:"/?F1YQXArji9J8lg5eyGlIKiTv"; startswith; fast_pattern; http.host; content:"www.czgaoyu.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017070; classtype:social-engineering; sid:6017070; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dovishfinancialservices.com/wp-content/uploads/2026/43rd/index.html)"; flow:established,to_server; http.uri; content:"/wp-content/uploads/2026/43rd/index.html"; startswith; fast_pattern; http.host; content:"dovishfinancialservices.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017071; classtype:social-engineering; sid:6017071; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-irnoka-biz-pramte-luzqi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-irnoka-biz-pramte-luzqi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017072; classtype:social-engineering; sid:6017072; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalcreditointeligente.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalcreditointeligente.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017073; classtype:social-engineering; sid:6017073; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalfinanceirodigital.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalfinanceirodigital.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017074; classtype:social-engineering; sid:6017074; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fibretecnic.es/factu/)"; flow:established,to_server; http.uri; content:"/factu/"; startswith; fast_pattern; http.host; content:"fibretecnic.es"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017075; classtype:social-engineering; sid:6017075; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facilcentralcredito.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facilcentralcredito.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017076; classtype:social-engineering; sid:6017076; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-wurnal-biz-tronka-zesdu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-wurnal-biz-tronka-zesdu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017077; classtype:social-engineering; sid:6017077; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralcreditoexecutivo.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralcreditoexecutivo.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017078; classtype:social-engineering; sid:6017078; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalsimplesfinanciamento.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalsimplesfinanciamento.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017079; classtype:social-engineering; sid:6017079; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth-spectrum-net-login-webmail.framer.website/?referer=urlvanish.com%2F4fcf4f71)"; flow:established,to_server; http.uri; content:"/?referer=urlvanish.com%2F4fcf4f71"; startswith; fast_pattern; http.host; content:"auth-spectrum-net-login-webmail.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017080; classtype:social-engineering; sid:6017080; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalcreditosimples.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalcreditosimples.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017081; classtype:social-engineering; sid:6017081; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (correos-institucionallco2026x.iceiy.com/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"correos-institucionallco2026x.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017082; classtype:social-engineering; sid:6017082; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralbeneficiosplus.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralbeneficiosplus.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017083; classtype:social-engineering; sid:6017083; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalgestaoexecutiva.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalgestaoexecutiva.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017084; classtype:social-engineering; sid:6017084; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telquro-gld-lensavi-p8t4dk64.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"telquro-gld-lensavi-p8t4dk64.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017085; classtype:social-engineering; sid:6017085; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icy-mud-0f8137210.7.azurestaticapps.net/Index.html)"; flow:established,to_server; http.uri; content:"/Index.html"; startswith; fast_pattern; http.host; content:"icy-mud-0f8137210.7.azurestaticapps.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017086; classtype:social-engineering; sid:6017086; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (project-zne9e.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"project-zne9e.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017087; classtype:social-engineering; sid:6017087; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalfinanciafacill.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalfinanciafacill.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017088; classtype:social-engineering; sid:6017088; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralgestaoexpress.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralgestaoexpress.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017089; classtype:social-engineering; sid:6017089; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9598ed23-53c9-4add-900f-e97e1a4313a6-00-8au1j2nnf8uy.riker.replit.dev/index2.html)"; flow:established,to_server; http.uri; content:"/index2.html"; startswith; fast_pattern; http.host; content:"9598ed23-53c9-4add-900f-e97e1a4313a6-00-8au1j2nnf8uy.riker.replit.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017090; classtype:social-engineering; sid:6017090; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vamptech-inc.com/images/0/2455908/)"; flow:established,to_server; http.uri; content:"/images/0/2455908/"; startswith; fast_pattern; http.host; content:"vamptech-inc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017091; classtype:social-engineering; sid:6017091; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedagio.digitalecovias.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pedagio.digitalecovias.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017092; classtype:social-engineering; sid:6017092; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalpeguecredito.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalpeguecredito.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017093; classtype:social-engineering; sid:6017093; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalclientesdigital.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalclientesdigital.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017094; classtype:social-engineering; sid:6017094; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (khkiiiih.vgho9-foqhfoq.com:15681/?inviteCode=95317&cid=124)"; flow:established,to_server; http.uri; content:"/?inviteCode=95317&cid=124"; startswith; fast_pattern; http.host; content:"khkiiiih.vgho9-foqhfoq.com:15681"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017095; classtype:social-engineering; sid:6017095; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (device-found.info/U4c)"; flow:established,to_server; http.uri; content:"/U4c"; startswith; fast_pattern; http.host; content:"device-found.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017096; classtype:social-engineering; sid:6017096; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-ulvnex-biz-pralto-medqu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-ulvnex-biz-pralto-medqu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017097; classtype:social-engineering; sid:6017097; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralfacilemprestimo.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralfacilemprestimo.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017098; classtype:social-engineering; sid:6017098; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suporte-netempresa.lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"suporte-netempresa.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017099; classtype:social-engineering; sid:6017099; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralacessoplus.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralacessoplus.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017100; classtype:social-engineering; sid:6017100; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralcreditovirtual.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralcreditovirtual.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017101; classtype:social-engineering; sid:6017101; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (exodus.page/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"exodus.page"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017102; classtype:social-engineering; sid:6017102; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalgestaosegura.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalgestaosegura.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017103; classtype:social-engineering; sid:6017103; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (doxc.dedhgaj.com/Korea)"; flow:established,to_server; http.uri; content:"/Korea"; startswith; fast_pattern; http.host; content:"doxc.dedhgaj.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017104; classtype:social-engineering; sid:6017104; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-jarnex-biz-vostri-melqa.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-jarnex-biz-vostri-melqa.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017105; classtype:social-engineering; sid:6017105; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dravemi-gld-lentami-p4x9hp12.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dravemi-gld-lentami-p4x9hp12.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017106; classtype:social-engineering; sid:6017106; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bsidge-apps.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bsidge-apps.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017107; classtype:social-engineering; sid:6017107; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (remboursement-operateur-instant.github.io/serviceclient/)"; flow:established,to_server; http.uri; content:"/serviceclient/"; startswith; fast_pattern; http.host; content:"remboursement-operateur-instant.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017108; classtype:social-engineering; sid:6017108; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.appsimplescredito.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.appsimplescredito.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017109; classtype:social-engineering; sid:6017109; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1bfe98b0-6714-be4c-3bf4-docviewer.rajesh-das1010.workers.dev/7vkdx6qwmr/4kleh5792ai/)"; flow:established,to_server; http.uri; content:"/7vkdx6qwmr/4kleh5792ai/"; startswith; fast_pattern; http.host; content:"1bfe98b0-6714-be4c-3bf4-docviewer.rajesh-das1010.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017110; classtype:social-engineering; sid:6017110; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.poortalfinanciafacil.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.poortalfinanciafacil.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017111; classtype:social-engineering; sid:6017111; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ref0107azpvkl.unifiedsrvgrid.com/public/index?ref=business-support-center-DASDFDSYUYEE43FJDSHFSDFsetting%25popup?client_id=889943718806-ual26tplnot2ea8b7n5t4p77keo8eb)"; flow:established,to_server; http.uri; content:"/public/index?ref=business-support-center-DASDFDSYUYEE43FJDSHFSDFsetting%25popup?client_id=889943718806-ual26tplnot2ea8b7n5t4p77keo8eb"; startswith; fast_pattern; http.host; content:"ref0107azpvkl.unifiedsrvgrid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017112; classtype:social-engineering; sid:6017112; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tatendahjames-glitch.github.io/Apk1/)"; flow:established,to_server; http.uri; content:"/Apk1/"; startswith; fast_pattern; http.host; content:"tatendahjames-glitch.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017113; classtype:social-engineering; sid:6017113; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ufauc.com/bhlg)"; flow:established,to_server; http.uri; content:"/bhlg"; startswith; fast_pattern; http.host; content:"ufauc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017114; classtype:social-engineering; sid:6017114; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.financiamentocentral.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.financiamentocentral.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017115; classtype:social-engineering; sid:6017115; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.cenzoryr.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app.cenzoryr.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017116; classtype:social-engineering; sid:6017116; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.uni-test-nine.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.uni-test-nine.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017117; classtype:social-engineering; sid:6017117; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eqpodesgrdadffcwhttp.iceiy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eqpodesgrdadffcwhttp.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017118; classtype:social-engineering; sid:6017118; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blox.watevergames.net/?ysclid=mr3qdph62n168800637)"; flow:established,to_server; http.uri; content:"/?ysclid=mr3qdph62n168800637"; startswith; fast_pattern; http.host; content:"blox.watevergames.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017119; classtype:social-engineering; sid:6017119; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.creditointeligentedigital.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.creditointeligentedigital.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017120; classtype:social-engineering; sid:6017120; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-yorqen-biz-treska-vomlu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-yorqen-biz-treska-vomlu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017121; classtype:social-engineering; sid:6017121; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (discreet-tetragon-686387.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"discreet-tetragon-686387.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017122; classtype:social-engineering; sid:6017122; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ngfffgygt.vgho9-foqhfoq.com:15681/?inviteCode=64298&cid=118)"; flow:established,to_server; http.uri; content:"/?inviteCode=64298&cid=118"; startswith; fast_pattern; http.host; content:"ngfffgygt.vgho9-foqhfoq.com:15681"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017123; classtype:social-engineering; sid:6017123; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.emprestimocentral.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.emprestimocentral.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017124; classtype:social-engineering; sid:6017124; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (project-zne9e.vercel.app/step1-login.html/)"; flow:established,to_server; http.uri; content:"/step1-login.html/"; startswith; fast_pattern; http.host; content:"project-zne9e.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017125; classtype:social-engineering; sid:6017125; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralclientesdigital.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralclientesdigital.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017126; classtype:social-engineering; sid:6017126; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-felqor-biz-kramta-vusni.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-felqor-biz-kramta-vusni.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017127; classtype:social-engineering; sid:6017127; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (niveldeacessoorganizadorgasto.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"niveldeacessoorganizadorgasto.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017128; classtype:social-engineering; sid:6017128; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalseucredito.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalseucredito.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017129; classtype:social-engineering; sid:6017129; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17921.xyz/m/)"; flow:established,to_server; http.uri; content:"/m/"; startswith; fast_pattern; http.host; content:"17921.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017130; classtype:social-engineering; sid:6017130; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yghgyhyyy.df14dfq-dnqofhjoqfh.com:15681/?cid=117&inviteCode=28816)"; flow:established,to_server; http.uri; content:"/?cid=117&inviteCode=28816"; startswith; fast_pattern; http.host; content:"yghgyhyyy.df14dfq-dnqofhjoqfh.com:15681"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017131; classtype:social-engineering; sid:6017131; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalsimplescredito.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalsimplescredito.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017132; classtype:social-engineering; sid:6017132; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalgestaointeligente.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalgestaointeligente.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017133; classtype:social-engineering; sid:6017133; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-telvra-biz-pronka-fesmu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-telvra-biz-pronka-fesmu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017134; classtype:social-engineering; sid:6017134; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shop.pipitea.com/hbt/kd/sp)"; flow:established,to_server; http.uri; content:"/hbt/kd/sp"; startswith; fast_pattern; http.host; content:"shop.pipitea.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017135; classtype:social-engineering; sid:6017135; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webverifitl.webcindario.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webverifitl.webcindario.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017136; classtype:social-engineering; sid:6017136; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cms-sjg-cra-arcc.cfd/scpage/Log%20in%20to%20your%20account%20desjardin.htm?amount=245&from=Canada+Revenue+Agency&message=+Canada+Groceries+and+Essentials+Benefit.(CGEB)&expiry=July+8)"; flow:established,to_server; http.uri; content:"/scpage/Log%20in%20to%20your%20account%20desjardin.htm?amount=245&from=Canada+Revenue+Agency&message=+Canada+Groceries+and+Essentials+Benefit.(CGEB)&expiry=July+8"; startswith; fast_pattern; http.host; content:"cms-sjg-cra-arcc.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017137; classtype:social-engineering; sid:6017137; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-qelvar-biz-tronka-fimzu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-qelvar-biz-tronka-fimzu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017138; classtype:social-engineering; sid:6017138; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kvw-bgdxc.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kvw-bgdxc.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017139; classtype:social-engineering; sid:6017139; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j105i.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j105i.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017140; classtype:social-engineering; sid:6017140; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chat-whatsapp.tw.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"chat-whatsapp.tw.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017141; classtype:social-engineering; sid:6017141; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adminwebmaill.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"adminwebmaill.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017142; classtype:social-engineering; sid:6017142; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2ygkf6ps52-png.github.io/ledger/)"; flow:established,to_server; http.uri; content:"/ledger/"; startswith; fast_pattern; http.host; content:"2ygkf6ps52-png.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017143; classtype:social-engineering; sid:6017143; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralemprestima.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralemprestima.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017144; classtype:social-engineering; sid:6017144; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.acessocentralplus.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.acessocentralplus.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017145; classtype:social-engineering; sid:6017145; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalfinanciafaciil.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalfinanciafaciil.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017146; classtype:social-engineering; sid:6017146; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-rolvar-biz-prenka-fusqi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-rolvar-biz-prenka-fusqi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017147; classtype:social-engineering; sid:6017147; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j105h.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j105h.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017148; classtype:social-engineering; sid:6017148; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralmelhorcredito.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralmelhorcredito.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017149; classtype:social-engineering; sid:6017149; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralemprestimofacil.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralemprestimofacil.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017150; classtype:social-engineering; sid:6017150; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.liiberarcredito.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.liiberarcredito.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017151; classtype:social-engineering; sid:6017151; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralgestaointeligente.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralgestaointeligente.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017152; classtype:social-engineering; sid:6017152; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalgestaoestrategica.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalgestaoestrategica.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017153; classtype:social-engineering; sid:6017153; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ipac-tech.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ipac-tech.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017154; classtype:social-engineering; sid:6017154; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.setupfirmwaresync.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.setupfirmwaresync.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017155; classtype:social-engineering; sid:6017155; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralgestaoexecutiva.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralgestaoexecutiva.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017156; classtype:social-engineering; sid:6017156; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralsimplescredito.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralsimplescredito.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017157; classtype:social-engineering; sid:6017157; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalcreditoseguro.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalcreditoseguro.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017158; classtype:social-engineering; sid:6017158; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gracesyt.github.io/Documentalert/Contractordocumental%20PTY%20LTD)"; flow:established,to_server; http.uri; content:"/Documentalert/Contractordocumental%20PTY%20LTD"; startswith; fast_pattern; http.host; content:"gracesyt.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017159; classtype:social-engineering; sid:6017159; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verifwsa.iceiy.com/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"verifwsa.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017160; classtype:social-engineering; sid:6017160; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.appcreditofacil.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.appcreditofacil.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017161; classtype:social-engineering; sid:6017161; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (validationoutlook365ing.site.je/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"validationoutlook365ing.site.je"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017162; classtype:social-engineering; sid:6017162; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralcreditoagil.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralcreditoagil.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017163; classtype:social-engineering; sid:6017163; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ripristino-account.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ripristino-account.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017164; classtype:social-engineering; sid:6017164; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1327.win/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1327.win"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017165; classtype:social-engineering; sid:6017165; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365549.cc:8443/index.html?shareName=365549.cc&proxyAccount=)"; flow:established,to_server; http.uri; content:"/index.html?shareName=365549.cc&proxyAccount="; startswith; fast_pattern; http.host; content:"365549.cc:8443"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017166; classtype:social-engineering; sid:6017166; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralpeguecredito.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralpeguecredito.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017167; classtype:social-engineering; sid:6017167; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kvx-hfdes.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kvx-hfdes.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017168; classtype:social-engineering; sid:6017168; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qasralhosn.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qasralhosn.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017169; classtype:social-engineering; sid:6017169; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sucursalpersonasvirtual.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.sucursalpersonasvirtual.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017170; classtype:social-engineering; sid:6017170; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalfinanciamento.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalfinanciamento.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017171; classtype:social-engineering; sid:6017171; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j107b.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j107b.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017172; classtype:social-engineering; sid:6017172; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalcreditoprime.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalcreditoprime.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017173; classtype:social-engineering; sid:6017173; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecuadorenlinea-3237--ecuadoerdejnn.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ecuadorenlinea-3237--ecuadoerdejnn.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017174; classtype:social-engineering; sid:6017174; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (helloakansha.github.io/airbnb-project)"; flow:established,to_server; http.uri; content:"/airbnb-project"; startswith; fast_pattern; http.host; content:"helloakansha.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017175; classtype:social-engineering; sid:6017175; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dravora-gld-belqumi-r1t5hp37.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dravora-gld-belqumi-r1t5hp37.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017176; classtype:social-engineering; sid:6017176; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalgestaototal.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalgestaototal.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017177; classtype:social-engineering; sid:6017177; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centraldinheiro.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centraldinheiro.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017178; classtype:social-engineering; sid:6017178; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-lovqar-biz-trenka-medvu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-lovqar-biz-trenka-medvu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017179; classtype:social-engineering; sid:6017179; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lokalna-ofera74764345.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lokalna-ofera74764345.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017180; classtype:social-engineering; sid:6017180; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (solicidmaisvoce.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"solicidmaisvoce.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017181; classtype:social-engineering; sid:6017181; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (18098.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"18098.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017182; classtype:social-engineering; sid:6017182; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-sorqal-biz-vramik-ludzo.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-sorqal-biz-vramik-ludzo.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017183; classtype:social-engineering; sid:6017183; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (device-found.info/ycQ)"; flow:established,to_server; http.uri; content:"/ycQ"; startswith; fast_pattern; http.host; content:"device-found.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017184; classtype:social-engineering; sid:6017184; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralfinanceirodigital.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralfinanceirodigital.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017185; classtype:social-engineering; sid:6017185; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (michalsmely-del.github.io/ledger/)"; flow:established,to_server; http.uri; content:"/ledger/"; startswith; fast_pattern; http.host; content:"michalsmely-del.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017186; classtype:social-engineering; sid:6017186; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralcreditointeligente.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralcreditointeligente.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017187; classtype:social-engineering; sid:6017187; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metasmensaisparametrosdeseguranca.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"metasmensaisparametrosdeseguranca.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017188; classtype:social-engineering; sid:6017188; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17ae5ea3-1706-511d-a183-docviewer3.reynoldsjace5.workers.dev/tg5lwnq0/govsoja/)"; flow:established,to_server; http.uri; content:"/tg5lwnq0/govsoja/"; startswith; fast_pattern; http.host; content:"17ae5ea3-1706-511d-a183-docviewer3.reynoldsjace5.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017189; classtype:social-engineering; sid:6017189; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jub-ytfde.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jub-ytfde.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017190; classtype:social-engineering; sid:6017190; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (selecaoelitenu.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"selecaoelitenu.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017191; classtype:social-engineering; sid:6017191; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.appfinanciafacil.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.appfinanciafacil.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017192; classtype:social-engineering; sid:6017192; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.serrenon.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app.serrenon.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017193; classtype:social-engineering; sid:6017193; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.plataformacreditosdigital.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.plataformacreditosdigital.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017194; classtype:social-engineering; sid:6017194; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.servicoscredito.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.servicoscredito.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017195; classtype:social-engineering; sid:6017195; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-zurnex-biz-keltri-fadqo.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-zurnex-biz-keltri-fadqo.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017196; classtype:social-engineering; sid:6017196; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.beneficioscentral.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.beneficioscentral.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017197; classtype:social-engineering; sid:6017197; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (14247.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"14247.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017198; classtype:social-engineering; sid:6017198; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (morlita-gld-belquro-r8x3dk25.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"morlita-gld-belquro-r8x3dk25.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017199; classtype:social-engineering; sid:6017199; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.agorafinanciamento.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.agorafinanciamento.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017200; classtype:social-engineering; sid:6017200; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roanokethaimassage.com/yx01xa/mail%20update/crypt/index.php/)"; flow:established,to_server; http.uri; content:"/yx01xa/mail%20update/crypt/index.php/"; startswith; fast_pattern; http.host; content:"roanokethaimassage.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017201; classtype:social-engineering; sid:6017201; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralfacilcredito.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralfacilcredito.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017202; classtype:social-engineering; sid:6017202; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-parnex-biz-volska-medqu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-parnex-biz-volska-medqu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017203; classtype:social-engineering; sid:6017203; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (72231.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"72231.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017204; classtype:social-engineering; sid:6017204; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentokas01.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentokas01.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017205; classtype:social-engineering; sid:6017205; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jumbo-stable-computergame.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jumbo-stable-computergame.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017206; classtype:social-engineering; sid:6017206; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreihe6uxuzsep7huk7j6xaecynwpwzhozlasmk3a7pvipz6zof5gihy.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreihe6uxuzsep7huk7j6xaecynwpwzhozlasmk3a7pvipz6zof5gihy.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017207; classtype:social-engineering; sid:6017207; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (juy-oubv.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"juy-oubv.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017208; classtype:social-engineering; sid:6017208; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralfinanceiro.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralfinanceiro.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017209; classtype:social-engineering; sid:6017209; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralcreditoprime.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralcreditoprime.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017210; classtype:social-engineering; sid:6017210; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klavor-pintel-3l82da-brkt-krendal.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"klavor-pintel-3l82da-brkt-krendal.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017211; classtype:social-engineering; sid:6017211; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hwq-hyrws.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hwq-hyrws.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017212; classtype:social-engineering; sid:6017212; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inusual-2026importante.fwh.is/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"inusual-2026importante.fwh.is"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017213; classtype:social-engineering; sid:6017213; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (org-wlletconnect-connect.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"org-wlletconnect-connect.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017214; classtype:social-engineering; sid:6017214; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalomelhorcredito.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalomelhorcredito.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017215; classtype:social-engineering; sid:6017215; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (officialtrzre.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"officialtrzre.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017216; classtype:social-engineering; sid:6017216; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.melhorcentralcredito.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.melhorcentralcredito.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017217; classtype:social-engineering; sid:6017217; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezor.wallet-web3.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezor.wallet-web3.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017218; classtype:social-engineering; sid:6017218; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.beneficiosfinanceiros.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.beneficiosfinanceiros.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017219; classtype:social-engineering; sid:6017219; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sheratonmelbourne.spahotel.guru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sheratonmelbourne.spahotel.guru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017220; classtype:social-engineering; sid:6017220; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalfinanceiroplus.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalfinanceiroplus.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017221; classtype:social-engineering; sid:6017221; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nk.xoexfml.net/safer/safe)"; flow:established,to_server; http.uri; content:"/safer/safe"; startswith; fast_pattern; http.host; content:"nk.xoexfml.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017222; classtype:social-engineering; sid:6017222; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vormita-gld-belquro-c5x7qk27.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vormita-gld-belquro-c5x7qk27.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017223; classtype:social-engineering; sid:6017223; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-dorqex-biz-plunra-mefvi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-dorqex-biz-plunra-mefvi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017224; classtype:social-engineering; sid:6017224; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cms-sjg-cra-arcc.cfd/scpage/RBC%20Royal%20Bank%20%E2%80%93%20Secure%20Sign%20In.htm?amount=245&from=Canada+Revenue+Agency&message=+Canada+Groceries+and+Essentials+Benefit.(CGEB)&expiry=July+8)"; flow:established,to_server; http.uri; content:"/scpage/RBC%20Royal%20Bank%20%E2%80%93%20Secure%20Sign%20In.htm?amount=245&from=Canada+Revenue+Agency&message=+Canada+Groceries+and+Essentials+Benefit.(CGEB)&expiry=July+8"; startswith; fast_pattern; http.host; content:"cms-sjg-cra-arcc.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017225; classtype:social-engineering; sid:6017225; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralgestaototal.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralgestaototal.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017226; classtype:social-engineering; sid:6017226; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.appfacilcredito.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.appfacilcredito.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017227; classtype:social-engineering; sid:6017227; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (h82pl5-7ln-thoq-qq2-79bn.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"h82pl5-7ln-thoq-qq2-79bn.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017228; classtype:social-engineering; sid:6017228; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralfinanciamento.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralfinanciamento.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017229; classtype:social-engineering; sid:6017229; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (weedfreegardening.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"weedfreegardening.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017230; classtype:social-engineering; sid:6017230; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brohihafsa57-hash.github.io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"brohihafsa57-hash.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017231; classtype:social-engineering; sid:6017231; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xhdjnd.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xhdjnd.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017232; classtype:social-engineering; sid:6017232; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalfinancieroagora.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalfinancieroagora.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017233; classtype:social-engineering; sid:6017233; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalconsultadigital.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalconsultadigital.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017234; classtype:social-engineering; sid:6017234; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralservicoscentral.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralservicoscentral.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017235; classtype:social-engineering; sid:6017235; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.acessoclientes.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.acessoclientes.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017236; classtype:social-engineering; sid:6017236; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.rapidocreditocentral.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.rapidocreditocentral.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017237; classtype:social-engineering; sid:6017237; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-gurnex-biz-kraste-jomvu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-gurnex-biz-kraste-jomvu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017238; classtype:social-engineering; sid:6017238; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-horvik-biz-talren-zufmo.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-horvik-biz-talren-zufmo.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017239; classtype:social-engineering; sid:6017239; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.appfinanciamento.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.appfinanciamento.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017240; classtype:social-engineering; sid:6017240; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (onivok-wrelna-0qu61f-njbyh-4ot590.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"onivok-wrelna-0qu61f-njbyh-4ot590.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017241; classtype:social-engineering; sid:6017241; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-larnex-biz-prasto-vemqi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-larnex-biz-prasto-vemqi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017242; classtype:social-engineering; sid:6017242; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (helpnets.info/p20b7b22eq719049170938a6530oe00e9bfe.html/)"; flow:established,to_server; http.uri; content:"/p20b7b22eq719049170938a6530oe00e9bfe.html/"; startswith; fast_pattern; http.host; content:"helpnets.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017243; classtype:social-engineering; sid:6017243; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enfoqueyproduct1v1dad-2026.zya.me/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"enfoqueyproduct1v1dad-2026.zya.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017244; classtype:social-engineering; sid:6017244; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-torval-biz-freska-limdu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-torval-biz-freska-limdu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017245; classtype:social-engineering; sid:6017245; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.financeiroportal.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.financeiroportal.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017246; classtype:social-engineering; sid:6017246; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralgestaoseguro.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralgestaoseguro.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017247; classtype:social-engineering; sid:6017247; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (biglobe.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"biglobe.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017248; classtype:social-engineering; sid:6017248; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-zorval-biz-talpra-mesqi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-zorval-biz-talpra-mesqi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017249; classtype:social-engineering; sid:6017249; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vdhedheb.vercel.app/vincular.html)"; flow:established,to_server; http.uri; content:"/vincular.html"; startswith; fast_pattern; http.host; content:"vdhedheb.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017250; classtype:social-engineering; sid:6017250; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (il-whatapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"il-whatapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017251; classtype:social-engineering; sid:6017251; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-surnok-biz-talmex-jodvu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-surnok-biz-talmex-jodvu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017252; classtype:social-engineering; sid:6017252; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (patelnayan77108-max.github.io/internpractice/)"; flow:established,to_server; http.uri; content:"/internpractice/"; startswith; fast_pattern; http.host; content:"patelnayan77108-max.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017253; classtype:social-engineering; sid:6017253; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralfinanceiroplus.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralfinanceiroplus.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017254; classtype:social-engineering; sid:6017254; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (interface-instagram-one.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"interface-instagram-one.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017255; classtype:social-engineering; sid:6017255; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.creditocentralmelhor.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.creditocentralmelhor.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017256; classtype:social-engineering; sid:6017256; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eiqk-xrp1-winq.rjones-vortaxeng-us-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eiqk-xrp1-winq.rjones-vortaxeng-us-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017257; classtype:social-engineering; sid:6017257; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (formspreeguatemalashoponline.github.io/ApoyaAtuamigo/)"; flow:established,to_server; http.uri; content:"/ApoyaAtuamigo/"; startswith; fast_pattern; http.host; content:"formspreeguatemalashoponline.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017258; classtype:social-engineering; sid:6017258; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalservicosexpress.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalservicosexpress.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017259; classtype:social-engineering; sid:6017259; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (website-danaid.bantu4n.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"website-danaid.bantu4n.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017260; classtype:social-engineering; sid:6017260; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-selnex-biz-pradra-zomqi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-selnex-biz-pradra-zomqi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017261; classtype:social-engineering; sid:6017261; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralcreditorapido.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralcreditorapido.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017262; classtype:social-engineering; sid:6017262; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rlavor-bintel-db3006bnh-mrkt-grendal.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rlavor-bintel-db3006bnh-mrkt-grendal.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017263; classtype:social-engineering; sid:6017263; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalservicoscentral.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalservicoscentral.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017264; classtype:social-engineering; sid:6017264; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralseucredito.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralseucredito.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017265; classtype:social-engineering; sid:6017265; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.creditocentralfacil.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.creditocentralfacil.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017266; classtype:social-engineering; sid:6017266; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sakshitulsyan.github.io/amozon.github.io/)"; flow:established,to_server; http.uri; content:"/amozon.github.io/"; startswith; fast_pattern; http.host; content:"sakshitulsyan.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017267; classtype:social-engineering; sid:6017267; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-rarnok-biz-kaltri-jusvo.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-rarnok-biz-kaltri-jusvo.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017268; classtype:social-engineering; sid:6017268; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adithya2809.github.io/Netflix-Clone-Frontend/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone-Frontend/"; startswith; fast_pattern; http.host; content:"adithya2809.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017269; classtype:social-engineering; sid:6017269; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cms-sjg-cra-arcc.cfd/scpage/Sign%20in%20_%20Scotiabank.htm?amount=245&from=Canada+Revenue+Agency&message=+Canada+Groceries+and+Essentials+Benefit.(CGEB)&expiry=July+8)"; flow:established,to_server; http.uri; content:"/scpage/Sign%20in%20_%20Scotiabank.htm?amount=245&from=Canada+Revenue+Agency&message=+Canada+Groceries+and+Essentials+Benefit.(CGEB)&expiry=July+8"; startswith; fast_pattern; http.host; content:"cms-sjg-cra-arcc.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017270; classtype:social-engineering; sid:6017270; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rapid-mountain-517.allcompredirectportalshare.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rapid-mountain-517.allcompredirectportalshare.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017271; classtype:social-engineering; sid:6017271; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.nitol.life/Amazing/)"; flow:established,to_server; http.uri; content:"/Amazing/"; startswith; fast_pattern; http.host; content:"www.nitol.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017272; classtype:social-engineering; sid:6017272; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-ulqnor-biz-vrante-jofmu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-ulqnor-biz-vrante-jofmu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017273; classtype:social-engineering; sid:6017273; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cn.unionpay6138.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cn.unionpay6138.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017274; classtype:social-engineering; sid:6017274; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalliberarcredito.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalliberarcredito.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017275; classtype:social-engineering; sid:6017275; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-tw.tw-im-whatsapp.tw.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-tw.tw-im-whatsapp.tw.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017276; classtype:social-engineering; sid:6017276; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (solicita-tu-tarjeta-de-credito-bhd.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"solicita-tu-tarjeta-de-credito-bhd.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017277; classtype:social-engineering; sid:6017277; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (server-site--taffomersidb.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"server-site--taffomersidb.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017278; classtype:social-engineering; sid:6017278; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jinwoo30.github.io/my-ecommerce-websitee)"; flow:established,to_server; http.uri; content:"/my-ecommerce-websitee"; startswith; fast_pattern; http.host; content:"jinwoo30.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017279; classtype:social-engineering; sid:6017279; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalacessocentral.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalacessocentral.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017280; classtype:social-engineering; sid:6017280; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.project-zne9e.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.project-zne9e.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017281; classtype:social-engineering; sid:6017281; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j39e.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j39e.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017282; classtype:social-engineering; sid:6017282; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telquni-gld-varmita-c4x1dk87.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"telquni-gld-varmita-c4x1dk87.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017283; classtype:social-engineering; sid:6017283; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pemulihan-akun.acctri.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pemulihan-akun.acctri.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017284; classtype:social-engineering; sid:6017284; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.appcreditosimples.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.appcreditosimples.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017285; classtype:social-engineering; sid:6017285; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.morisshoes.it/it/content/4-chi-siamo)"; flow:established,to_server; http.uri; content:"/it/content/4-chi-siamo"; startswith; fast_pattern; http.host; content:"www.morisshoes.it"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017286; classtype:social-engineering; sid:6017286; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ernestolopes.github.io/exerc-cio/)"; flow:established,to_server; http.uri; content:"/exerc-cio/"; startswith; fast_pattern; http.host; content:"ernestolopes.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017287; classtype:social-engineering; sid:6017287; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enlineacreditecuador--creditoenlinea3.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"enlineacreditecuador--creditoenlinea3.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017288; classtype:social-engineering; sid:6017288; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-jorvex-biz-kalnix-furmo.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-jorvex-biz-kalnix-furmo.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017289; classtype:social-engineering; sid:6017289; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.678bet365.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.678bet365.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017290; classtype:social-engineering; sid:6017290; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (24eg105p46-dotcom.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"24eg105p46-dotcom.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017291; classtype:social-engineering; sid:6017291; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.acessocreditos.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.acessocreditos.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017292; classtype:social-engineering; sid:6017292; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalbeneficiosonline.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalbeneficiosonline.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017293; classtype:social-engineering; sid:6017293; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-belvar-biz-norpra-zemtu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-belvar-biz-norpra-zemtu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017294; classtype:social-engineering; sid:6017294; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coderhub-one.vercel.app/index1.html)"; flow:established,to_server; http.uri; content:"/index1.html"; startswith; fast_pattern; http.host; content:"coderhub-one.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017295; classtype:social-engineering; sid:6017295; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (https-wwv-roblox.cam/users/241551989/profile)"; flow:established,to_server; http.uri; content:"/users/241551989/profile"; startswith; fast_pattern; http.host; content:"https-wwv-roblox.cam"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017296; classtype:social-engineering; sid:6017296; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uni-test-nine.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uni-test-nine.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017297; classtype:social-engineering; sid:6017297; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tatendahjames-glitch.github.io/Ledger/)"; flow:established,to_server; http.uri; content:"/Ledger/"; startswith; fast_pattern; http.host; content:"tatendahjames-glitch.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017298; classtype:social-engineering; sid:6017298; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalcreditoagil.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalcreditoagil.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017299; classtype:social-engineering; sid:6017299; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalfiinancafacil.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalfiinancafacil.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017300; classtype:social-engineering; sid:6017300; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralliberarcredito.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralliberarcredito.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017301; classtype:social-engineering; sid:6017301; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (device-found.info/help?U4c)"; flow:established,to_server; http.uri; content:"/help?U4c"; startswith; fast_pattern; http.host; content:"device-found.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017302; classtype:social-engineering; sid:6017302; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (confirm-your-order.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"confirm-your-order.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017303; classtype:social-engineering; sid:6017303; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralcreditoapp.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralcreditoapp.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017304; classtype:social-engineering; sid:6017304; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (helpnets.info/p20b7b22eq719049170938a6530oe00e9bfe.html)"; flow:established,to_server; http.uri; content:"/p20b7b22eq719049170938a6530oe00e9bfe.html"; startswith; fast_pattern; http.host; content:"helpnets.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017305; classtype:social-engineering; sid:6017305; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.creditorapidocentral.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.creditorapidocentral.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017306; classtype:social-engineering; sid:6017306; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flow-web3-sig-claim-demo.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"flow-web3-sig-claim-demo.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017307; classtype:social-engineering; sid:6017307; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalfacilcredito.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalfacilcredito.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017308; classtype:social-engineering; sid:6017308; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralgestaovirtual.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralgestaovirtual.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017309; classtype:social-engineering; sid:6017309; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralcreditosimples.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralcreditosimples.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017310; classtype:social-engineering; sid:6017310; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (snivok-trelna-2ed83f-vjbyh-6cb712-2f9.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"snivok-trelna-2ed83f-vjbyh-6cb712-2f9.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017311; classtype:social-engineering; sid:6017311; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ulonex-fursa-a7c109-wplm-vhrr.pages.dev/welcome_aboard?welcome=100067059075094&token248=100067059075094&name_token136=Tony's%20Muziekhuis)"; flow:established,to_server; http.uri; content:"/welcome_aboard?welcome=100067059075094&token248=100067059075094&name_token136=Tony's%20Muziekhuis"; startswith; fast_pattern; http.host; content:"ulonex-fursa-a7c109-wplm-vhrr.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017312; classtype:social-engineering; sid:6017312; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.beneficiosdigitais.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.beneficiosdigitais.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017313; classtype:social-engineering; sid:6017313; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalgestaovirtual.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalgestaovirtual.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017314; classtype:social-engineering; sid:6017314; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.portalgestaoseguro.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.portalgestaoseguro.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017315; classtype:social-engineering; sid:6017315; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (im-chat-whatsapp.tw.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"im-chat-whatsapp.tw.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017316; classtype:social-engineering; sid:6017316; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralcreditoexpress.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralcreditoexpress.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017317; classtype:social-engineering; sid:6017317; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.pl-85223.click/oferta/-772683137?id=3aafecd847)"; flow:established,to_server; http.uri; content:"/oferta/-772683137?id=3aafecd847"; startswith; fast_pattern; http.host; content:"allegrolokalnie.pl-85223.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017318; classtype:social-engineering; sid:6017318; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralseucreditofacil.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralseucreditofacil.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017319; classtype:social-engineering; sid:6017319; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centralsimplesfinanciamento.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.centralsimplesfinanciamento.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017320; classtype:social-engineering; sid:6017320; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zh-app-whastapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zh-app-whastapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017321; classtype:social-engineering; sid:6017321; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-renvok-biz-talsen-jopfu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-renvok-biz-talsen-jopfu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017322; classtype:social-engineering; sid:6017322; rev:1; metadata: signature_severity Major, created_et 2026_07_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinity-voice-j74rv.daftpage.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinity-voice-j74rv.daftpage.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017323; classtype:social-engineering; sid:6017323; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bbbbbbbbtttttt.daftpage.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bbbbbbbbtttttt.daftpage.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017324; classtype:social-engineering; sid:6017324; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ja7.jp/smbc)"; flow:established,to_server; http.uri; content:"/smbc"; startswith; fast_pattern; http.host; content:"ja7.jp"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017325; classtype:social-engineering; sid:6017325; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.pl-5789127853.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalnie.pl-5789127853.sbs"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017326; classtype:social-engineering; sid:6017326; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.pl-5789127853.sbs/oferta/46138812/karta-graficzna-msi-geforce-rtx-3060-ti-gaming-z-trio)"; flow:established,to_server; http.uri; content:"/oferta/46138812/karta-graficzna-msi-geforce-rtx-3060-ti-gaming-z-trio"; startswith; fast_pattern; http.host; content:"allegrolokalnie.pl-5789127853.sbs"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017327; classtype:social-engineering; sid:6017327; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mattcomps.com/Justification/online/online-b781hj4-e0bc-4c2e-a435-97dshj6735-8645jel35/microsoft/)"; flow:established,to_server; http.uri; content:"/Justification/online/online-b781hj4-e0bc-4c2e-a435-97dshj6735-8645jel35/microsoft/"; startswith; fast_pattern; http.host; content:"www.mattcomps.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017328; classtype:social-engineering; sid:6017328; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (impoclub.com/aa/config/)"; flow:established,to_server; http.uri; content:"/aa/config/"; startswith; fast_pattern; http.host; content:"impoclub.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017329; classtype:social-engineering; sid:6017329; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.oferta735278.click/oferta/xbox-series-x-oryginalnym-opakowaniu-z-kontrolerem-i-gr%C4%85/506406612)"; flow:established,to_server; http.uri; content:"/oferta/xbox-series-x-oryginalnym-opakowaniu-z-kontrolerem-i-gr%C4%85/506406612"; startswith; fast_pattern; http.host; content:"allegrolokalnie.oferta735278.click"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017330; classtype:social-engineering; sid:6017330; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail-prefrence.daftpage.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mail-prefrence.daftpage.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017331; classtype:social-engineering; sid:6017331; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bt-b41l6.daftpage.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bt-b41l6.daftpage.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017332; classtype:social-engineering; sid:6017332; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (drenox-filda-pk3006tgb-shrr-thrr.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"drenox-filda-pk3006tgb-shrr-thrr.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017333; classtype:social-engineering; sid:6017333; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (company-notice.com/afthF6)"; flow:established,to_server; http.uri; content:"/afthF6"; startswith; fast_pattern; http.host; content:"company-notice.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017334; classtype:social-engineering; sid:6017334; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.j107c.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.j107c.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017335; classtype:social-engineering; sid:6017335; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (89429.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"89429.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017336; classtype:social-engineering; sid:6017336; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.03365bet.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.03365bet.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017337; classtype:social-engineering; sid:6017337; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agon-law.de/b/p2.html)"; flow:established,to_server; http.uri; content:"/b/p2.html"; startswith; fast_pattern; http.host; content:"agon-law.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017338; classtype:social-engineering; sid:6017338; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cpcefcd351fb9a.b-cdn.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cpcefcd351fb9a.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017339; classtype:social-engineering; sid:6017339; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bermavi-gld-zentora-c2t7dk83.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bermavi-gld-zentora-c2t7dk83.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017340; classtype:social-engineering; sid:6017340; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mgm2.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mgm2.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017341; classtype:social-engineering; sid:6017341; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17897.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17897.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017342; classtype:social-engineering; sid:6017342; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b31m.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b31m.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017343; classtype:social-engineering; sid:6017343; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (odhejm.shop/?code=Dunaei)"; flow:established,to_server; http.uri; content:"/?code=Dunaei"; startswith; fast_pattern; http.host; content:"odhejm.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017344; classtype:social-engineering; sid:6017344; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (danae.com.br/it/persone-e-famiglie/content/internetbanking/common/extra-content-login/)"; flow:established,to_server; http.uri; content:"/it/persone-e-famiglie/content/internetbanking/common/extra-content-login/"; startswith; fast_pattern; http.host; content:"danae.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017345; classtype:social-engineering; sid:6017345; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.s206d.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.s206d.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017346; classtype:social-engineering; sid:6017346; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (estigo.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"estigo.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017347; classtype:social-engineering; sid:6017347; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fortgames.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fortgames.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017348; classtype:social-engineering; sid:6017348; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.m166f.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.m166f.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017349; classtype:social-engineering; sid:6017349; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (musicaspoftiybr.store/musica/sd/)"; flow:established,to_server; http.uri; content:"/musica/sd/"; startswith; fast_pattern; http.host; content:"musicaspoftiybr.store"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017350; classtype:social-engineering; sid:6017350; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinitycomcas000.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinitycomcas000.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017351; classtype:social-engineering; sid:6017351; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b267p.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b267p.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017352; classtype:social-engineering; sid:6017352; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galabet.gadres.cam/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galabet.gadres.cam"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017353; classtype:social-engineering; sid:6017353; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cp5b41434fa99c.b-cdn.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cp5b41434fa99c.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017354; classtype:social-engineering; sid:6017354; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xlavor-bintel-3b82fc-mrkt-grendal.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xlavor-bintel-3b82fc-mrkt-grendal.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017355; classtype:social-engineering; sid:6017355; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (track-01.aaraubleibtcool.ch/ga/click/2-111462265-1511-11975-23436-12955-b45b9c05ea-0a56100b3b)"; flow:established,to_server; http.uri; content:"/ga/click/2-111462265-1511-11975-23436-12955-b45b9c05ea-0a56100b3b"; startswith; fast_pattern; http.host; content:"track-01.aaraubleibtcool.ch"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017356; classtype:social-engineering; sid:6017356; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-8395d783c3564236868f2e10fcd6fd05.r2.dev/New3_E.html)"; flow:established,to_server; http.uri; content:"/New3_E.html"; startswith; fast_pattern; http.host; content:"pub-8395d783c3564236868f2e10fcd6fd05.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017357; classtype:social-engineering; sid:6017357; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (js97.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"js97.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017358; classtype:social-engineering; sid:6017358; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-irvexa-biz-kolvra-judqo.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-irvexa-biz-kolvra-judqo.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017359; classtype:social-engineering; sid:6017359; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eng-trzzr-bridge.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eng-trzzr-bridge.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017360; classtype:social-engineering; sid:6017360; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qurnela-gld-zelmora-a6t2dk87.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qurnela-gld-zelmora-a6t2dk87.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017361; classtype:social-engineering; sid:6017361; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (avanzaringenieriaysalud.com/wp-content/d0cs/Windows/utility.php/download/download/index.php)"; flow:established,to_server; http.uri; content:"/wp-content/d0cs/Windows/utility.php/download/download/index.php"; startswith; fast_pattern; http.host; content:"avanzaringenieriaysalud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017362; classtype:social-engineering; sid:6017362; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (procesmemberrsse.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"procesmemberrsse.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017363; classtype:social-engineering; sid:6017363; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (simple-security-index--allaesthetics1.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"simple-security-index--allaesthetics1.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017364; classtype:social-engineering; sid:6017364; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (89439.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"89439.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017365; classtype:social-engineering; sid:6017365; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meetamacks_luuwingnnnn.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meetamacks_luuwingnnnn.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017366; classtype:social-engineering; sid:6017366; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.89572.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.89572.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017367; classtype:social-engineering; sid:6017367; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b31l.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b31l.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017368; classtype:social-engineering; sid:6017368; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maine-bridge.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"maine-bridge.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017369; classtype:social-engineering; sid:6017369; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-dorvex-biz-prumra-zifvu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-dorvex-biz-prumra-zifvu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017370; classtype:social-engineering; sid:6017370; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bluxxfruit.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bluxxfruit.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017371; classtype:social-engineering; sid:6017371; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.88465.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.88465.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017372; classtype:social-engineering; sid:6017372; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.g103a.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.g103a.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017373; classtype:social-engineering; sid:6017373; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.imtaken.my/download.html)"; flow:established,to_server; http.uri; content:"/download.html"; startswith; fast_pattern; http.host; content:"www.imtaken.my"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017374; classtype:social-engineering; sid:6017374; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365627.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"365627.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017375; classtype:social-engineering; sid:6017375; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p30g.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p30g.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017376; classtype:social-engineering; sid:6017376; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bamgt0i.myrdbx.io/wp-content/AAtrato/MOULzstrato/index1.html)"; flow:established,to_server; http.uri; content:"/wp-content/AAtrato/MOULzstrato/index1.html"; startswith; fast_pattern; http.host; content:"bamgt0i.myrdbx.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017377; classtype:social-engineering; sid:6017377; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (padisahbeeting.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"padisahbeeting.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017378; classtype:social-engineering; sid:6017378; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (peachexch.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"peachexch.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017379; classtype:social-engineering; sid:6017379; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17872.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17872.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017380; classtype:social-engineering; sid:6017380; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qurnavi-gld-lormeta-p3x8fw96.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qurnavi-gld-lormeta-p3x8fw96.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017381; classtype:social-engineering; sid:6017381; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (y31i.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"y31i.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017382; classtype:social-engineering; sid:6017382; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (believjilali-boop.github.io/roblox-login)"; flow:established,to_server; http.uri; content:"/roblox-login"; startswith; fast_pattern; http.host; content:"believjilali-boop.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017383; classtype:social-engineering; sid:6017383; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s30g.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"s30g.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017384; classtype:social-engineering; sid:6017384; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-index-edit--mlcrawford.replit.app/forgotpassword.html)"; flow:established,to_server; http.uri; content:"/forgotpassword.html"; startswith; fast_pattern; http.host; content:"secure-index-edit--mlcrawford.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017385; classtype:social-engineering; sid:6017385; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (claim-txt-esl-org.help/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"claim-txt-esl-org.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017386; classtype:social-engineering; sid:6017386; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flixclone-hummingbird-b93cae.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"flixclone-hummingbird-b93cae.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017387; classtype:social-engineering; sid:6017387; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wallet-web3.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wallet-web3.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017388; classtype:social-engineering; sid:6017388; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (menahilshabbir9-cmyk.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"menahilshabbir9-cmyk.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017389; classtype:social-engineering; sid:6017389; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j40j.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j40j.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017390; classtype:social-engineering; sid:6017390; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortlard.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortlard.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017391; classtype:social-engineering; sid:6017391; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uat.orderexpress.net.au/telstra/)"; flow:established,to_server; http.uri; content:"/telstra/"; startswith; fast_pattern; http.host; content:"uat.orderexpress.net.au"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017392; classtype:social-engineering; sid:6017392; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17868.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17868.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017393; classtype:social-engineering; sid:6017393; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (y37w.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"y37w.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017394; classtype:social-engineering; sid:6017394; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (macroja36dsvjhbsdjhbsdjhbjhds-a4dsfkawdgh5avh0.z01.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"macroja36dsvjhbsdjhbsdjhbjhds-a4dsfkawdgh5avh0.z01.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017395; classtype:social-engineering; sid:6017395; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vormela-gld-larquro-p8x4fq97.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vormela-gld-larquro-p8x4fq97.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017396; classtype:social-engineering; sid:6017396; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cpd0f0d11eaefc.b-cdn.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cpd0f0d11eaefc.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017397; classtype:social-engineering; sid:6017397; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreih5ihdasjbtqdnkt76nojwmgg54rmklfuve7kfm6pv2skiuipq5zm.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreih5ihdasjbtqdnkt76nojwmgg54rmklfuve7kfm6pv2skiuipq5zm.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017398; classtype:social-engineering; sid:6017398; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (simple-secure-page--terrell10d.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"simple-secure-page--terrell10d.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017399; classtype:social-engineering; sid:6017399; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (transfer-1usd-bep.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"transfer-1usd-bep.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017400; classtype:social-engineering; sid:6017400; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alsahlahotel.com/inside-it-opens-to-reveal-two-compartments-divided-by-a/)"; flow:established,to_server; http.uri; content:"/inside-it-opens-to-reveal-two-compartments-divided-by-a/"; startswith; fast_pattern; http.host; content:"alsahlahotel.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017401; classtype:social-engineering; sid:6017401; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgerr-bridge.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledgerr-bridge.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017402; classtype:social-engineering; sid:6017402; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aima.ma/renew.html)"; flow:established,to_server; http.uri; content:"/renew.html"; startswith; fast_pattern; http.host; content:"aima.ma"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017403; classtype:social-engineering; sid:6017403; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.89461.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.89461.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017404; classtype:social-engineering; sid:6017404; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (procss-membresasweib1check.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"procss-membresasweib1check.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017405; classtype:social-engineering; sid:6017405; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jlonex-fursa-a7c109-wplm-vhrr.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jlonex-fursa-a7c109-wplm-vhrr.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017406; classtype:social-engineering; sid:6017406; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sign-in-to-xfinity-101765.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sign-in-to-xfinity-101765.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017407; classtype:social-engineering; sid:6017407; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bamgt0i.myrdbx.io/wp-content/AAtrato/MOULzstrato/)"; flow:established,to_server; http.uri; content:"/wp-content/AAtrato/MOULzstrato/"; startswith; fast_pattern; http.host; content:"bamgt0i.myrdbx.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017408; classtype:social-engineering; sid:6017408; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (treezoore-bridge.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"treezoore-bridge.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017409; classtype:social-engineering; sid:6017409; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anujyad15-sudo.github.io/CloneAmazon/)"; flow:established,to_server; http.uri; content:"/CloneAmazon/"; startswith; fast_pattern; http.host; content:"anujyad15-sudo.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017410; classtype:social-engineering; sid:6017410; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auhts-bridge.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auhts-bridge.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017411; classtype:social-engineering; sid:6017411; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (morzani-gld-lormavi-a8x3fc27.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"morzani-gld-lormavi-a8x3fc27.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017412; classtype:social-engineering; sid:6017412; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pichinchamiles.id/points/)"; flow:established,to_server; http.uri; content:"/points/"; startswith; fast_pattern; http.host; content:"pichinchamiles.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017413; classtype:social-engineering; sid:6017413; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-glenza-biz-torvik-hadru.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-glenza-biz-torvik-hadru.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017414; classtype:social-engineering; sid:6017414; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jwy2-z5duq-hgw6t-cuo-yq2.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jwy2-z5duq-hgw6t-cuo-yq2.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017415; classtype:social-engineering; sid:6017415; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en-trzzer-bridge.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"en-trzzer-bridge.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017416; classtype:social-engineering; sid:6017416; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (x125i.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"x125i.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017417; classtype:social-engineering; sid:6017417; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aplicform.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aplicform.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017418; classtype:social-engineering; sid:6017418; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (betyeni2.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"betyeni2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017419; classtype:social-engineering; sid:6017419; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vrivok-nlnar-3kp04e-xjygh-6mn783.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vrivok-nlnar-3kp04e-xjygh-6mn783.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017420; classtype:social-engineering; sid:6017420; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-page-editor--melisapritt.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-page-editor--melisapritt.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017421; classtype:social-engineering; sid:6017421; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telmita-gld-larquni-p5t7hd43.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"telmita-gld-larquni-p5t7hd43.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017422; classtype:social-engineering; sid:6017422; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.candidateame.com.dcmcare.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.candidateame.com.dcmcare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017423; classtype:social-engineering; sid:6017423; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.frongivedonrousza.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.frongivedonrousza.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017424; classtype:social-engineering; sid:6017424; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.metmask_loggi.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.metmask_loggi.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017425; classtype:social-engineering; sid:6017425; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xflnltupda.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xflnltupda.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017426; classtype:social-engineering; sid:6017426; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ghjgfree.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ghjgfree.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017427; classtype:social-engineering; sid:6017427; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (berqumi-gld-zentora-c1x6qk84.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"berqumi-gld-zentora-c1x6qk84.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017428; classtype:social-engineering; sid:6017428; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bahislink6.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bahislink6.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017429; classtype:social-engineering; sid:6017429; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-ernokx-biz-pravro-zelmu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-ernokx-biz-pravro-zelmu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017430; classtype:social-engineering; sid:6017430; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (colours.hostel.town/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"colours.hostel.town"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017431; classtype:social-engineering; sid:6017431; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (by55.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"by55.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017432; classtype:social-engineering; sid:6017432; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cpb05f8779286e.b-cdn.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cpb05f8779286e.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017433; classtype:social-engineering; sid:6017433; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metanasjkloghinn.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metanasjkloghinn.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017434; classtype:social-engineering; sid:6017434; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-xurnal-biz-krelta-fimvu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-xurnal-biz-krelta-fimvu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017435; classtype:social-engineering; sid:6017435; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fifaworldcupgiveaway.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fifaworldcupgiveaway.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017436; classtype:social-engineering; sid:6017436; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (banco-bhd-creditos.hstn.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"banco-bhd-creditos.hstn.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017437; classtype:social-engineering; sid:6017437; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.galabet-resmi-giris.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.galabet-resmi-giris.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017438; classtype:social-engineering; sid:6017438; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (89457.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"89457.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017439; classtype:social-engineering; sid:6017439; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store.workshopcommunityawardsvalve.com/sharedfiles/filesdetails/id=35225482503/)"; flow:established,to_server; http.uri; content:"/sharedfiles/filesdetails/id=35225482503/"; startswith; fast_pattern; http.host; content:"store.workshopcommunityawardsvalve.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017440; classtype:social-engineering; sid:6017440; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xelvani-gld-zormela-r4x6hz81.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xelvani-gld-zormela-r4x6hz81.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017441; classtype:social-engineering; sid:6017441; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prince-0-tyagi.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"prince-0-tyagi.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017442; classtype:social-engineering; sid:6017442; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (akttyx-dnxfccily.pylterr-idxx.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"akttyx-dnxfccily.pylterr-idxx.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017443; classtype:social-engineering; sid:6017443; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sign-in-to-xfinity-111.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sign-in-to-xfinity-111.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017444; classtype:social-engineering; sid:6017444; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cpeb146781743f.b-cdn.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cpeb146781743f.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017445; classtype:social-engineering; sid:6017445; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adpflikbl.nfy.fyi/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"adpflikbl.nfy.fyi"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017446; classtype:social-engineering; sid:6017446; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kkmetamskmsk_login_u.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kkmetamskmsk_login_u.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017447; classtype:social-engineering; sid:6017447; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp724.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp724.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017448; classtype:social-engineering; sid:6017448; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.71257.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.71257.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017449; classtype:social-engineering; sid:6017449; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (u110d.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"u110d.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017450; classtype:social-engineering; sid:6017450; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metmask_loggi.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metmask_loggi.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017451; classtype:social-engineering; sid:6017451; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (renoveseumaisnovolimite.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"renoveseumaisnovolimite.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017452; classtype:social-engineering; sid:6017452; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dobro-gift.xyz/id=5947221648)"; flow:established,to_server; http.uri; content:"/id=5947221648"; startswith; fast_pattern; http.host; content:"dobro-gift.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017453; classtype:social-engineering; sid:6017453; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coinbase-perps.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coinbase-perps.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017454; classtype:social-engineering; sid:6017454; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bricsan.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bricsan.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017455; classtype:social-engineering; sid:6017455; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portlregency.spahotel.guru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"portlregency.spahotel.guru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017456; classtype:social-engineering; sid:6017456; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.89435.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.89435.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017457; classtype:social-engineering; sid:6017457; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.89458.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.89458.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017458; classtype:social-engineering; sid:6017458; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ccnatacion.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ccnatacion.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017459; classtype:social-engineering; sid:6017459; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.porcupine-dachshund-884k.squarespace.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.porcupine-dachshund-884k.squarespace.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017460; classtype:social-engineering; sid:6017460; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ajmontblanc.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ajmontblanc.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017461; classtype:social-engineering; sid:6017461; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (project1-landing-git.pages.dev/?e=example@domain.invalid&\;sui=%7Bsui%7D&\;fn=Rolf&\;ln=Herzig)"; flow:established,to_server; http.uri; content:"/?e=example@domain.invalid&|3b|sui=%7Bsui%7D&|3b|fn=Rolf&|3b|ln=Herzig"; startswith; fast_pattern; http.host; content:"project1-landing-git.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017462; classtype:social-engineering; sid:6017462; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (theeffortwelfaretrust.com/wp/index.htm)"; flow:established,to_server; http.uri; content:"/wp/index.htm"; startswith; fast_pattern; http.host; content:"theeffortwelfaretrust.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017463; classtype:social-engineering; sid:6017463; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (us_metamsika_-us.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"us_metamsika_-us.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017464; classtype:social-engineering; sid:6017464; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (morlena-gld-zartora-r1t6dp28.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"morlena-gld-zartora-r1t6dp28.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017465; classtype:social-engineering; sid:6017465; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17895.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17895.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017466; classtype:social-engineering; sid:6017466; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeethmyaaffiliate.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopeethmyaaffiliate.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017467; classtype:social-engineering; sid:6017467; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (89426.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"89426.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017468; classtype:social-engineering; sid:6017468; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.u110i.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.u110i.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017469; classtype:social-engineering; sid:6017469; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s30a.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"s30a.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017470; classtype:social-engineering; sid:6017470; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f38i.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f38i.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017471; classtype:social-engineering; sid:6017471; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-jelnok-biz-tramka-moldu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-jelnok-biz-tramka-moldu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017472; classtype:social-engineering; sid:6017472; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (661815.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"661815.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017473; classtype:social-engineering; sid:6017473; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wise-worldcup.today/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wise-worldcup.today"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017474; classtype:social-engineering; sid:6017474; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.j40g.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.j40g.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017475; classtype:social-engineering; sid:6017475; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auhatomicwallet.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auhatomicwallet.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017476; classtype:social-engineering; sid:6017476; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (candidateame.com.dcmcare.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"candidateame.com.dcmcare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017477; classtype:social-engineering; sid:6017477; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-gurnok-biz-tralvo-fimdu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-gurnok-biz-tralvo-fimdu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017478; classtype:social-engineering; sid:6017478; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.89452.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.89452.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017479; classtype:social-engineering; sid:6017479; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (varunnachimuthu-s.github.io/amazon-ecommerce-web-app/checkout.html)"; flow:established,to_server; http.uri; content:"/amazon-ecommerce-web-app/checkout.html"; startswith; fast_pattern; http.host; content:"varunnachimuthu-s.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017480; classtype:social-engineering; sid:6017480; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mathys689.github.io/Paypal/)"; flow:established,to_server; http.uri; content:"/Paypal/"; startswith; fast_pattern; http.host; content:"mathys689.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017481; classtype:social-engineering; sid:6017481; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflixfeitoaqui.com.br/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflixfeitoaqui.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017482; classtype:social-engineering; sid:6017482; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.galabet-girisiniz.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.galabet-girisiniz.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017483; classtype:social-engineering; sid:6017483; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.s30i.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.s30i.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017484; classtype:social-engineering; sid:6017484; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s30h.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"s30h.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017485; classtype:social-engineering; sid:6017485; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cp7e4af0ae804b.b-cdn.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cp7e4af0ae804b.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017486; classtype:social-engineering; sid:6017486; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17880.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17880.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017487; classtype:social-engineering; sid:6017487; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b31j.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b31j.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017488; classtype:social-engineering; sid:6017488; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (parkom.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"parkom.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017489; classtype:social-engineering; sid:6017489; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p30d.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p30d.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017490; classtype:social-engineering; sid:6017490; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (esl-org-claims-txt.help/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"esl-org-claims-txt.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017491; classtype:social-engineering; sid:6017491; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rpyschool-ui.github.io/insta/)"; flow:established,to_server; http.uri; content:"/insta/"; startswith; fast_pattern; http.host; content:"rpyschool-ui.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017492; classtype:social-engineering; sid:6017492; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qurnavo-gld-zelmari-a7x8dw31.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qurnavo-gld-zelmari-a7x8dw31.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017493; classtype:social-engineering; sid:6017493; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bervani-gld-zarqumi-r2x6hz83.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bervani-gld-zarqumi-r2x6hz83.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017494; classtype:social-engineering; sid:6017494; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bxstiani.github.io/netflix-clone/index2.html)"; flow:established,to_server; http.uri; content:"/netflix-clone/index2.html"; startswith; fast_pattern; http.host; content:"bxstiani.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017495; classtype:social-engineering; sid:6017495; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamaslogien.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metamaslogien.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017496; classtype:social-engineering; sid:6017496; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.88446.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.88446.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017497; classtype:social-engineering; sid:6017497; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebookfb.cyou/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebookfb.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017498; classtype:social-engineering; sid:6017498; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.us_metamsika_-us.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.us_metamsika_-us.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017499; classtype:social-engineering; sid:6017499; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m166a.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m166a.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017500; classtype:social-engineering; sid:6017500; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imtkone.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"imtkone.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017501; classtype:social-engineering; sid:6017501; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jvi.ojd.mybluehost.me/wp-admin/maint/loginschwinze/?token=)"; flow:established,to_server; http.uri; content:"/wp-admin/maint/loginschwinze/?token="; startswith; fast_pattern; http.host; content:"jvi.ojd.mybluehost.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017502; classtype:social-engineering; sid:6017502; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (htpps-www-roblox.com/users/909139181/profile)"; flow:established,to_server; http.uri; content:"/users/909139181/profile"; startswith; fast_pattern; http.host; content:"htpps-www-roblox.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017503; classtype:social-engineering; sid:6017503; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pontefinance.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pontefinance.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017504; classtype:social-engineering; sid:6017504; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.88680.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.88680.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017505; classtype:social-engineering; sid:6017505; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.88764.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.88764.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017506; classtype:social-engineering; sid:6017506; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (test.solutioncata.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"test.solutioncata.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017507; classtype:social-engineering; sid:6017507; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iygfrety.df14dfq-dnqofhjoqfh.com:15681/?inviteCode=64298&cid=118)"; flow:established,to_server; http.uri; content:"/?inviteCode=64298&cid=118"; startswith; fast_pattern; http.host; content:"iygfrety.df14dfq-dnqofhjoqfh.com:15681"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017508; classtype:social-engineering; sid:6017508; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ppayargentina.com/login/yahoo/)"; flow:established,to_server; http.uri; content:"/login/yahoo/"; startswith; fast_pattern; http.host; content:"ppayargentina.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017509; classtype:social-engineering; sid:6017509; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (esl-org-claim-txt.help/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"esl-org-claim-txt.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017510; classtype:social-engineering; sid:6017510; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j110l.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j110l.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017511; classtype:social-engineering; sid:6017511; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (h5-chat-whatsapp.tw.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"h5-chat-whatsapp.tw.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017512; classtype:social-engineering; sid:6017512; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.89451.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.89451.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017513; classtype:social-engineering; sid:6017513; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.g103j.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.g103j.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017514; classtype:social-engineering; sid:6017514; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (horny-honey.online/click.php?key=0bbrv2yn6n2cz03owl0h&ext=gecg0b2gX206eXd2eeXie05X2b55id33ff44JaghcabfcfdJbg0i0hJeciegffJdghacedJdgidgefJhd0Ja00JfJiiiiJb0bJbe&v1=c11001&v2=270908&v3=5395766&v4=4781354_4794756&v5=US_5&v6=mobile%20phone&v7=android&v8=9999&v9=4781354&v10=4794756)"; flow:established,to_server; http.uri; content:"/click.php?key=0bbrv2yn6n2cz03owl0h&ext=gecg0b2gX206eXd2eeXie05X2b55id33ff44JaghcabfcfdJbg0i0hJeciegffJdghacedJdgidgefJhd0Ja00JfJiiiiJb0bJbe&v1=c11001&v2=270908&v3=5395766&v4=4781354_4794756&v5=US_5&v6=mobile%20phone&v7=android&v8=9999&v9=4781354&v10=4794756"; startswith; fast_pattern; http.host; content:"horny-honey.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017515; classtype:social-engineering; sid:6017515; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s29x.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"s29x.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017516; classtype:social-engineering; sid:6017516; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telvora-gld-belmita-c1x9dk42.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"telvora-gld-belmita-c1x9dk42.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017517; classtype:social-engineering; sid:6017517; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16376.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16376.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017518; classtype:social-engineering; sid:6017518; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p30f.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p30f.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017519; classtype:social-engineering; sid:6017519; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b73223085-49c6-4dca-a2f1-4722014079fb-dpi4fgipupcs.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b73223085-49c6-4dca-a2f1-4722014079fb-dpi4fgipupcs.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017520; classtype:social-engineering; sid:6017520; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verificcmsn365avisofinal.fwh.is/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"verificcmsn365avisofinal.fwh.is"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017521; classtype:social-engineering; sid:6017521; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (craxil-nomber-lh3006vfr-kthn-dravik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"craxil-nomber-lh3006vfr-kthn-dravik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017522; classtype:social-engineering; sid:6017522; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (new-land1.testamentenligne.info/Q0g0MS1OMTUxNS1EMDkwNjA2/?u=161C1515&\;e=example.agb%2540domain.invalid&\;s3=Rolf&\;s4=Herzig&\;s5=&\;s6=&\;s7=&\;s8=)"; flow:established,to_server; http.uri; content:"/Q0g0MS1OMTUxNS1EMDkwNjA2/?u=161C1515&|3b|e=example.agb%2540domain.invalid&|3b|s3=Rolf&|3b|s4=Herzig&|3b|s5=&|3b|s6=&|3b|s7=&|3b|s8="; startswith; fast_pattern; http.host; content:"new-land1.testamentenligne.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017523; classtype:social-engineering; sid:6017523; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vormita-gld-zelmira-c2x8qk35.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vormita-gld-zelmira-c2x8qk35.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017524; classtype:social-engineering; sid:6017524; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (malhotraanmol1112-cell.github.io/amazonclone/)"; flow:established,to_server; http.uri; content:"/amazonclone/"; startswith; fast_pattern; http.host; content:"malhotraanmol1112-cell.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017525; classtype:social-engineering; sid:6017525; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ary12ansaini-cyber.github.io/NETFLIX-WEBSITE-CLONE-HTML-CSS-/)"; flow:established,to_server; http.uri; content:"/NETFLIX-WEBSITE-CLONE-HTML-CSS-/"; startswith; fast_pattern; http.host; content:"ary12ansaini-cyber.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017526; classtype:social-engineering; sid:6017526; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (armoniaholidayvillage.spahotel.guru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"armoniaholidayvillage.spahotel.guru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017527; classtype:social-engineering; sid:6017527; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.checkrobuxheree.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.checkrobuxheree.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017528; classtype:social-engineering; sid:6017528; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tax.s.gy/sars.gov)"; flow:established,to_server; http.uri; content:"/sars.gov"; startswith; fast_pattern; http.host; content:"tax.s.gy"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017529; classtype:social-engineering; sid:6017529; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vianatrademarkcollectionbywyndham.spahotel.guru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vianatrademarkcollectionbywyndham.spahotel.guru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017530; classtype:social-engineering; sid:6017530; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (90426.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"90426.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017531; classtype:social-engineering; sid:6017531; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cgyfinitya80is.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cgyfinitya80is.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017532; classtype:social-engineering; sid:6017532; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (procss-membresiawebidcheks.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"procss-membresiawebidcheks.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017533; classtype:social-engineering; sid:6017533; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-zervax-biz-klamto-fomvu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-zervax-biz-klamto-fomvu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017534; classtype:social-engineering; sid:6017534; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bubblecrate.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bubblecrate.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017535; classtype:social-engineering; sid:6017535; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamask_usa_logiwiki.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metamask_usa_logiwiki.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017536; classtype:social-engineering; sid:6017536; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j40n.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j40n.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017537; classtype:social-engineering; sid:6017537; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-yornex-biz-kelvro-jidmu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-yornex-biz-kelvro-jidmu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017538; classtype:social-engineering; sid:6017538; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hayleymedia.icedre.com/user/verify-access/)"; flow:established,to_server; http.uri; content:"/user/verify-access/"; startswith; fast_pattern; http.host; content:"hayleymedia.icedre.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017539; classtype:social-engineering; sid:6017539; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (topupgaminglobal.web.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"topupgaminglobal.web.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017540; classtype:social-engineering; sid:6017540; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galabet-club.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galabet-club.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017541; classtype:social-engineering; sid:6017541; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uspsaunitedworkforce.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uspsaunitedworkforce.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017542; classtype:social-engineering; sid:6017542; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kkmetamskmsk_login_u.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kkmetamskmsk_login_u.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017543; classtype:social-engineering; sid:6017543; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-holqar-biz-prusna-zemfi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-holqar-biz-prusna-zemfi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017544; classtype:social-engineering; sid:6017544; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t0kqwl.ujsaj.lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"t0kqwl.ujsaj.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017545; classtype:social-engineering; sid:6017545; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shwetashwe2703-glitch.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"shwetashwe2703-glitch.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017546; classtype:social-engineering; sid:6017546; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bancraft.eu/htdocs/)"; flow:established,to_server; http.uri; content:"/htdocs/"; startswith; fast_pattern; http.host; content:"bancraft.eu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017547; classtype:social-engineering; sid:6017547; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (primes.app.bill.serv.0auth.pymnt.129-121-85-54.cpanel.site/etmin/desktop)"; flow:established,to_server; http.uri; content:"/etmin/desktop"; startswith; fast_pattern; http.host; content:"primes.app.bill.serv.0auth.pymnt.129-121-85-54.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017548; classtype:social-engineering; sid:6017548; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reaccessmentatoworkforce.digital/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"reaccessmentatoworkforce.digital"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017549; classtype:social-engineering; sid:6017549; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (marvelous-growth-159626.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"marvelous-growth-159626.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017550; classtype:social-engineering; sid:6017550; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cmcomcast2025.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cmcomcast2025.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017551; classtype:social-engineering; sid:6017551; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.agon-law.de/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.agon-law.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017552; classtype:social-engineering; sid:6017552; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oh32jq-kr0a-lz2-97tg-ujqo.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"oh32jq-kr0a-lz2-97tg-ujqo.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017553; classtype:social-engineering; sid:6017553; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (starlit-khapse-19cf9d.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"starlit-khapse-19cf9d.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017554; classtype:social-engineering; sid:6017554; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.0198969230.cfd/oferta/sprzedam-motocykl-wsk-1983r/03690)"; flow:established,to_server; http.uri; content:"/oferta/sprzedam-motocykl-wsk-1983r/03690"; startswith; fast_pattern; http.host; content:"allegrolokalnie.0198969230.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017555; classtype:social-engineering; sid:6017555; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (w86365.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"w86365.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017556; classtype:social-engineering; sid:6017556; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qurnela-gld-zelmora-a6t2dk87.pages.dev/thn-yjm-uio-lkh?welcome=1183735991491400&stt=1183735991491400&name_stt=Harlow's%20Charter%20Bus%20Service)"; flow:established,to_server; http.uri; content:"/thn-yjm-uio-lkh?welcome=1183735991491400&stt=1183735991491400&name_stt=Harlow's%20Charter%20Bus%20Service"; startswith; fast_pattern; http.host; content:"qurnela-gld-zelmora-a6t2dk87.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017557; classtype:social-engineering; sid:6017557; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (skinsure.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"skinsure.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017558; classtype:social-engineering; sid:6017558; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-curnaq-biz-trivko-jasqi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-curnaq-biz-trivko-jasqi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017559; classtype:social-engineering; sid:6017559; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.x125e.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.x125e.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017560; classtype:social-engineering; sid:6017560; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dextuda.ru/rbx1000/)"; flow:established,to_server; http.uri; content:"/rbx1000/"; startswith; fast_pattern; http.host; content:"www.dextuda.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017561; classtype:social-engineering; sid:6017561; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.88443.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.88443.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017562; classtype:social-engineering; sid:6017562; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeethmyaaffiliate.net/user/login)"; flow:established,to_server; http.uri; content:"/user/login"; startswith; fast_pattern; http.host; content:"shopeethmyaaffiliate.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017563; classtype:social-engineering; sid:6017563; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (new2eorzyrenewsubscriptionnow.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"new2eorzyrenewsubscriptionnow.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017564; classtype:social-engineering; sid:6017564; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.f248k.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.f248k.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017565; classtype:social-engineering; sid:6017565; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.89414.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.89414.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017566; classtype:social-engineering; sid:6017566; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wlavor-bintel-rf3006bnh-mrkt-grendal.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wlavor-bintel-rf3006bnh-mrkt-grendal.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017567; classtype:social-engineering; sid:6017567; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-yorvax-biz-tranvo-julfi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-yorvax-biz-tranvo-julfi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017568; classtype:social-engineering; sid:6017568; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bermita-gld-zarqula-r5x8hz21.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bermita-gld-zarqula-r5x8hz21.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017569; classtype:social-engineering; sid:6017569; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.metamask_usa_logiwiki.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.metamask_usa_logiwiki.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017570; classtype:social-engineering; sid:6017570; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.com-isupport.help/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.com-isupport.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017571; classtype:social-engineering; sid:6017571; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ss87365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ss87365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017572; classtype:social-engineering; sid:6017572; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (forthb.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"forthb.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017573; classtype:social-engineering; sid:6017573; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.1177ylg.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.1177ylg.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017574; classtype:social-engineering; sid:6017574; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (y31g.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"y31g.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017575; classtype:social-engineering; sid:6017575; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-balvok-biz-krosna-femdu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-balvok-biz-krosna-femdu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017576; classtype:social-engineering; sid:6017576; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ing.h5-chat-whatsapp.tw.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ing.h5-chat-whatsapp.tw.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017577; classtype:social-engineering; sid:6017577; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-lurnex-biz-kralto-femvu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-lurnex-biz-kralto-femvu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017578; classtype:social-engineering; sid:6017578; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cp5c4b6bc2f3d4.b-cdn.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cp5c4b6bc2f3d4.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017579; classtype:social-engineering; sid:6017579; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17901.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17901.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017580; classtype:social-engineering; sid:6017580; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (k6w1n8p4r9x2.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"k6w1n8p4r9x2.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017581; classtype:social-engineering; sid:6017581; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (x125d.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"x125d.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017582; classtype:social-engineering; sid:6017582; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (y226q.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"y226q.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017583; classtype:social-engineering; sid:6017583; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (89447.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"89447.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017584; classtype:social-engineering; sid:6017584; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (globesourced.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"globesourced.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017585; classtype:social-engineering; sid:6017585; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (royal-security-hub-profile-privacy-questions-upgrade.vograc.com/signon/lgn.php?signin_RBC=30Q0567DLQ8BVKEI98CZS2XOKSSXIGYIP7KTW6XGE2IZVLSM5ITQF9EMDEV0R6RYV86FZA7RLRGMH2R41CGEBBU1T6BANVJZFG2Q3MS0S79K249EFWIP7W6N9QJYF-8S934P76OSE280JKA41KFQ50TD7LJWYAW8PFF9N7A1LJWBXNI7QLKLL5ELQZHACLTF2113SSV5A2MXUB4XPQY205X8FSR8QJJRH8BQA6EWC9XB8)"; flow:established,to_server; http.uri; content:"/signon/lgn.php?signin_RBC=30Q0567DLQ8BVKEI98CZS2XOKSSXIGYIP7KTW6XGE2IZVLSM5ITQF9EMDEV0R6RYV86FZA7RLRGMH2R41CGEBBU1T6BANVJZFG2Q3MS0S79K249EFWIP7W6N9QJYF-8S934P76OSE280JKA41KFQ50TD7LJWYAW8PFF9N7A1LJWBXNI7QLKLL5ELQZHACLTF2113SSV5A2MXUB4XPQY205X8FSR8QJJRH8BQA6EWC9XB8"; startswith; fast_pattern; http.host; content:"royal-security-hub-profile-privacy-questions-upgrade.vograc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017586; classtype:social-engineering; sid:6017586; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17878.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17878.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017587; classtype:social-engineering; sid:6017587; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metasdloggiien.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metasdloggiien.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017588; classtype:social-engineering; sid:6017588; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bricsan.com/user/verify-access)"; flow:established,to_server; http.uri; content:"/user/verify-access"; startswith; fast_pattern; http.host; content:"www.bricsan.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017589; classtype:social-engineering; sid:6017589; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rlonex-fursa-a7c109-wplm.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rlonex-fursa-a7c109-wplm.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017590; classtype:social-engineering; sid:6017590; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (varunnachimuthu-s.github.io/amazon-ecommerce-web-app/orders.html)"; flow:established,to_server; http.uri; content:"/amazon-ecommerce-web-app/orders.html"; startswith; fast_pattern; http.host; content:"varunnachimuthu-s.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017591; classtype:social-engineering; sid:6017591; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xxvmcc5m.daftpage.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xxvmcc5m.daftpage.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017592; classtype:social-engineering; sid:6017592; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2026-07-05.sqllq.com/en/?howtosuecslplasma.org#nolanguage)"; flow:established,to_server; http.uri; content:"/en/?howtosuecslplasma.org#nolanguage"; startswith; fast_pattern; http.host; content:"2026-07-05.sqllq.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017593; classtype:social-engineering; sid:6017593; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokainie.oferta383462.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokainie.oferta383462.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017594; classtype:social-engineering; sid:6017594; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (at-t-4lo1l.daftpage.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"at-t-4lo1l.daftpage.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017595; classtype:social-engineering; sid:6017595; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (formlab.au/-/)"; flow:established,to_server; http.uri; content:"/-/"; startswith; fast_pattern; http.host; content:"formlab.au"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017596; classtype:social-engineering; sid:6017596; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (checkersin.daftpage.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"checkersin.daftpage.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017597; classtype:social-engineering; sid:6017597; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stationnement-antai-gouv-infractions.kurvex.sk/fr/facture-electronique/dossie/fr-fr/redirect???%5BUUID%5D)"; flow:established,to_server; http.uri; content:"/fr/facture-electronique/dossie/fr-fr/redirect???%5BUUID%5D"; startswith; fast_pattern; http.host; content:"stationnement-antai-gouv-infractions.kurvex.sk"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017598; classtype:social-engineering; sid:6017598; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bt-email-update-hb83v.daftpage.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bt-email-update-hb83v.daftpage.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017599; classtype:social-engineering; sid:6017599; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coincommunity-ta.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coincommunity-ta.netlify.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017600; classtype:social-engineering; sid:6017600; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (talktalk-admin-u32j3.daftpage.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"talktalk-admin-u32j3.daftpage.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017601; classtype:social-engineering; sid:6017601; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suciver.cc/uy)"; flow:established,to_server; http.uri; content:"/uy"; startswith; fast_pattern; http.host; content:"suciver.cc"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017602; classtype:social-engineering; sid:6017602; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie.pl-83012.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.pl-83012.sbs"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017603; classtype:social-engineering; sid:6017603; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sbc-carid.vpass.smcbnokkianesia.com/mem1/oshiharai1/index-jsp-dk=hp_006_0021919_hd1)"; flow:established,to_server; http.uri; content:"/mem1/oshiharai1/index-jsp-dk=hp_006_0021919_hd1"; startswith; fast_pattern; http.host; content:"sbc-carid.vpass.smcbnokkianesia.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017604; classtype:social-engineering; sid:6017604; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (entailglobal.com/app)"; flow:established,to_server; http.uri; content:"/app"; startswith; fast_pattern; http.host; content:"entailglobal.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017605; classtype:social-engineering; sid:6017605; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mastevbcs.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mastevbcs.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017606; classtype:social-engineering; sid:6017606; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.team-p.my/p/ldfx-fupn/wtoihdnb)"; flow:established,to_server; http.uri; content:"/p/ldfx-fupn/wtoihdnb"; startswith; fast_pattern; http.host; content:"s.team-p.my"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017607; classtype:social-engineering; sid:6017607; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bet9837.com/wp-admin/)"; flow:established,to_server; http.uri; content:"/wp-admin/"; startswith; fast_pattern; http.host; content:"www.bet9837.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017608; classtype:social-engineering; sid:6017608; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abhishektyagipro.github.io/Netflix-Clone)"; flow:established,to_server; http.uri; content:"/Netflix-Clone"; startswith; fast_pattern; http.host; content:"abhishektyagipro.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017609; classtype:social-engineering; sid:6017609; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qarnex-pulto-8ac913-hfbb.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qarnex-pulto-8ac913-hfbb.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017610; classtype:social-engineering; sid:6017610; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.72597.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.72597.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017611; classtype:social-engineering; sid:6017611; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verification-record-hub.pages.dev/ads-center/)"; flow:established,to_server; http.uri; content:"/ads-center/"; startswith; fast_pattern; http.host; content:"verification-record-hub.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017612; classtype:social-engineering; sid:6017612; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jourakolpol.alwaysdata.net/u/)"; flow:established,to_server; http.uri; content:"/u/"; startswith; fast_pattern; http.host; content:"jourakolpol.alwaysdata.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017613; classtype:social-engineering; sid:6017613; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebooklende.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebooklende.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017614; classtype:social-engineering; sid:6017614; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-17unme5eo-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-17unme5eo-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017615; classtype:social-engineering; sid:6017615; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2025-bcsit-152-sudo.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"2025-bcsit-152-sudo.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017616; classtype:social-engineering; sid:6017616; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.team-ft.com/p/fhtb-mrgw/nwjrmgwv/)"; flow:established,to_server; http.uri; content:"/p/fhtb-mrgw/nwjrmgwv/"; startswith; fast_pattern; http.host; content:"s.team-ft.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017617; classtype:social-engineering; sid:6017617; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pp99990009999.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pp99990009999.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017618; classtype:social-engineering; sid:6017618; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kraxil-fomber-3o92lm-vthn-pravik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kraxil-fomber-3o92lm-vthn-pravik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017619; classtype:social-engineering; sid:6017619; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezorsuite.app-wallett.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezorsuite.app-wallett.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017620; classtype:social-engineering; sid:6017620; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moz-extension-getstarted-coinbase-extension.pages.dev/select)"; flow:established,to_server; http.uri; content:"/select"; startswith; fast_pattern; http.host; content:"moz-extension-getstarted-coinbase-extension.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017621; classtype:social-engineering; sid:6017621; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-61iaa4ldn-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-61iaa4ldn-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017622; classtype:social-engineering; sid:6017622; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (musrat001.github.io/netflexClone)"; flow:established,to_server; http.uri; content:"/netflexClone"; startswith; fast_pattern; http.host; content:"musrat001.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017623; classtype:social-engineering; sid:6017623; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (norzani-gld-felmora-p4t8hz96.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"norzani-gld-felmora-p4t8hz96.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017624; classtype:social-engineering; sid:6017624; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-nh8cagtat-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-nh8cagtat-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017625; classtype:social-engineering; sid:6017625; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-gqlf07hkp-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-gqlf07hkp-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017626; classtype:social-engineering; sid:6017626; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dirge-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dirge-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017627; classtype:social-engineering; sid:6017627; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (manson9078-blip.github.io/ledger/)"; flow:established,to_server; http.uri; content:"/ledger/"; startswith; fast_pattern; http.host; content:"manson9078-blip.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017628; classtype:social-engineering; sid:6017628; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whatsapp724.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whatsapp724.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017629; classtype:social-engineering; sid:6017629; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16385.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16385.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017630; classtype:social-engineering; sid:6017630; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (getkeyoffer.com/?dmn=netfflix.us&tkn=dc435HWc)"; flow:established,to_server; http.uri; content:"/?dmn=netfflix.us&tkn=dc435HWc"; startswith; fast_pattern; http.host; content:"getkeyoffer.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017631; classtype:social-engineering; sid:6017631; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (de.konto-versicherung.com/blocked)"; flow:established,to_server; http.uri; content:"/blocked"; startswith; fast_pattern; http.host; content:"de.konto-versicherung.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017632; classtype:social-engineering; sid:6017632; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.18073.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.18073.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017633; classtype:social-engineering; sid:6017633; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (18073.xyz/lander)"; flow:established,to_server; http.uri; content:"/lander"; startswith; fast_pattern; http.host; content:"18073.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017634; classtype:social-engineering; sid:6017634; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (haduoq-whehe.net/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"haduoq-whehe.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017635; classtype:social-engineering; sid:6017635; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (scans-2btrjks226shte1cigsd9su1dvvv.logsisall.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"scans-2btrjks226shte1cigsd9su1dvvv.logsisall.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017636; classtype:social-engineering; sid:6017636; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5300samhouston.com/Xfinity/)"; flow:established,to_server; http.uri; content:"/Xfinity/"; startswith; fast_pattern; http.host; content:"5300samhouston.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017637; classtype:social-engineering; sid:6017637; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pancakeswapfinances.pages.dev/s.@2.webp/)"; flow:established,to_server; http.uri; content:"/s.@2.webp/"; startswith; fast_pattern; http.host; content:"pancakeswapfinances.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017638; classtype:social-engineering; sid:6017638; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-git-henryharris-com2-1748-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-git-henryharris-com2-1748-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017639; classtype:social-engineering; sid:6017639; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sejalguptagr-maker.github.io/amazone-clone/)"; flow:established,to_server; http.uri; content:"/amazone-clone/"; startswith; fast_pattern; http.host; content:"sejalguptagr-maker.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017640; classtype:social-engineering; sid:6017640; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365626.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"365626.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017641; classtype:social-engineering; sid:6017641; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (itauempresas30horas.likescandy.com/home.html)"; flow:established,to_server; http.uri; content:"/home.html"; startswith; fast_pattern; http.host; content:"itauempresas30horas.likescandy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017642; classtype:social-engineering; sid:6017642; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sbogovtr.com/basvuru.php)"; flow:established,to_server; http.uri; content:"/basvuru.php"; startswith; fast_pattern; http.host; content:"sbogovtr.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017643; classtype:social-engineering; sid:6017643; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vnivok-trelna-2ed83f-vjbyh-6cb712-a2a.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vnivok-trelna-2ed83f-vjbyh-6cb712-a2a.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017644; classtype:social-engineering; sid:6017644; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365607.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"365607.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017645; classtype:social-engineering; sid:6017645; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shop.tiktok-shop.cloud/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shop.tiktok-shop.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017646; classtype:social-engineering; sid:6017646; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cdmx-bud.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cdmx-bud.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017647; classtype:social-engineering; sid:6017647; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-varnok-biz-tramka-jomqi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-varnok-biz-tramka-jomqi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017648; classtype:social-engineering; sid:6017648; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylaterz.jqxc.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylaterz.jqxc.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017649; classtype:social-engineering; sid:6017649; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (btczzusdt.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"btczzusdt.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017650; classtype:social-engineering; sid:6017650; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-o8bjttdzi-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-o8bjttdzi-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017651; classtype:social-engineering; sid:6017651; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klavor-pintel-4b82fc-mrkt-grendal.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"klavor-pintel-4b82fc-mrkt-grendal.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017652; classtype:social-engineering; sid:6017652; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rahul80055.github.io/Amazon-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-clone/"; startswith; fast_pattern; http.host; content:"rahul80055.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017653; classtype:social-engineering; sid:6017653; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cigaretteswhilelisteningtomusic.github.io/instagram/)"; flow:established,to_server; http.uri; content:"/instagram/"; startswith; fast_pattern; http.host; content:"cigaretteswhilelisteningtomusic.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017654; classtype:social-engineering; sid:6017654; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j99w.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j99w.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017655; classtype:social-engineering; sid:6017655; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nytout-wrdaf.com/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"nytout-wrdaf.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017656; classtype:social-engineering; sid:6017656; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p7o-yb7jq-74o-n1qaw-17d7.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p7o-yb7jq-74o-n1qaw-17d7.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017657; classtype:social-engineering; sid:6017657; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hrivok-selnar-1fd82e-njygh-4ab561.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hrivok-selnar-1fd82e-njygh-4ab561.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017658; classtype:social-engineering; sid:6017658; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (invoice-adobe-us.s3.us-east-1.amazonaws.com/abobe648bviuebvri4houbdlkf+v\;l/invoice-adobe-us+u4g67ft8437g8yvwbiyebvy8egr87vg)"; flow:established,to_server; http.uri; content:"/abobe648bviuebvri4houbdlkf+v|3b|l/invoice-adobe-us+u4g67ft8437g8yvwbiyebvy8egr87vg"; startswith; fast_pattern; http.host; content:"invoice-adobe-us.s3.us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017659; classtype:social-engineering; sid:6017659; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pxjsjm.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pxjsjm.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017660; classtype:social-engineering; sid:6017660; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b47l.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b47l.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017661; classtype:social-engineering; sid:6017661; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cnivok-krelna-mk3006tgb-bjbyh-2ch378.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cnivok-krelna-mk3006tgb-bjbyh-2ch378.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017662; classtype:social-engineering; sid:6017662; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help-trizer-suit.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"help-trizer-suit.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017663; classtype:social-engineering; sid:6017663; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nzdbmd-a2seg-3whto-c2g48m.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nzdbmd-a2seg-3whto-c2g48m.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017664; classtype:social-engineering; sid:6017664; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metumaskk_lognn.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metumaskk_lognn.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017665; classtype:social-engineering; sid:6017665; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rupkathahere06.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"rupkathahere06.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017666; classtype:social-engineering; sid:6017666; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebocks.com.vn/cantimgapnguoinayngaycohautaa?a&l)"; flow:established,to_server; http.uri; content:"/cantimgapnguoinayngaycohautaa?a&l"; startswith; fast_pattern; http.host; content:"facebocks.com.vn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017667; classtype:social-engineering; sid:6017667; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-jql3k2i1g-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-jql3k2i1g-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017668; classtype:social-engineering; sid:6017668; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (h32c.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"h32c.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017669; classtype:social-engineering; sid:6017669; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (validaciionlive.fwh.is/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"validaciionlive.fwh.is"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017670; classtype:social-engineering; sid:6017670; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atualizacaonecessaria.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"atualizacaonecessaria.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017671; classtype:social-engineering; sid:6017671; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-dcla69ceg-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-dcla69ceg-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017672; classtype:social-engineering; sid:6017672; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telquna-gld-felmora-p2t7hd69.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"telquna-gld-felmora-p2t7hd69.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017673; classtype:social-engineering; sid:6017673; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tregor-bridge.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tregor-bridge.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017674; classtype:social-engineering; sid:6017674; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (berzora-gld-larqumi-c4t3fp92.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"berzora-gld-larqumi-c4t3fp92.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017675; classtype:social-engineering; sid:6017675; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m7iw-jm46-y3dz.everton-silva-farmrio-com-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m7iw-jm46-y3dz.everton-silva-farmrio-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017676; classtype:social-engineering; sid:6017676; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflixhasnohomepage.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflixhasnohomepage.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017677; classtype:social-engineering; sid:6017677; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toony29-ship-it.github.io/Ledger/)"; flow:established,to_server; http.uri; content:"/Ledger/"; startswith; fast_pattern; http.host; content:"toony29-ship-it.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017678; classtype:social-engineering; sid:6017678; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usrajbrar-code.github.io/Netflix-clone)"; flow:established,to_server; http.uri; content:"/Netflix-clone"; startswith; fast_pattern; http.host; content:"usrajbrar-code.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017679; classtype:social-engineering; sid:6017679; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bybltix.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bybltix.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017680; classtype:social-engineering; sid:6017680; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-felvax-biz-krante-josqi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-felvax-biz-krante-josqi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017681; classtype:social-engineering; sid:6017681; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-git-kristammoffett-culkin-com2-3c5240-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-git-kristammoffett-culkin-com2-3c5240-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017682; classtype:social-engineering; sid:6017682; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (x32i.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"x32i.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017683; classtype:social-engineering; sid:6017683; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qlonex-fursa-a7c109-wplm.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qlonex-fursa-a7c109-wplm.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017684; classtype:social-engineering; sid:6017684; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bashful-championship-889678.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bashful-championship-889678.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017685; classtype:social-engineering; sid:6017685; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (granthi-manjothkaur.github.io/netflix-homepage-clone/)"; flow:established,to_server; http.uri; content:"/netflix-homepage-clone/"; startswith; fast_pattern; http.host; content:"granthi-manjothkaur.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017686; classtype:social-engineering; sid:6017686; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (encouraging-selfie-733175.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"encouraging-selfie-733175.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017687; classtype:social-engineering; sid:6017687; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-8nbxkcgb9-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-8nbxkcgb9-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017688; classtype:social-engineering; sid:6017688; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mycmportal-juni-omdoor.shop/website_mirror/www.netflix.com/login.html)"; flow:established,to_server; http.uri; content:"/website_mirror/www.netflix.com/login.html"; startswith; fast_pattern; http.host; content:"mycmportal-juni-omdoor.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017689; classtype:social-engineering; sid:6017689; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pwn1i-7mx-e83-7be-za3yks.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pwn1i-7mx-e83-7be-za3yks.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017690; classtype:social-engineering; sid:6017690; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j98n.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j98n.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017691; classtype:social-engineering; sid:6017691; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j107a.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j107a.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017692; classtype:social-engineering; sid:6017692; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (servicios-digitales.alwaysdata.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"servicios-digitales.alwaysdata.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017693; classtype:social-engineering; sid:6017693; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (030-zulassungsdienst-berlin.de/swch/swisspass-v4/ch/)"; flow:established,to_server; http.uri; content:"/swch/swisspass-v4/ch/"; startswith; fast_pattern; http.host; content:"030-zulassungsdienst-berlin.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017694; classtype:social-engineering; sid:6017694; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (riyakhandelwal19.github.io/amazon-clone/Giftcard.html)"; flow:established,to_server; http.uri; content:"/amazon-clone/Giftcard.html"; startswith; fast_pattern; http.host; content:"riyakhandelwal19.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017695; classtype:social-engineering; sid:6017695; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-git-fix-com2-1732-deposit-activ-992e83-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-git-fix-com2-1732-deposit-activ-992e83-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017696; classtype:social-engineering; sid:6017696; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-git-henryharris-com2-1636-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-git-henryharris-com2-1636-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017697; classtype:social-engineering; sid:6017697; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shivamkohli1989.github.io/aple-chk)"; flow:established,to_server; http.uri; content:"/aple-chk"; startswith; fast_pattern; http.host; content:"shivamkohli1989.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017698; classtype:social-engineering; sid:6017698; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f36x.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f36x.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017699; classtype:social-engineering; sid:6017699; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jorvik-clenda-b7d204-rgtt-ponvek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jorvik-clenda-b7d204-rgtt-ponvek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017700; classtype:social-engineering; sid:6017700; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xelquni-gld-zentora-c3x5dk13.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xelquni-gld-zentora-c3x5dk13.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017701; classtype:social-engineering; sid:6017701; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (246236365756.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"246236365756.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017702; classtype:social-engineering; sid:6017702; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shital-gangawane.github.io/ECommerce--UI-Clone/)"; flow:established,to_server; http.uri; content:"/ECommerce--UI-Clone/"; startswith; fast_pattern; http.host; content:"shital-gangawane.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017703; classtype:social-engineering; sid:6017703; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.barc-online.co.uk/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.barc-online.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017704; classtype:social-engineering; sid:6017704; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shubhxtech61-org.github.io/Amozon-clone/)"; flow:established,to_server; http.uri; content:"/Amozon-clone/"; startswith; fast_pattern; http.host; content:"shubhxtech61-org.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017705; classtype:social-engineering; sid:6017705; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-8nyp1joze.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-8nyp1joze.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017706; classtype:social-engineering; sid:6017706; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (morlavo-gld-lentami-c4t7pf86.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"morlavo-gld-lentami-c4t7pf86.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017707; classtype:social-engineering; sid:6017707; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j106n.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j106n.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017708; classtype:social-engineering; sid:6017708; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (steamcomrmutly.shop/workshop/glock18/)"; flow:established,to_server; http.uri; content:"/workshop/glock18/"; startswith; fast_pattern; http.host; content:"steamcomrmutly.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017709; classtype:social-engineering; sid:6017709; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (y35n.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"y35n.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017710; classtype:social-engineering; sid:6017710; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (arthurdeveloper11.github.io/ssapi/)"; flow:established,to_server; http.uri; content:"/ssapi/"; startswith; fast_pattern; http.host; content:"arthurdeveloper11.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017711; classtype:social-engineering; sid:6017711; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-j0m62jhpy-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-j0m62jhpy-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017712; classtype:social-engineering; sid:6017712; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-p197ibwvq-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-p197ibwvq-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017713; classtype:social-engineering; sid:6017713; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metmask_logn.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metmask_logn.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017714; classtype:social-engineering; sid:6017714; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j107i.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j107i.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017715; classtype:social-engineering; sid:6017715; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eku2in008-create.github.io/netflix-clone)"; flow:established,to_server; http.uri; content:"/netflix-clone"; startswith; fast_pattern; http.host; content:"eku2in008-create.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017716; classtype:social-engineering; sid:6017716; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dravora-gld-lentavi-p3x8dk91.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dravora-gld-lentavi-p3x8dk91.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017717; classtype:social-engineering; sid:6017717; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j107h.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j107h.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017718; classtype:social-engineering; sid:6017718; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (varshiguduru-code.github.io/netflix-homepage-clone/)"; flow:established,to_server; http.uri; content:"/netflix-homepage-clone/"; startswith; fast_pattern; http.host; content:"varshiguduru-code.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017719; classtype:social-engineering; sid:6017719; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (u28z.top/m/)"; flow:established,to_server; http.uri; content:"/m/"; startswith; fast_pattern; http.host; content:"u28z.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017720; classtype:social-engineering; sid:6017720; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebooklende.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebooklende.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017721; classtype:social-engineering; sid:6017721; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (driksjb11jul.kaisen.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"driksjb11jul.kaisen.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017722; classtype:social-engineering; sid:6017722; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (berzani-gld-larmora-a1x6hc84.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"berzani-gld-larmora-a1x6hc84.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017723; classtype:social-engineering; sid:6017723; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dakshrajbairagi.github.io/Netfix---login---project-/)"; flow:established,to_server; http.uri; content:"/Netfix---login---project-/"; startswith; fast_pattern; http.host; content:"dakshrajbairagi.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017724; classtype:social-engineering; sid:6017724; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (claim1-txt-esl-org.help/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"claim1-txt-esl-org.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017725; classtype:social-engineering; sid:6017725; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (binuixc.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"binuixc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017726; classtype:social-engineering; sid:6017726; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vinyan22-bot.github.io/Ledger/)"; flow:established,to_server; http.uri; content:"/Ledger/"; startswith; fast_pattern; http.host; content:"vinyan22-bot.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017727; classtype:social-engineering; sid:6017727; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uppravoce.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"uppravoce.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017728; classtype:social-engineering; sid:6017728; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-git-henryharris-com2-1363-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-git-henryharris-com2-1363-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017729; classtype:social-engineering; sid:6017729; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dextuda.ru/rbgifts)"; flow:established,to_server; http.uri; content:"/rbgifts"; startswith; fast_pattern; http.host; content:"dextuda.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017730; classtype:social-engineering; sid:6017730; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (talal7279-byte.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"talal7279-byte.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017731; classtype:social-engineering; sid:6017731; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-5jacj9p4a-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-5jacj9p4a-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017732; classtype:social-engineering; sid:6017732; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (draveta-gld-felmora-r6t8hp75.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"draveta-gld-felmora-r6t8hp75.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017733; classtype:social-engineering; sid:6017733; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1737063365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1737063365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017734; classtype:social-engineering; sid:6017734; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shubhxtech61-org.github.io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"shubhxtech61-org.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017735; classtype:social-engineering; sid:6017735; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ereifufyuqwwqq.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ereifufyuqwwqq.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017736; classtype:social-engineering; sid:6017736; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cpa24031ab7aa9.b-cdn.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cpa24031ab7aa9.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017737; classtype:social-engineering; sid:6017737; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (riyakhandelwal19.github.io/amazon-clone/customer-services.html)"; flow:established,to_server; http.uri; content:"/amazon-clone/customer-services.html"; startswith; fast_pattern; http.host; content:"riyakhandelwal19.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017738; classtype:social-engineering; sid:6017738; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (564194365756.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"564194365756.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017739; classtype:social-engineering; sid:6017739; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (antai-service-app.kingpur.pt/mycsss/login.php)"; flow:established,to_server; http.uri; content:"/mycsss/login.php"; startswith; fast_pattern; http.host; content:"antai-service-app.kingpur.pt"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017740; classtype:social-engineering; sid:6017740; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4662.win/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4662.win"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017741; classtype:social-engineering; sid:6017741; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (serviciosdigitales.hstn.me/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"serviciosdigitales.hstn.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017742; classtype:social-engineering; sid:6017742; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-6xnwbvw2o-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-6xnwbvw2o-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017743; classtype:social-engineering; sid:6017743; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vormavi-gld-zentela-p9t1hd34.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vormavi-gld-zentela-p9t1hd34.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017744; classtype:social-engineering; sid:6017744; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-p1n7nv04q-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-p1n7nv04q-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017745; classtype:social-engineering; sid:6017745; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (steamcomunnmity.com/tradeoffer/new/partner=783662133token=l4hhebGA76713)"; flow:established,to_server; http.uri; content:"/tradeoffer/new/partner=783662133token=l4hhebGA76713"; startswith; fast_pattern; http.host; content:"steamcomunnmity.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017746; classtype:social-engineering; sid:6017746; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (de.konto-versicherung.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"de.konto-versicherung.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017747; classtype:social-engineering; sid:6017747; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (raj1310-p.github.io/WebProject/)"; flow:established,to_server; http.uri; content:"/WebProject/"; startswith; fast_pattern; http.host; content:"raj1310-p.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017748; classtype:social-engineering; sid:6017748; rev:1; metadata: signature_severity Major, created_et 2026_07_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (banbif-ie.firebaseapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"banbif-ie.firebaseapp.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017749; classtype:social-engineering; sid:6017749; rev:1; metadata: signature_severity Major, created_et 2026_07_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.ofeta-lokalna65915.shop/oferta/samsung-galaxy-s26-ultra/266720116)"; flow:established,to_server; http.uri; content:"/oferta/samsung-galaxy-s26-ultra/266720116"; startswith; fast_pattern; http.host; content:"allegrolokalnie.ofeta-lokalna65915.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017750; classtype:social-engineering; sid:6017750; rev:1; metadata: signature_severity Major, created_et 2026_07_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fenixgeneral.systeme.io/c5dd67c4)"; flow:established,to_server; http.uri; content:"/c5dd67c4"; startswith; fast_pattern; http.host; content:"fenixgeneral.systeme.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017751; classtype:social-engineering; sid:6017751; rev:1; metadata: signature_severity Major, created_et 2026_07_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spedizione.github.io/nstagramvrfy)"; flow:established,to_server; http.uri; content:"/nstagramvrfy"; startswith; fast_pattern; http.host; content:"spedizione.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017752; classtype:social-engineering; sid:6017752; rev:1; metadata: signature_severity Major, created_et 2026_07_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (birth.5gsewa.cyou/crs/)"; flow:established,to_server; http.uri; content:"/crs/"; startswith; fast_pattern; http.host; content:"birth.5gsewa.cyou"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017753; classtype:social-engineering; sid:6017753; rev:1; metadata: signature_severity Major, created_et 2026_07_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ftyfetefefytedfd37uij.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ftyfetefefytedfd37uij.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017754; classtype:social-engineering; sid:6017754; rev:1; metadata: signature_severity Major, created_et 2026_07_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.077800j45.lol/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.077800j45.lol"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017755; classtype:social-engineering; sid:6017755; rev:1; metadata: signature_severity Major, created_et 2026_07_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.9239h9459.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.9239h9459.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017756; classtype:social-engineering; sid:6017756; rev:1; metadata: signature_severity Major, created_et 2026_07_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (freepetss.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"freepetss.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017757; classtype:social-engineering; sid:6017757; rev:1; metadata: signature_severity Major, created_et 2026_07_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (newzimb.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"newzimb.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017758; classtype:social-engineering; sid:6017758; rev:1; metadata: signature_severity Major, created_et 2026_07_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aacredltvmlam-online.top/?secure_connect=f523c*&_subid=15ld5h3.4c.20i44&_token=3gh587sbhdbdp.1783354260.18.cc36b12b40aba4137fdd6257ecf5d488)"; flow:established,to_server; http.uri; content:"/?secure_connect=f523c*&_subid=15ld5h3.4c.20i44&_token=3gh587sbhdbdp.1783354260.18.cc36b12b40aba4137fdd6257ecf5d488"; startswith; fast_pattern; http.host; content:"aacredltvmlam-online.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017759; classtype:social-engineering; sid:6017759; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maxispointsredemption.us.cc/4g/)"; flow:established,to_server; http.uri; content:"/4g/"; startswith; fast_pattern; http.host; content:"maxispointsredemption.us.cc"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017760; classtype:social-engineering; sid:6017760; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (area.baudienst.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"area.baudienst.org"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017761; classtype:social-engineering; sid:6017761; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maxisou.com/mymaxis)"; flow:established,to_server; http.uri; content:"/mymaxis"; startswith; fast_pattern; http.host; content:"maxisou.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017762; classtype:social-engineering; sid:6017762; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (securpass-creditagricole.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"securpass-creditagricole.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017763; classtype:social-engineering; sid:6017763; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.macle-numerique.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.macle-numerique.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017764; classtype:social-engineering; sid:6017764; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.36490j4509845.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.36490j4509845.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017765; classtype:social-engineering; sid:6017765; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwwmaxpointsprogram.us.cc/4g/)"; flow:established,to_server; http.uri; content:"/4g/"; startswith; fast_pattern; http.host; content:"wwwmaxpointsprogram.us.cc"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017766; classtype:social-engineering; sid:6017766; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maxisnz.com/maxis)"; flow:established,to_server; http.uri; content:"/maxis"; startswith; fast_pattern; http.host; content:"maxisnz.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017767; classtype:social-engineering; sid:6017767; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aacredltvmlam-online.top/?secure_connect=f523c*&_subid=3rpb3ti.4c.20i59&_token=3l1agtc2q3g48u.1783355100.15.b3a0d77d232d99f2aa93e7257cad142a)"; flow:established,to_server; http.uri; content:"/?secure_connect=f523c*&_subid=3rpb3ti.4c.20i59&_token=3l1agtc2q3g48u.1783355100.15.b3a0d77d232d99f2aa93e7257cad142a"; startswith; fast_pattern; http.host; content:"aacredltvmlam-online.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017768; classtype:social-engineering; sid:6017768; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (takealotvoucher.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"takealotvoucher.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6017769; classtype:social-engineering; sid:6017769; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nurtured-umbrella-322056.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nurtured-umbrella-322056.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017770; classtype:social-engineering; sid:6017770; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (orchid-wealth-171454.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"orchid-wealth-171454.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017771; classtype:social-engineering; sid:6017771; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-delnor-biz-klesva-zufmir.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-delnor-biz-klesva-zufmir.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017772; classtype:social-engineering; sid:6017772; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bermora-gld-felmavi-c4x9qk16.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bermora-gld-felmavi-c4x9qk16.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017773; classtype:social-engineering; sid:6017773; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mindful-area-925592.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mindful-area-925592.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017774; classtype:social-engineering; sid:6017774; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-dernax-biz-tramso-jimqi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-dernax-biz-tramso-jimqi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017775; classtype:social-engineering; sid:6017775; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (82491.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"82491.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017776; classtype:social-engineering; sid:6017776; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bybitamlchecker.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bybitamlchecker.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017777; classtype:social-engineering; sid:6017777; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-sornax-biz-trusra-jidqi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-sornax-biz-trusra-jidqi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017778; classtype:social-engineering; sid:6017778; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-zarnex-biz-trusna-josqi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-zarnex-biz-trusna-josqi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017779; classtype:social-engineering; sid:6017779; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nrivok-belnar-1fd82e-njygh-4ab561.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nrivok-belnar-1fd82e-njygh-4ab561.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017780; classtype:social-engineering; sid:6017780; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.pl-84673.click/oferta/l/-502292850?id=c7829eb6a)"; flow:established,to_server; http.uri; content:"/oferta/l/-502292850?id=c7829eb6a"; startswith; fast_pattern; http.host; content:"allegrolokalnie.pl-84673.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017781; classtype:social-engineering; sid:6017781; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.82492.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.82492.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017782; classtype:social-engineering; sid:6017782; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-farnex-biz-krolva-fimra.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-farnex-biz-krolva-fimra.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017783; classtype:social-engineering; sid:6017783; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (helpcenteraple.tempurl.host/D%207%20L%20S%20E%20N%20D%20P%20K/track/track.php)"; flow:established,to_server; http.uri; content:"/D%207%20L%20S%20E%20N%20D%20P%20K/track/track.php"; startswith; fast_pattern; http.host; content:"helpcenteraple.tempurl.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017784; classtype:social-engineering; sid:6017784; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (obedient-cube-649160.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"obedient-cube-649160.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017785; classtype:social-engineering; sid:6017785; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lakebled.hostel.town/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lakebled.hostel.town"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017786; classtype:social-engineering; sid:6017786; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-garnix-biz-tralsa-femqur.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-garnix-biz-tralsa-femqur.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017787; classtype:social-engineering; sid:6017787; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-morliq-biz-krasna-fidru.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-morliq-biz-krasna-fidru.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017788; classtype:social-engineering; sid:6017788; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-ilrnaq-biz-pramso-zifdu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-ilrnaq-biz-pramso-zifdu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017789; classtype:social-engineering; sid:6017789; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure.zoinbase.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure.zoinbase.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017790; classtype:social-engineering; sid:6017790; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deniz-mobil-com-promosyyon-ekrani.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"deniz-mobil-com-promosyyon-ekrani.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017791; classtype:social-engineering; sid:6017791; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (giveaway-8y3.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"giveaway-8y3.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017792; classtype:social-engineering; sid:6017792; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2641.win/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2641.win"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017793; classtype:social-engineering; sid:6017793; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-delnax-biz-kralvo-fodqi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-delnax-biz-kralvo-fodqi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017794; classtype:social-engineering; sid:6017794; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-gelnaq-biz-pralto-zivmu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-gelnaq-biz-pralto-zivmu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017795; classtype:social-engineering; sid:6017795; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (helpcenteraple.tempurl.host/D%207%20L%20S%20E%20N%20D%20P%20K/track/info.php)"; flow:established,to_server; http.uri; content:"/D%207%20L%20S%20E%20N%20D%20P%20K/track/info.php"; startswith; fast_pattern; http.host; content:"helpcenteraple.tempurl.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017796; classtype:social-engineering; sid:6017796; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-yorvek-biz-tronqa-ziflar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-yorvek-biz-tronqa-ziflar.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017797; classtype:social-engineering; sid:6017797; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-ivroqa-biz-truska-jomfi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-ivroqa-biz-truska-jomfi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017798; classtype:social-engineering; sid:6017798; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwwmicrosoft-com-en-us-microsoft-365-outlook-email.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wwwmicrosoft-com-en-us-microsoft-365-outlook-email.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017799; classtype:social-engineering; sid:6017799; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.82484.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.82484.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017800; classtype:social-engineering; sid:6017800; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my-xfinity-account-update-1-x.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"my-xfinity-account-update-1-x.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017801; classtype:social-engineering; sid:6017801; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-qarnov-biz-prusko-zelfar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-qarnov-biz-prusko-zelfar.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017802; classtype:social-engineering; sid:6017802; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.365bet288.com/eng/home/index/)"; flow:established,to_server; http.uri; content:"/eng/home/index/"; startswith; fast_pattern; http.host; content:"m.365bet288.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017803; classtype:social-engineering; sid:6017803; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cnt-apps-kaiyunsports.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cnt-apps-kaiyunsports.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017804; classtype:social-engineering; sid:6017804; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ufh-vd0w-q5s-01c-jjje-63wq2b.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ufh-vd0w-q5s-01c-jjje-63wq2b.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017805; classtype:social-engineering; sid:6017805; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (connect-comcast.framer.wiki/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"connect-comcast.framer.wiki"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017806; classtype:social-engineering; sid:6017806; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jrivok-selnar-1fd82e-njygh-4ab561.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jrivok-selnar-1fd82e-njygh-4ab561.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017807; classtype:social-engineering; sid:6017807; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-gorniq-biz-prusko-zalfir.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-gorniq-biz-prusko-zalfir.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017808; classtype:social-engineering; sid:6017808; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-elnov-biz-trasqo-jidra.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-elnov-biz-trasqo-jidra.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017809; classtype:social-engineering; sid:6017809; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinityserver.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinityserver.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017810; classtype:social-engineering; sid:6017810; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (insta-clone--leumasleinad419.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"insta-clone--leumasleinad419.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017811; classtype:social-engineering; sid:6017811; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-wa-llet-support.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-wa-llet-support.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017812; classtype:social-engineering; sid:6017812; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bewildered-fruit-952216.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bewildered-fruit-952216.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017813; classtype:social-engineering; sid:6017813; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hj555.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hj555.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017814; classtype:social-engineering; sid:6017814; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hopeful-methods-639860.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hopeful-methods-639860.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017815; classtype:social-engineering; sid:6017815; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-dorlen-biz-truska-jefnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-dorlen-biz-truska-jefnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017816; classtype:social-engineering; sid:6017816; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (effective-employees-986806.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"effective-employees-986806.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017817; classtype:social-engineering; sid:6017817; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (slavor-bintel-3b82fc-mrkt-grendal-1iv.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"slavor-bintel-3b82fc-mrkt-grendal-1iv.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017818; classtype:social-engineering; sid:6017818; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (haleemausman1.github.io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"haleemausman1.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017819; classtype:social-engineering; sid:6017819; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-fornex-biz-tramka-jusfi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-fornex-biz-tramka-jusfi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017820; classtype:social-engineering; sid:6017820; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-qorlen-biz-klanvo-ziftur.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-qorlen-biz-klanvo-ziftur.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017821; classtype:social-engineering; sid:6017821; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c03n.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c03n.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017822; classtype:social-engineering; sid:6017822; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (use1.sentomiemie.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"use1.sentomiemie.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017823; classtype:social-engineering; sid:6017823; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kartikbuilds.github.io/Ledger-Co/)"; flow:established,to_server; http.uri; content:"/Ledger-Co/"; startswith; fast_pattern; http.host; content:"kartikbuilds.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017824; classtype:social-engineering; sid:6017824; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bplg-agb.de/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bplg-agb.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017825; classtype:social-engineering; sid:6017825; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qurnita-gld-lormavi-a8x3fc26.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qurnita-gld-lormavi-a8x3fc26.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017826; classtype:social-engineering; sid:6017826; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-borniq-biz-pralsi-zomqel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-borniq-biz-pralsi-zomqel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017827; classtype:social-engineering; sid:6017827; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-gornax-biz-trenka-judqi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-gornax-biz-trenka-judqi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017828; classtype:social-engineering; sid:6017828; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lapetiteaubergedesaintsernin.hostel.town/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lapetiteaubergedesaintsernin.hostel.town"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017829; classtype:social-engineering; sid:6017829; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vormela-gld-vartemi-c5x9hd22.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vormela-gld-vartemi-c5x9hd22.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017830; classtype:social-engineering; sid:6017830; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hmivok-trelna-2ed83f-vjbyh-6cb712.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hmivok-trelna-2ed83f-vjbyh-6cb712.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017831; classtype:social-engineering; sid:6017831; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.r19a.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.r19a.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017832; classtype:social-engineering; sid:6017832; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aryama10.github.io/facebook-login-page/)"; flow:established,to_server; http.uri; content:"/facebook-login-page/"; startswith; fast_pattern; http.host; content:"aryama10.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017833; classtype:social-engineering; sid:6017833; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-tervaq-biz-pralko-zesmu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-tervaq-biz-pralko-zesmu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017834; classtype:social-engineering; sid:6017834; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ztoot.raoqm.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ztoot.raoqm.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017835; classtype:social-engineering; sid:6017835; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-pelvra-biz-klenko-fomqi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-pelvra-biz-klenko-fomqi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017836; classtype:social-engineering; sid:6017836; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sweet-truth-af82.igtyitifweh.workers.dev/v3/guidelines/)"; flow:established,to_server; http.uri; content:"/v3/guidelines/"; startswith; fast_pattern; http.host; content:"sweet-truth-af82.igtyitifweh.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017837; classtype:social-engineering; sid:6017837; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-vernax-biz-prusvo-zimru.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-vernax-biz-prusvo-zimru.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017838; classtype:social-engineering; sid:6017838; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-talvoq-biz-klastro-fidra.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-talvoq-biz-klastro-fidra.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017839; classtype:social-engineering; sid:6017839; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jkrepro.co.za/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jkrepro.co.za"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017840; classtype:social-engineering; sid:6017840; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-xelnax-biz-pramko-zidqi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-xelnax-biz-pramko-zidqi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017841; classtype:social-engineering; sid:6017841; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-corlix-biz-klavso-fomter.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-corlix-biz-klavso-fomter.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017842; classtype:social-engineering; sid:6017842; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (belmora-gld-lentora-a5x3hc43.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"belmora-gld-lentora-a5x3hc43.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017843; classtype:social-engineering; sid:6017843; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (panoasg.github.io/ledger)"; flow:established,to_server; http.uri; content:"/ledger"; startswith; fast_pattern; http.host; content:"panoasg.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017844; classtype:social-engineering; sid:6017844; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f38h.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f38h.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017845; classtype:social-engineering; sid:6017845; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-bralvo-biz-trunke-forsiq.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-bralvo-biz-trunke-forsiq.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017846; classtype:social-engineering; sid:6017846; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kundenservice.konto-versicherung.com/blocked)"; flow:established,to_server; http.uri; content:"/blocked"; startswith; fast_pattern; http.host; content:"kundenservice.konto-versicherung.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017847; classtype:social-engineering; sid:6017847; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.82499.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.82499.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017848; classtype:social-engineering; sid:6017848; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (82496.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"82496.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017849; classtype:social-engineering; sid:6017849; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-melqix-biz-pralka-furnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-melqix-biz-pralka-furnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017850; classtype:social-engineering; sid:6017850; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (im8-dsf-i0m-5ne7ez-w8ms-w9c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"im8-dsf-i0m-5ne7ez-w8ms-w9c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017851; classtype:social-engineering; sid:6017851; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-relvak-biz-truska-fidqem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-relvak-biz-truska-fidqem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017852; classtype:social-engineering; sid:6017852; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreid6stk3vn6iqnc32cyurmpazi7fgks752xu33ymolv6rv2pff2shi.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreid6stk3vn6iqnc32cyurmpazi7fgks752xu33ymolv6rv2pff2shi.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017853; classtype:social-engineering; sid:6017853; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eq3is-6d3-3qn4b-ian9g-66sex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eq3is-6d3-3qn4b-ian9g-66sex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017854; classtype:social-engineering; sid:6017854; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-cornik-biz-klenva-fudmu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-cornik-biz-klenva-fudmu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017855; classtype:social-engineering; sid:6017855; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-iurnaq-biz-krolta-fudfi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-iurnaq-biz-krolta-fudfi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017856; classtype:social-engineering; sid:6017856; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reapergamin18.github.io/expense-tracker/)"; flow:established,to_server; http.uri; content:"/expense-tracker/"; startswith; fast_pattern; http.host; content:"reapergamin18.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017857; classtype:social-engineering; sid:6017857; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zwtld0uxi.com.ng/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zwtld0uxi.com.ng"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017858; classtype:social-engineering; sid:6017858; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rbia047-png.github.io/PaginaEntrarFacebook/)"; flow:established,to_server; http.uri; content:"/PaginaEntrarFacebook/"; startswith; fast_pattern; http.host; content:"rbia047-png.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017859; classtype:social-engineering; sid:6017859; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (serrenon.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"serrenon.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017860; classtype:social-engineering; sid:6017860; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amaarahmed806-rgb.github.io/Invoice-Generator/)"; flow:established,to_server; http.uri; content:"/Invoice-Generator/"; startswith; fast_pattern; http.host; content:"amaarahmed806-rgb.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017861; classtype:social-engineering; sid:6017861; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yuexikejilou.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yuexikejilou.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017862; classtype:social-engineering; sid:6017862; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.vkfsizlerle.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.vkfsizlerle.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017863; classtype:social-engineering; sid:6017863; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-lunvax-biz-presko-jalfur.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-lunvax-biz-presko-jalfur.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017864; classtype:social-engineering; sid:6017864; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-lelvoq-biz-krenvo-fimqi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-lelvoq-biz-krenvo-fimqi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017865; classtype:social-engineering; sid:6017865; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e73bp9-8u3u-x80vd-0p3z3o.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e73bp9-8u3u-x80vd-0p3z3o.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017866; classtype:social-engineering; sid:6017866; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (h0lo55-gs0c-dcz-61jp-usv.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"h0lo55-gs0c-dcz-61jp-usv.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017867; classtype:social-engineering; sid:6017867; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ututj588khj.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ututj588khj.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017868; classtype:social-engineering; sid:6017868; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.12612.co/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.12612.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017869; classtype:social-engineering; sid:6017869; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-lernox-biz-tramka-felqur.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-lernox-biz-tramka-felqur.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017870; classtype:social-engineering; sid:6017870; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (black-pumpkin-377375.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"black-pumpkin-377375.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017871; classtype:social-engineering; sid:6017871; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (onivok-trelna-gv3006uhb-vjbyh-6cb712.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"onivok-trelna-gv3006uhb-vjbyh-6cb712.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017872; classtype:social-engineering; sid:6017872; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-vorlax-biz-kresto-fomqi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-vorlax-biz-kresto-fomqi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017873; classtype:social-engineering; sid:6017873; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-harnoq-biz-pralso-zomtir.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-harnoq-biz-pralso-zomtir.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017874; classtype:social-engineering; sid:6017874; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flodxvlw.com.ng/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"flodxvlw.com.ng"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017875; classtype:social-engineering; sid:6017875; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-ulrnok-biz-tralka-josqi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-ulrnok-biz-tralka-josqi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017876; classtype:social-engineering; sid:6017876; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-mornex-biz-trulka-josfi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-mornex-biz-trulka-josfi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017877; classtype:social-engineering; sid:6017877; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-horniq-biz-klenvo-fesra.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-horniq-biz-klenvo-fesra.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017878; classtype:social-engineering; sid:6017878; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-yornaq-biz-pralto-zodfi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-yornaq-biz-pralto-zodfi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017879; classtype:social-engineering; sid:6017879; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dravemi-gld-belquna-r5t7hp93.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dravemi-gld-belquna-r5t7hp93.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017880; classtype:social-engineering; sid:6017880; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (h30h.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"h30h.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017881; classtype:social-engineering; sid:6017881; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (helpful-assistant-453359.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"helpful-assistant-453359.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017882; classtype:social-engineering; sid:6017882; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.79044.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.79044.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017883; classtype:social-engineering; sid:6017883; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kundenservice.konto-versicherung.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kundenservice.konto-versicherung.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017884; classtype:social-engineering; sid:6017884; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.robinhood-reward.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.robinhood-reward.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017885; classtype:social-engineering; sid:6017885; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-rolvex-biz-kranvo-fidra.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-rolvex-biz-kranvo-fidra.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017886; classtype:social-engineering; sid:6017886; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ijazwakeel-old.github.io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"ijazwakeel-old.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017887; classtype:social-engineering; sid:6017887; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pecmyconnect.oa.r.appspot.com/cnjhbmrvbubyyw5kb20uy29t)"; flow:established,to_server; http.uri; content:"/cnjhbmrvbubyyw5kb20uy29t"; startswith; fast_pattern; http.host; content:"pecmyconnect.oa.r.appspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017888; classtype:social-engineering; sid:6017888; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-yornaq-biz-klamto-fesqi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-yornaq-biz-klamto-fesqi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017889; classtype:social-engineering; sid:6017889; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (highmarket.my/personal/market/)"; flow:established,to_server; http.uri; content:"/personal/market/"; startswith; fast_pattern; http.host; content:"highmarket.my"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017890; classtype:social-engineering; sid:6017890; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (discreetencryption.com/2513501.doc/18a80a/fad0f483-81b2-45c6-ad47-7272058d9cb6/)"; flow:established,to_server; http.uri; content:"/2513501.doc/18a80a/fad0f483-81b2-45c6-ad47-7272058d9cb6/"; startswith; fast_pattern; http.host; content:"discreetencryption.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017891; classtype:social-engineering; sid:6017891; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.m.amz-topi.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.m.amz-topi.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017892; classtype:social-engineering; sid:6017892; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.artmix24.de/Pemmalsioassnbesm/index.php)"; flow:established,to_server; http.uri; content:"/Pemmalsioassnbesm/index.php"; startswith; fast_pattern; http.host; content:"www.artmix24.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017893; classtype:social-engineering; sid:6017893; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-melnok-biz-prusqa-zofmi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-melnok-biz-prusqa-zofmi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017894; classtype:social-engineering; sid:6017894; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (636cp.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"636cp.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017895; classtype:social-engineering; sid:6017895; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fuyexm.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fuyexm.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017896; classtype:social-engineering; sid:6017896; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-sarnok-biz-trimsa-jufqi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-sarnok-biz-trimsa-jufqi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017897; classtype:social-engineering; sid:6017897; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-calvex-biz-prunka-zefro.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-calvex-biz-prunka-zefro.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017898; classtype:social-engineering; sid:6017898; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (82493.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"82493.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017899; classtype:social-engineering; sid:6017899; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bankofamericaijcf.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bankofamericaijcf.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017900; classtype:social-engineering; sid:6017900; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (datchan514-sjjj.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"datchan514-sjjj.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017901; classtype:social-engineering; sid:6017901; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-lernax-biz-prusko-zodqi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-lernax-biz-prusko-zodqi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017902; classtype:social-engineering; sid:6017902; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-relnok-biz-trunvo-jemra.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-relnok-biz-trunvo-jemra.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017903; classtype:social-engineering; sid:6017903; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (misty-ice-145636.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"misty-ice-145636.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017904; classtype:social-engineering; sid:6017904; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vormela-gld-felmita-c2x4qk58.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vormela-gld-felmita-c2x4qk58.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017905; classtype:social-engineering; sid:6017905; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telmavi-gld-zartora-p1t4hd27.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"telmavi-gld-zartora-p1t4hd27.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017906; classtype:social-engineering; sid:6017906; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bankofamericaijcf.com/web/)"; flow:established,to_server; http.uri; content:"/web/"; startswith; fast_pattern; http.host; content:"www.bankofamericaijcf.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017907; classtype:social-engineering; sid:6017907; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-warnok-biz-trusva-jedri.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-warnok-biz-trusva-jedri.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017908; classtype:social-engineering; sid:6017908; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.balsa-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.balsa-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017909; classtype:social-engineering; sid:6017909; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (static-side-627110.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"static-side-627110.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017910; classtype:social-engineering; sid:6017910; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-sarvoq-biz-prusra-zumfel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-sarvoq-biz-prusra-zumfel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017911; classtype:social-engineering; sid:6017911; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alavor-bintel-3b82fc-mrkt-grendal.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"alavor-bintel-3b82fc-mrkt-grendal.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017912; classtype:social-engineering; sid:6017912; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (extraordinary-united-387018.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"extraordinary-united-387018.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017913; classtype:social-engineering; sid:6017913; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (giving-overlay-628317.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"giving-overlay-628317.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017914; classtype:social-engineering; sid:6017914; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b6fbt-2fa3-ry8c6-4kgd-ef9lm.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b6fbt-2fa3-ry8c6-4kgd-ef9lm.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017915; classtype:social-engineering; sid:6017915; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (warmhearted-card-323809.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"warmhearted-card-323809.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017916; classtype:social-engineering; sid:6017916; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-frulka-biz-plenvo-zumri.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-frulka-biz-plenvo-zumri.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017917; classtype:social-engineering; sid:6017917; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-renvok-biz-klosmi-fartuq.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-renvok-biz-klosmi-fartuq.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017918; classtype:social-engineering; sid:6017918; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yamzoza-north-007-amazon.s3.us-east-1.amazonaws.com/moon.html)"; flow:established,to_server; http.uri; content:"/moon.html"; startswith; fast_pattern; http.host; content:"yamzoza-north-007-amazon.s3.us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017919; classtype:social-engineering; sid:6017919; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-kornaq-biz-pramta-zodru.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-kornaq-biz-pramta-zodru.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017920; classtype:social-engineering; sid:6017920; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (same-lrf23elu9nh-latest.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"same-lrf23elu9nh-latest.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017921; classtype:social-engineering; sid:6017921; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pr-newsroom-wp.appspot.com/2024-03-01/a-letter-to-the-european-commission-on-apples-lack-of-dma-compliance)"; flow:established,to_server; http.uri; content:"/2024-03-01/a-letter-to-the-european-commission-on-apples-lack-of-dma-compliance"; startswith; fast_pattern; http.host; content:"www.pr-newsroom-wp.appspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017922; classtype:social-engineering; sid:6017922; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dc.crsorgi.gov.in.verfiys.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dc.crsorgi.gov.in.verfiys.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017923; classtype:social-engineering; sid:6017923; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (satyansh-yadav0812.github.io/steam-web-clone/)"; flow:established,to_server; http.uri; content:"/steam-web-clone/"; startswith; fast_pattern; http.host; content:"satyansh-yadav0812.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017924; classtype:social-engineering; sid:6017924; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-forlen-biz-klamra-zefvor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-forlen-biz-klamra-zefvor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017925; classtype:social-engineering; sid:6017925; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-ronqex-biz-klamko-zifnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-ronqex-biz-klamko-zifnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017926; classtype:social-engineering; sid:6017926; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-balroq-biz-prusva-zemtu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-balroq-biz-prusva-zemtu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017927; classtype:social-engineering; sid:6017927; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (miraculous-watching-043899.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"miraculous-watching-043899.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017928; classtype:social-engineering; sid:6017928; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bybitamlchecker.com/connect)"; flow:established,to_server; http.uri; content:"/connect"; startswith; fast_pattern; http.host; content:"bybitamlchecker.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017929; classtype:social-engineering; sid:6017929; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xinhuimuye.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xinhuimuye.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017930; classtype:social-engineering; sid:6017930; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (functional-points-663271.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"functional-points-663271.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017931; classtype:social-engineering; sid:6017931; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rfgon-ene6v-c8x-iaf-pacn.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rfgon-ene6v-c8x-iaf-pacn.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017932; classtype:social-engineering; sid:6017932; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (courageous-homeowners-576305.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"courageous-homeowners-576305.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017933; classtype:social-engineering; sid:6017933; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trivok-belnar-1fd82e-njygh-4ab561-94p.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trivok-belnar-1fd82e-njygh-4ab561-94p.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017934; classtype:social-engineering; sid:6017934; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (morlita-gld-larqumi-r5t8dp43.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"morlita-gld-larqumi-r5t8dp43.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017935; classtype:social-engineering; sid:6017935; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (internal-variations-441444.framer.app/?referer=urlvanish.com%2F3f1c1509)"; flow:established,to_server; http.uri; content:"/?referer=urlvanish.com%2F3f1c1509"; startswith; fast_pattern; http.host; content:"internal-variations-441444.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017936; classtype:social-engineering; sid:6017936; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apple.5g.in/ch)"; flow:established,to_server; http.uri; content:"/ch"; startswith; fast_pattern; http.host; content:"apple.5g.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017937; classtype:social-engineering; sid:6017937; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yellowblackteam.github.io/HetiBlox/)"; flow:established,to_server; http.uri; content:"/HetiBlox/"; startswith; fast_pattern; http.host; content:"yellowblackteam.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017938; classtype:social-engineering; sid:6017938; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sumitkumar016.github.io/Amazon-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-clone/"; startswith; fast_pattern; http.host; content:"sumitkumar016.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017939; classtype:social-engineering; sid:6017939; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-xerniq-biz-klomra-zeftal.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-xerniq-biz-klomra-zeftal.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017940; classtype:social-engineering; sid:6017940; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-lorniq-biz-prusra-zedmur.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-lorniq-biz-prusra-zedmur.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017941; classtype:social-engineering; sid:6017941; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qurnavi-gld-larmita-r2t4dp98.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qurnavi-gld-larmita-r2t4dp98.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017942; classtype:social-engineering; sid:6017942; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-mornik-biz-tralka-jusra.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-mornik-biz-tralka-jusra.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017943; classtype:social-engineering; sid:6017943; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-xolnar-biz-prunko-fesliq.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-xolnar-biz-prunko-fesliq.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017944; classtype:social-engineering; sid:6017944; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hjword.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hjword.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017945; classtype:social-engineering; sid:6017945; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-brenok-biz-tulvra-josme.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-brenok-biz-tulvra-josme.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017946; classtype:social-engineering; sid:6017946; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9qb-drmmto-laljls-89n0-bunyz.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9qb-drmmto-laljls-89n0-bunyz.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017947; classtype:social-engineering; sid:6017947; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-ulnora-biz-klenqa-fomri.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-ulnora-biz-klenqa-fomri.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017948; classtype:social-engineering; sid:6017948; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-helvoq-biz-trusra-jomqi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-helvoq-biz-trusra-jomqi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017949; classtype:social-engineering; sid:6017949; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-grenox-biz-kaltra-fosmu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-grenox-biz-kaltra-fosmu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017950; classtype:social-engineering; sid:6017950; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suyogacenter.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"suyogacenter.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017951; classtype:social-engineering; sid:6017951; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (manikgupta-2004.github.io/netflix-homepage/)"; flow:established,to_server; http.uri; content:"/netflix-homepage/"; startswith; fast_pattern; http.host; content:"manikgupta-2004.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017952; classtype:social-engineering; sid:6017952; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-qalvra-biz-klenro-fosqi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-qalvra-biz-klenro-fosqi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017953; classtype:social-engineering; sid:6017953; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (v36p.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"v36p.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017954; classtype:social-engineering; sid:6017954; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwwyh26.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wwwyh26.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017955; classtype:social-engineering; sid:6017955; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-elrvoq-biz-prusra-zofdu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-elrvoq-biz-prusra-zofdu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017956; classtype:social-engineering; sid:6017956; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telzani-gld-varquro-a8x6dw34.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"telzani-gld-varquro-a8x6dw34.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017957; classtype:social-engineering; sid:6017957; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-ulvren-biz-pramka-zufro.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-ulvren-biz-pramka-zufro.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017958; classtype:social-engineering; sid:6017958; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bold-mountain-041d.kksfkwelcoibiwu.workers.dev/business-blue-tick-approved/)"; flow:established,to_server; http.uri; content:"/business-blue-tick-approved/"; startswith; fast_pattern; http.host; content:"bold-mountain-041d.kksfkwelcoibiwu.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017959; classtype:social-engineering; sid:6017959; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-ralvex-biz-prenko-zodmi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-ralvex-biz-prenko-zodmi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017960; classtype:social-engineering; sid:6017960; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-parnoq-biz-trenka-jemfu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-parnoq-biz-trenka-jemfu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017961; classtype:social-engineering; sid:6017961; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365545.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"365545.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017962; classtype:social-engineering; sid:6017962; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (same-phoenix-631664.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"same-phoenix-631664.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017963; classtype:social-engineering; sid:6017963; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telquni-gld-varmora-a9x5dw18.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"telquni-gld-varmora-a9x5dw18.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017964; classtype:social-engineering; sid:6017964; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-qesmar-biz-pralki-zomvel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-qesmar-biz-pralki-zomvel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017965; classtype:social-engineering; sid:6017965; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wvw-facebook.com/share-us5ow7ds2?mibextid=wwXIfr)"; flow:established,to_server; http.uri; content:"/share-us5ow7ds2?mibextid=wwXIfr"; startswith; fast_pattern; http.host; content:"wvw-facebook.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017966; classtype:social-engineering; sid:6017966; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j-8np.pages.dev/facebook.com-1027275509)"; flow:established,to_server; http.uri; content:"/facebook.com-1027275509"; startswith; fast_pattern; http.host; content:"j-8np.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017967; classtype:social-engineering; sid:6017967; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bnp-agb.de/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bnp-agb.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017968; classtype:social-engineering; sid:6017968; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sincere-usability-272022.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sincere-usability-272022.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017969; classtype:social-engineering; sid:6017969; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-vernok-biz-klamvo-fisra.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-vernok-biz-klamvo-fisra.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017970; classtype:social-engineering; sid:6017970; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.teams-rf.com/p/fjbd-cbch/zoogzziw/)"; flow:established,to_server; http.uri; content:"/p/fjbd-cbch/zoogzziw/"; startswith; fast_pattern; http.host; content:"s.teams-rf.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017971; classtype:social-engineering; sid:6017971; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-jorvak-biz-tralsu-femqor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-jorvak-biz-tralsu-femqor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017972; classtype:social-engineering; sid:6017972; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-goylyguzs-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-goylyguzs-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017973; classtype:social-engineering; sid:6017973; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-belqor-biz-tralka-zifvem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-belqor-biz-tralka-zifvem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017974; classtype:social-engineering; sid:6017974; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adarsh31-a.github.io/projects/)"; flow:established,to_server; http.uri; content:"/projects/"; startswith; fast_pattern; http.host; content:"adarsh31-a.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017975; classtype:social-engineering; sid:6017975; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vkfsizlerle.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vkfsizlerle.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017976; classtype:social-engineering; sid:6017976; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (caura.ryz.tepuyserver.net/~tanacom/payu/WAB5/Select/index.php)"; flow:established,to_server; http.uri; content:"/~tanacom/payu/WAB5/Select/index.php"; startswith; fast_pattern; http.host; content:"caura.ryz.tepuyserver.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017977; classtype:social-engineering; sid:6017977; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-durnex-biz-tronka-jilmu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-durnex-biz-tronka-jilmu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017978; classtype:social-engineering; sid:6017978; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-pelnax-biz-trenka-jomfi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-pelnax-biz-trenka-jomfi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017979; classtype:social-engineering; sid:6017979; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-burnaq-biz-prusvo-zemfi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-burnaq-biz-prusvo-zemfi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017980; classtype:social-engineering; sid:6017980; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-zormaq-biz-klenva-fudri.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-zormaq-biz-klenva-fudri.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017981; classtype:social-engineering; sid:6017981; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j110x.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j110x.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017982; classtype:social-engineering; sid:6017982; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (morlena-gld-belmavi-a6x7fc94.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"morlena-gld-belmavi-a6x7fc94.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017983; classtype:social-engineering; sid:6017983; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prateek-singh-1210.github.io/netflix-homepage-clone/)"; flow:established,to_server; http.uri; content:"/netflix-homepage-clone/"; startswith; fast_pattern; http.host; content:"prateek-singh-1210.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017984; classtype:social-engineering; sid:6017984; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-lervoq-biz-krenso-femra.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-lervoq-biz-krenso-femra.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017985; classtype:social-engineering; sid:6017985; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-velqix-biz-klonra-zamfur.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-velqix-biz-klonra-zamfur.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017986; classtype:social-engineering; sid:6017986; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-ralniq-biz-pralka-zofdu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-ralniq-biz-pralka-zofdu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017987; classtype:social-engineering; sid:6017987; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-qornex-biz-trusva-jimru.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-qornex-biz-trusva-jimru.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017988; classtype:social-engineering; sid:6017988; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whtsapp-serve.chat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whtsapp-serve.chat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017989; classtype:social-engineering; sid:6017989; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfmewmails.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfmewmails.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017990; classtype:social-engineering; sid:6017990; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (major-cues-495596.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"major-cues-495596.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017991; classtype:social-engineering; sid:6017991; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-qulvex-biz-pramto-nisfu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-qulvex-biz-pramto-nisfu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017992; classtype:social-engineering; sid:6017992; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-morqen-biz-tralsi-fodnek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-morqen-biz-tralsi-fodnek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017993; classtype:social-engineering; sid:6017993; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinitymaill.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinitymaill.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017994; classtype:social-engineering; sid:6017994; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-orliqx-biz-klamta-fodru.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-orliqx-biz-klamta-fodru.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017995; classtype:social-engineering; sid:6017995; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nhn-cafearticles.com/view/315692)"; flow:established,to_server; http.uri; content:"/view/315692"; startswith; fast_pattern; http.host; content:"nhn-cafearticles.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017996; classtype:social-engineering; sid:6017996; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lower-nonogon-665988.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lower-nonogon-665988.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017997; classtype:social-engineering; sid:6017997; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-warniq-biz-trulka-jefmu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-warniq-biz-trulka-jefmu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017998; classtype:social-engineering; sid:6017998; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-xelvoq-biz-pralna-zifmu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-xelvoq-biz-pralna-zifmu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6017999; classtype:social-engineering; sid:6017999; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-cornaq-biz-kralta-fosqi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-cornaq-biz-kralta-fosqi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018000; classtype:social-engineering; sid:6018000; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (applsosj83eugsvdjhsvbdjhvseh-bkhbducngwfzb2b6.z01.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"applsosj83eugsvdjhsvbdjhvseh-bkhbducngwfzb2b6.z01.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018001; classtype:social-engineering; sid:6018001; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-zurnex-biz-tronka-jomra.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-zurnex-biz-tronka-jomra.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018002; classtype:social-engineering; sid:6018002; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robinhood-reward.com/login.html)"; flow:established,to_server; http.uri; content:"/login.html"; startswith; fast_pattern; http.host; content:"robinhood-reward.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018003; classtype:social-engineering; sid:6018003; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vnivok-trelna-2ed83f-vjbyh-6cb712.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vnivok-trelna-2ed83f-vjbyh-6cb712.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018004; classtype:social-engineering; sid:6018004; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (onboarding365.mitarbeiter.onl/vi5yg0qhptuowq9k/)"; flow:established,to_server; http.uri; content:"/vi5yg0qhptuowq9k/"; startswith; fast_pattern; http.host; content:"onboarding365.mitarbeiter.onl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018005; classtype:social-engineering; sid:6018005; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-yarnox-biz-klentra-zomfur.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-yarnox-biz-klentra-zomfur.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018006; classtype:social-engineering; sid:6018006; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.79036.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.79036.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018007; classtype:social-engineering; sid:6018007; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfmewmails.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfmewmails.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018008; classtype:social-engineering; sid:6018008; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-qelnax-biz-prusra-zomqi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-qelnax-biz-prusra-zomqi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018009; classtype:social-engineering; sid:6018009; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwwkaiyun123.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wwwkaiyun123.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018010; classtype:social-engineering; sid:6018010; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-pelnok-biz-klatro-fesvu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-pelnok-biz-klatro-fesvu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018011; classtype:social-engineering; sid:6018011; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-kernaq-biz-plosra-fidkor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-kernaq-biz-plosra-fidkor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018012; classtype:social-engineering; sid:6018012; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tusharsharma2606.github.io/netflix-clone-/)"; flow:established,to_server; http.uri; content:"/netflix-clone-/"; startswith; fast_pattern; http.host; content:"tusharsharma2606.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018013; classtype:social-engineering; sid:6018013; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (82485.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"82485.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018014; classtype:social-engineering; sid:6018014; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-delvra-biz-tramka-jisro.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-delvra-biz-tramka-jisro.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018015; classtype:social-engineering; sid:6018015; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (armaancabling.com/cgi-sys/suspendedpage.cgi?email=redacted@abuse.ionos.com)"; flow:established,to_server; http.uri; content:"/cgi-sys/suspendedpage.cgi?email=redacted@abuse.ionos.com"; startswith; fast_pattern; http.host; content:"armaancabling.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6018016; classtype:social-engineering; sid:6018016; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.1239h8453.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.1239h8453.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6018017; classtype:social-engineering; sid:6018017; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (urls.vn/link-blocked?url=https%3A%2F%2Fcv41519.tw1.ru%2Forange-mail%2Fpages%2Flogin.php)"; flow:established,to_server; http.uri; content:"/link-blocked?url=https%3A%2F%2Fcv41519.tw1.ru%2Forange-mail%2Fpages%2Flogin.php"; startswith; fast_pattern; http.host; content:"urls.vn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6018018; classtype:social-engineering; sid:6018018; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ser.cn-ssl-okooo.com/m/)"; flow:established,to_server; http.uri; content:"/m/"; startswith; fast_pattern; http.host; content:"ser.cn-ssl-okooo.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6018019; classtype:social-engineering; sid:6018019; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hys.appleenespanol.com/63q6pzps/turnstile.php?t=MTc4MzM4ODA1NnwxNzgzMzg4MzU2fDBlZmQ1MzZjMjA0MGJhMzJ8NXxmMzQyMTZlYWNmY2JkM2U4OWRlZWI2M2JhODIyNjg2N3wxMWQwZjY0OTYzZmE1MzRmNGE1OTk5OTIyNjc5MzlmZTMyMWM2Yzg4YTBjMmVlNjQ1MzlhMGU3OWQyYjZmMTVj&r=LzYzcTZwenBzL2d6ZDJwemU4)"; flow:established,to_server; http.uri; content:"/63q6pzps/turnstile.php?t=MTc4MzM4ODA1NnwxNzgzMzg4MzU2fDBlZmQ1MzZjMjA0MGJhMzJ8NXxmMzQyMTZlYWNmY2JkM2U4OWRlZWI2M2JhODIyNjg2N3wxMWQwZjY0OTYzZmE1MzRmNGE1OTk5OTIyNjc5MzlmZTMyMWM2Yzg4YTBjMmVlNjQ1MzlhMGU3OWQyYjZmMTVj&r=LzYzcTZwenBzL2d6ZDJwemU4"; startswith; fast_pattern; http.host; content:"hys.appleenespanol.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6018020; classtype:social-engineering; sid:6018020; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fromagevert.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fromagevert.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6018021; classtype:social-engineering; sid:6018021; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m-relay-creneau.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m-relay-creneau.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6018022; classtype:social-engineering; sid:6018022; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spbkxizjanfz.top/static/upload/resource/caree/invitation/online)"; flow:established,to_server; http.uri; content:"/static/upload/resource/caree/invitation/online"; startswith; fast_pattern; http.host; content:"spbkxizjanfz.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6018023; classtype:social-engineering; sid:6018023; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (discosthoo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"discosthoo.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6018024; classtype:social-engineering; sid:6018024; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hostpichincha.zya.me/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"hostpichincha.zya.me"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6018025; classtype:social-engineering; sid:6018025; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stationnement-antai-gouv-infractions.ukrootsfm.net/fr/facture-electronique/dossie/fr-fr/fr/redirect???%5BUUID%5D)"; flow:established,to_server; http.uri; content:"/fr/facture-electronique/dossie/fr-fr/fr/redirect???%5BUUID%5D"; startswith; fast_pattern; http.host; content:"stationnement-antai-gouv-infractions.ukrootsfm.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6018026; classtype:social-engineering; sid:6018026; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.lokalna-ofeta2570076.shop/oferta/Xbox-Series-S-+-kontroler/372035953)"; flow:established,to_server; http.uri; content:"/oferta/Xbox-Series-S-+-kontroler/372035953"; startswith; fast_pattern; http.host; content:"allegrolokalnie.lokalna-ofeta2570076.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6018027; classtype:social-engineering; sid:6018027; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wakdwfelxdhzjvr.top/static/upload/resource/caree/invitation/online)"; flow:established,to_server; http.uri; content:"/static/upload/resource/caree/invitation/online"; startswith; fast_pattern; http.host; content:"wakdwfelxdhzjvr.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6018028; classtype:social-engineering; sid:6018028; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (etisalte-b.click/ecare/quick-pay/?locale=en)"; flow:established,to_server; http.uri; content:"/ecare/quick-pay/?locale=en"; startswith; fast_pattern; http.host; content:"etisalte-b.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018029; classtype:social-engineering; sid:6018029; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ncafearticle-share.com/view/315692)"; flow:established,to_server; http.uri; content:"/view/315692"; startswith; fast_pattern; http.host; content:"ncafearticle-share.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018030; classtype:social-engineering; sid:6018030; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nitroprestamoappsander-z.azurewebsites.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nitroprestamoappsander-z.azurewebsites.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018031; classtype:social-engineering; sid:6018031; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ulavor-bintel-3b82fc-mrkt-grendal-45x.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ulavor-bintel-3b82fc-mrkt-grendal-45x.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018032; classtype:social-engineering; sid:6018032; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (register.lol.memes.pictures/flex_hours_sign_up/cf66be/5eea31af-6b8e-40c1-9ee6-500878d943e6)"; flow:established,to_server; http.uri; content:"/flex_hours_sign_up/cf66be/5eea31af-6b8e-40c1-9ee6-500878d943e6"; startswith; fast_pattern; http.host; content:"register.lol.memes.pictures"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018033; classtype:social-engineering; sid:6018033; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t69b.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"t69b.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018034; classtype:social-engineering; sid:6018034; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (content.net.ua/registration/content/ua5384/secs/s42356/)"; flow:established,to_server; http.uri; content:"/registration/content/ua5384/secs/s42356/"; startswith; fast_pattern; http.host; content:"content.net.ua"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018035; classtype:social-engineering; sid:6018035; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (duiprsssapr.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"duiprsssapr.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018036; classtype:social-engineering; sid:6018036; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rakshithac11.github.io/NetflixClone)"; flow:established,to_server; http.uri; content:"/NetflixClone"; startswith; fast_pattern; http.host; content:"rakshithac11.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018037; classtype:social-engineering; sid:6018037; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (checkpoint--6a47cf36b5aec66b91570fd1--6a47deb934bc8237d617541a.base44.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"checkpoint--6a47cf36b5aec66b91570fd1--6a47deb934bc8237d617541a.base44.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018038; classtype:social-engineering; sid:6018038; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.92281935118.fx1.uyohse.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.92281935118.fx1.uyohse.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018039; classtype:social-engineering; sid:6018039; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bbiwbsiw-tech.github.io/Bima)"; flow:established,to_server; http.uri; content:"/Bima"; startswith; fast_pattern; http.host; content:"bbiwbsiw-tech.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018040; classtype:social-engineering; sid:6018040; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shruti-sharma09.github.io/Study-track/)"; flow:established,to_server; http.uri; content:"/Study-track/"; startswith; fast_pattern; http.host; content:"shruti-sharma09.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018041; classtype:social-engineering; sid:6018041; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (biobioaldia.cl/fdx/fedexattach.html)"; flow:established,to_server; http.uri; content:"/fdx/fedexattach.html"; startswith; fast_pattern; http.host; content:"biobioaldia.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018042; classtype:social-engineering; sid:6018042; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (expense-tracker-app-9903d9.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"expense-tracker-app-9903d9.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018043; classtype:social-engineering; sid:6018043; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.net-flick.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.net-flick.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018044; classtype:social-engineering; sid:6018044; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sps.xgfc9999.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sps.xgfc9999.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018045; classtype:social-engineering; sid:6018045; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ashishasahu.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"ashishasahu.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018046; classtype:social-engineering; sid:6018046; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.customdesignsuk.com/wp-content/plugins/uiesogydga/var/index.html)"; flow:established,to_server; http.uri; content:"/wp-content/plugins/uiesogydga/var/index.html"; startswith; fast_pattern; http.host; content:"www.customdesignsuk.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018047; classtype:social-engineering; sid:6018047; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bebidasdelivery-ze.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bebidasdelivery-ze.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018048; classtype:social-engineering; sid:6018048; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-farniq-biz-krolta-femru.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-farniq-biz-krolta-femru.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018049; classtype:social-engineering; sid:6018049; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (triqu.vercel.app/tc)"; flow:established,to_server; http.uri; content:"/tc"; startswith; fast_pattern; http.host; content:"triqu.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018050; classtype:social-engineering; sid:6018050; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ihtisham-dev.github.io/amazon-clone-ui/)"; flow:established,to_server; http.uri; content:"/amazon-clone-ui/"; startswith; fast_pattern; http.host; content:"ihtisham-dev.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018051; classtype:social-engineering; sid:6018051; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ttmgame28112006-alt.github.io/shopee/)"; flow:established,to_server; http.uri; content:"/shopee/"; startswith; fast_pattern; http.host; content:"ttmgame28112006-alt.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018052; classtype:social-engineering; sid:6018052; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (duiprsssapr.click/webapp/en/quick-recharge)"; flow:established,to_server; http.uri; content:"/webapp/en/quick-recharge"; startswith; fast_pattern; http.host; content:"duiprsssapr.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018053; classtype:social-engineering; sid:6018053; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kkotwal961-pixel.github.io/pella-login)"; flow:established,to_server; http.uri; content:"/pella-login"; startswith; fast_pattern; http.host; content:"kkotwal961-pixel.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018054; classtype:social-engineering; sid:6018054; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pranav10-dotcom.github.io/Netflix_Clone/)"; flow:established,to_server; http.uri; content:"/Netflix_Clone/"; startswith; fast_pattern; http.host; content:"pranav10-dotcom.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018055; classtype:social-engineering; sid:6018055; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dukeplamzes.click/webapp/en/quick-recharge)"; flow:established,to_server; http.uri; content:"/webapp/en/quick-recharge"; startswith; fast_pattern; http.host; content:"dukeplamzes.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018056; classtype:social-engineering; sid:6018056; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (frostresury.cc:443/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"frostresury.cc:443"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018057; classtype:social-engineering; sid:6018057; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (other-aqua-2qb7qzos.edgeone.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"other-aqua-2qb7qzos.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018058; classtype:social-engineering; sid:6018058; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (manasakonnur-bit.github.io/Netflix/)"; flow:established,to_server; http.uri; content:"/Netflix/"; startswith; fast_pattern; http.host; content:"manasakonnur-bit.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018059; classtype:social-engineering; sid:6018059; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (balbhadra-singh43.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"balbhadra-singh43.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018060; classtype:social-engineering; sid:6018060; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezr-suite-explor-sensiors.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezr-suite-explor-sensiors.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018061; classtype:social-engineering; sid:6018061; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lucas-henriquedias.github.io/streaming-ui-clone/catalogo/catalogo.html)"; flow:established,to_server; http.uri; content:"/streaming-ui-clone/catalogo/catalogo.html"; startswith; fast_pattern; http.host; content:"lucas-henriquedias.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018062; classtype:social-engineering; sid:6018062; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b2t3-5lil-tv2q.robert-sincii-com-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b2t3-5lil-tv2q.robert-sincii-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018063; classtype:social-engineering; sid:6018063; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (staticfile-878b7.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"staticfile-878b7.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018064; classtype:social-engineering; sid:6018064; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (duspmlcllmlr.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"duspmlcllmlr.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018065; classtype:social-engineering; sid:6018065; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (duopelasmcz.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"duopelasmcz.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018066; classtype:social-engineering; sid:6018066; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (olonex-fursa-a7c109-wplm-thrr.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"olonex-fursa-a7c109-wplm-thrr.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018067; classtype:social-engineering; sid:6018067; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (japan-aotucheck.index-sign013.saudhkuas10.cc/5f4dcc3b5aa765d61d8327deb882cf99/)"; flow:established,to_server; http.uri; content:"/5f4dcc3b5aa765d61d8327deb882cf99/"; startswith; fast_pattern; http.host; content:"japan-aotucheck.index-sign013.saudhkuas10.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018068; classtype:social-engineering; sid:6018068; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maxsiay.us.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"maxsiay.us.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018069; classtype:social-engineering; sid:6018069; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whtsapp-safty.help/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whtsapp-safty.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018070; classtype:social-engineering; sid:6018070; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sxxjxjz.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sxxjxjz.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018071; classtype:social-engineering; sid:6018071; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (triqu.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"triqu.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018072; classtype:social-engineering; sid:6018072; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-korvax-biz-klomso-fedmir.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-korvax-biz-klomso-fedmir.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018073; classtype:social-engineering; sid:6018073; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.come.ac/HFO1C/)"; flow:established,to_server; http.uri; content:"/HFO1C/"; startswith; fast_pattern; http.host; content:"www.come.ac"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018074; classtype:social-engineering; sid:6018074; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (duokplamser.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"duokplamser.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018075; classtype:social-engineering; sid:6018075; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-polvak-biz-klusko-zamfir.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-polvak-biz-klusko-zamfir.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018076; classtype:social-engineering; sid:6018076; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j68m.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j68m.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018077; classtype:social-engineering; sid:6018077; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.teamlz.com/p/sst-cgj/lctwghft/)"; flow:established,to_server; http.uri; content:"/p/sst-cgj/lctwghft/"; startswith; fast_pattern; http.host; content:"s.teamlz.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018078; classtype:social-engineering; sid:6018078; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spidaccediaruba.bar/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spidaccediaruba.bar"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018079; classtype:social-engineering; sid:6018079; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktivasi-pemulihann-bimaa-mobile.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktivasi-pemulihann-bimaa-mobile.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018080; classtype:social-engineering; sid:6018080; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kunalshinde2008.github.io/my_first_project/)"; flow:established,to_server; http.uri; content:"/my_first_project/"; startswith; fast_pattern; http.host; content:"kunalshinde2008.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018081; classtype:social-engineering; sid:6018081; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365outlookcl.webcindario.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"365outlookcl.webcindario.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018082; classtype:social-engineering; sid:6018082; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maxisba.com/tll?_eat=valid_20260706225112_ad2ef4460f78535001ea3a3cfc9c13a1)"; flow:established,to_server; http.uri; content:"/tll?_eat=valid_20260706225112_ad2ef4460f78535001ea3a3cfc9c13a1"; startswith; fast_pattern; http.host; content:"maxisba.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018083; classtype:social-engineering; sid:6018083; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (teamgenesispro.com/gg/securedoc.html)"; flow:established,to_server; http.uri; content:"/gg/securedoc.html"; startswith; fast_pattern; http.host; content:"teamgenesispro.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018084; classtype:social-engineering; sid:6018084; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mahhadev3299-collab.github.io/randompeo2/)"; flow:established,to_server; http.uri; content:"/randompeo2/"; startswith; fast_pattern; http.host; content:"mahhadev3299-collab.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018085; classtype:social-engineering; sid:6018085; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (duspmlcllmlr.click/webapp/en/quick-recharge)"; flow:established,to_server; http.uri; content:"/webapp/en/quick-recharge"; startswith; fast_pattern; http.host; content:"duspmlcllmlr.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018086; classtype:social-engineering; sid:6018086; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (registropersonalizado.lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"registropersonalizado.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018087; classtype:social-engineering; sid:6018087; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ze-express.com/pedidos/index.html)"; flow:established,to_server; http.uri; content:"/pedidos/index.html"; startswith; fast_pattern; http.host; content:"ze-express.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018088; classtype:social-engineering; sid:6018088; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktivasi-newbimamobilee.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktivasi-newbimamobilee.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018089; classtype:social-engineering; sid:6018089; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (attmailyahoo.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"attmailyahoo.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018090; classtype:social-engineering; sid:6018090; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (khushitiwari78.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"khushitiwari78.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018091; classtype:social-engineering; sid:6018091; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wathummoise1-crypto.github.io/instagtram)"; flow:established,to_server; http.uri; content:"/instagtram"; startswith; fast_pattern; http.host; content:"wathummoise1-crypto.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018092; classtype:social-engineering; sid:6018092; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deepika-m-06.github.io/instagram)"; flow:established,to_server; http.uri; content:"/instagram"; startswith; fast_pattern; http.host; content:"deepika-m-06.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018093; classtype:social-engineering; sid:6018093; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-norqix-biz-tralka-zolmur.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-norqix-biz-tralka-zolmur.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018094; classtype:social-engineering; sid:6018094; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maxicre-aul-apl-san.azurewebsites.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"maxicre-aul-apl-san.azurewebsites.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018095; classtype:social-engineering; sid:6018095; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortrun.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortrun.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018096; classtype:social-engineering; sid:6018096; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (21734265559.fx1.uyohse.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"21734265559.fx1.uyohse.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018097; classtype:social-engineering; sid:6018097; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j275y.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j275y.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018098; classtype:social-engineering; sid:6018098; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (muda34026-droid.github.io/Bima/)"; flow:established,to_server; http.uri; content:"/Bima/"; startswith; fast_pattern; http.host; content:"muda34026-droid.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018099; classtype:social-engineering; sid:6018099; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (duopelasmcz.click/webapp/en/quick-recharge)"; flow:established,to_server; http.uri; content:"/webapp/en/quick-recharge"; startswith; fast_pattern; http.host; content:"duopelasmcz.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018100; classtype:social-engineering; sid:6018100; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiscalgrupoconta.lol/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fiscalgrupoconta.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018101; classtype:social-engineering; sid:6018101; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (duokplamser.click/webapp/en/quick-recharge)"; flow:established,to_server; http.uri; content:"/webapp/en/quick-recharge"; startswith; fast_pattern; http.host; content:"duokplamser.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018102; classtype:social-engineering; sid:6018102; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mobilieellu.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mobilieellu.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018103; classtype:social-engineering; sid:6018103; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fortch.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fortch.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018104; classtype:social-engineering; sid:6018104; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lzut.org/pass/login.php)"; flow:established,to_server; http.uri; content:"/pass/login.php"; startswith; fast_pattern; http.host; content:"lzut.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018105; classtype:social-engineering; sid:6018105; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (falabe-lla.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"falabe-lla.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018106; classtype:social-engineering; sid:6018106; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-nalroq-biz-trenka-jodmi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-nalroq-biz-trenka-jodmi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018107; classtype:social-engineering; sid:6018107; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shapeuclinic.in/myGov/au/Sign-in/index4.php/)"; flow:established,to_server; http.uri; content:"/myGov/au/Sign-in/index4.php/"; startswith; fast_pattern; http.host; content:"shapeuclinic.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018108; classtype:social-engineering; sid:6018108; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (floppoker.com.br/odk/all11.html?eta=3mail@a.b.c0/)"; flow:established,to_server; http.uri; content:"/odk/all11.html?eta=3mail@a.b.c0/"; startswith; fast_pattern; http.host; content:"floppoker.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018109; classtype:social-engineering; sid:6018109; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-carniq-biz-klomta-fimlur.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-carniq-biz-klomta-fimlur.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018110; classtype:social-engineering; sid:6018110; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gene-bete.github.io/clone-de-facebook/)"; flow:established,to_server; http.uri; content:"/clone-de-facebook/"; startswith; fast_pattern; http.host; content:"gene-bete.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018111; classtype:social-engineering; sid:6018111; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (phsyan.fr/factura/)"; flow:established,to_server; http.uri; content:"/factura/"; startswith; fast_pattern; http.host; content:"phsyan.fr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018112; classtype:social-engineering; sid:6018112; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bts-cge.028426.com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/"; startswith; fast_pattern; http.host; content:"bts-cge.028426.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018113; classtype:social-engineering; sid:6018113; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bbviop.com/ph/home)"; flow:established,to_server; http.uri; content:"/ph/home"; startswith; fast_pattern; http.host; content:"bbviop.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018114; classtype:social-engineering; sid:6018114; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreidoo2ntxsznkk4fx2p34ro3gud6vi3x2y5ktzu7hrimjg6quoyczu.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreidoo2ntxsznkk4fx2p34ro3gud6vi3x2y5ktzu7hrimjg6quoyczu.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018115; classtype:social-engineering; sid:6018115; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.vectorseek.techngraphic.website/wp-content/cache/asp/tmp/verif1.php)"; flow:established,to_server; http.uri; content:"/wp-content/cache/asp/tmp/verif1.php"; startswith; fast_pattern; http.host; content:"www.vectorseek.techngraphic.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018116; classtype:social-engineering; sid:6018116; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (texts-claims-esl-org.lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"texts-claims-esl-org.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018117; classtype:social-engineering; sid:6018117; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mobile-bimaaktivasi-pemulihan.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mobile-bimaaktivasi-pemulihan.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018118; classtype:social-engineering; sid:6018118; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gh.sdtznt.com/netty/)"; flow:established,to_server; http.uri; content:"/netty/"; startswith; fast_pattern; http.host; content:"gh.sdtznt.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018119; classtype:social-engineering; sid:6018119; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.secureaccess.sbs/vsl/)"; flow:established,to_server; http.uri; content:"/vsl/"; startswith; fast_pattern; http.host; content:"www.secureaccess.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018120; classtype:social-engineering; sid:6018120; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (etisalcspre.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"etisalcspre.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018121; classtype:social-engineering; sid:6018121; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pawpal-001-site1.ltempurl.com/hype/continue/N56XI/Crd.php)"; flow:established,to_server; http.uri; content:"/hype/continue/N56XI/Crd.php"; startswith; fast_pattern; http.host; content:"pawpal-001-site1.ltempurl.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018122; classtype:social-engineering; sid:6018122; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lcp-x402-coinbase-web.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lcp-x402-coinbase-web.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018123; classtype:social-engineering; sid:6018123; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (checkpoint--6a47cf36b5aec66b91570fd1--6a47d65e54170d574d74b93d.base44.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"checkpoint--6a47cf36b5aec66b91570fd1--6a47d65e54170d574d74b93d.base44.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018124; classtype:social-engineering; sid:6018124; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktivasi-bimaa.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktivasi-bimaa.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018125; classtype:social-engineering; sid:6018125; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (techhubsolutions78.github.io/landingpage1)"; flow:established,to_server; http.uri; content:"/landingpage1"; startswith; fast_pattern; http.host; content:"techhubsolutions78.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018126; classtype:social-engineering; sid:6018126; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (craxil-nomber-2e81ac-kthn-dravik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"craxil-nomber-2e81ac-kthn-dravik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018127; classtype:social-engineering; sid:6018127; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-polrix-biz-klamve-zurniq.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-polrix-biz-klamve-zurniq.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018128; classtype:social-engineering; sid:6018128; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bills-5xb.pages.dev/credit_ledger)"; flow:established,to_server; http.uri; content:"/credit_ledger"; startswith; fast_pattern; http.host; content:"bills-5xb.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018129; classtype:social-engineering; sid:6018129; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alufast.com.br/Contractdocument/Contract_Document768726.html)"; flow:established,to_server; http.uri; content:"/Contractdocument/Contract_Document768726.html"; startswith; fast_pattern; http.host; content:"alufast.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018130; classtype:social-engineering; sid:6018130; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (etisalcmpez.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"etisalcmpez.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018131; classtype:social-engineering; sid:6018131; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.r17e.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.r17e.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018132; classtype:social-engineering; sid:6018132; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17870.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17870.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018133; classtype:social-engineering; sid:6018133; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telnavi-gld-zarqumi-a2x9dw67.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"telnavi-gld-zarqumi-a2x9dw67.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018134; classtype:social-engineering; sid:6018134; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bourrel-enregies.fr/clouddesks/)"; flow:established,to_server; http.uri; content:"/clouddesks/"; startswith; fast_pattern; http.host; content:"bourrel-enregies.fr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018135; classtype:social-engineering; sid:6018135; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cloud-demolition.jp/Aeroplans/shaw/?id=033)"; flow:established,to_server; http.uri; content:"/Aeroplans/shaw/?id=033"; startswith; fast_pattern; http.host; content:"www.cloud-demolition.jp"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018136; classtype:social-engineering; sid:6018136; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (etisalcspre.click/ecare/quick-pay/?locale=en)"; flow:established,to_server; http.uri; content:"/ecare/quick-pay/?locale=en"; startswith; fast_pattern; http.host; content:"etisalcspre.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018137; classtype:social-engineering; sid:6018137; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (autoescolaantunes.com.br/chart/)"; flow:established,to_server; http.uri; content:"/chart/"; startswith; fast_pattern; http.host; content:"autoescolaantunes.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018138; classtype:social-engineering; sid:6018138; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (truea1dsbkdhbsdsbjhsbdkjnadkjds-c4c8agc3fadrdub8.z02.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"truea1dsbkdhbsdsbjhsbdkjnadkjds-c4c8agc3fadrdub8.z02.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018139; classtype:social-engineering; sid:6018139; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.chubatya.ru/rbx1000/)"; flow:established,to_server; http.uri; content:"/rbx1000/"; startswith; fast_pattern; http.host; content:"www.chubatya.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018140; classtype:social-engineering; sid:6018140; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (olimit-bucketnuorigemprime.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"olimit-bucketnuorigemprime.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018141; classtype:social-engineering; sid:6018141; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (92281935118.fx1.uyohse.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"92281935118.fx1.uyohse.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018142; classtype:social-engineering; sid:6018142; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (duilapcmrez.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"duilapcmrez.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018143; classtype:social-engineering; sid:6018143; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (payment-limitsnivelnuexecutivo.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"payment-limitsnivelnuexecutivo.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018144; classtype:social-engineering; sid:6018144; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (irenox-filda-qa3006tgb-shrr-qonvek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"irenox-filda-qa3006tgb-shrr-qonvek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018145; classtype:social-engineering; sid:6018145; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-drenoq-biz-klavri-zunfar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-drenoq-biz-klavri-zunfar.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018146; classtype:social-engineering; sid:6018146; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dlonex-fursa-c7e104-rgtt-ponvek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dlonex-fursa-c7e104-rgtt-ponvek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018147; classtype:social-engineering; sid:6018147; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (etisapclesm.click/ecare/quick-pay/?locale=en)"; flow:established,to_server; http.uri; content:"/ecare/quick-pay/?locale=en"; startswith; fast_pattern; http.host; content:"etisapclesm.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018148; classtype:social-engineering; sid:6018148; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docusign-verify-auth.eportalsecure.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"docusign-verify-auth.eportalsecure.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018149; classtype:social-engineering; sid:6018149; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tt-verification-form.d2g.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tt-verification-form.d2g.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018150; classtype:social-engineering; sid:6018150; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (glamorous-peach-9hnztjgarn-14jr83uwox.edgeone.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"glamorous-peach-9hnztjgarn-14jr83uwox.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018151; classtype:social-engineering; sid:6018151; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (duielapsmer.click/webapp/en/quick-recharge)"; flow:established,to_server; http.uri; content:"/webapp/en/quick-recharge"; startswith; fast_pattern; http.host; content:"duielapsmer.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018152; classtype:social-engineering; sid:6018152; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (boletines0.intico.co/c/ne4r4790/3loojxuc/mujfx1y_cnq)"; flow:established,to_server; http.uri; content:"/c/ne4r4790/3loojxuc/mujfx1y_cnq"; startswith; fast_pattern; http.host; content:"boletines0.intico.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018153; classtype:social-engineering; sid:6018153; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.92281935118.fx1.uyohse.icu/h5/)"; flow:established,to_server; http.uri; content:"/h5/"; startswith; fast_pattern; http.host; content:"www.92281935118.fx1.uyohse.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018154; classtype:social-engineering; sid:6018154; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faizan-khanjada.github.io/amazon-web-clone/)"; flow:established,to_server; http.uri; content:"/amazon-web-clone/"; startswith; fast_pattern; http.host; content:"faizan-khanjada.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018155; classtype:social-engineering; sid:6018155; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wetransfdoc.iceiy.com/Wetrnsf.html)"; flow:established,to_server; http.uri; content:"/Wetrnsf.html"; startswith; fast_pattern; http.host; content:"wetransfdoc.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018156; classtype:social-engineering; sid:6018156; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.team-jk.com/p/fhtb-mrgw/nwjrmgwv/)"; flow:established,to_server; http.uri; content:"/p/fhtb-mrgw/nwjrmgwv/"; startswith; fast_pattern; http.host; content:"s.team-jk.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018157; classtype:social-engineering; sid:6018157; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (signinverify.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"signinverify.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018158; classtype:social-engineering; sid:6018158; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bima-mobile-aktivasi-pemulihan.edgeone.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bima-mobile-aktivasi-pemulihan.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018159; classtype:social-engineering; sid:6018159; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jxqc99.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jxqc99.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018160; classtype:social-engineering; sid:6018160; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bpivfdbhg.com/ph/home)"; flow:established,to_server; http.uri; content:"/ph/home"; startswith; fast_pattern; http.host; content:"bpivfdbhg.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018161; classtype:social-engineering; sid:6018161; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (versed-secure-session-shield.base44.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"versed-secure-session-shield.base44.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018162; classtype:social-engineering; sid:6018162; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (etisalmcpex.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"etisalmcpex.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018163; classtype:social-engineering; sid:6018163; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (online-cashpro-bofa.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"online-cashpro-bofa.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018164; classtype:social-engineering; sid:6018164; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hello-1g.vercel.app/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"hello-1g.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018165; classtype:social-engineering; sid:6018165; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mr-bel-informations.bolt.host/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"mr-bel-informations.bolt.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018166; classtype:social-engineering; sid:6018166; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (etisapclesm.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"etisapclesm.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018167; classtype:social-engineering; sid:6018167; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cqcp9988.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cqcp9988.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018168; classtype:social-engineering; sid:6018168; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dujaselcmpe.click/webapp/en/quick-recharge)"; flow:established,to_server; http.uri; content:"/webapp/en/quick-recharge"; startswith; fast_pattern; http.host; content:"dujaselcmpe.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018169; classtype:social-engineering; sid:6018169; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (investigation-workspace.com/cb/loading)"; flow:established,to_server; http.uri; content:"/cb/loading"; startswith; fast_pattern; http.host; content:"investigation-workspace.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018170; classtype:social-engineering; sid:6018170; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abinaya-pec.github.io/clone/)"; flow:established,to_server; http.uri; content:"/clone/"; startswith; fast_pattern; http.host; content:"abinaya-pec.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018171; classtype:social-engineering; sid:6018171; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (php-web-server--luismenxizcastr.replit.app/index3.php)"; flow:established,to_server; http.uri; content:"/index3.php"; startswith; fast_pattern; http.host; content:"php-web-server--luismenxizcastr.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018172; classtype:social-engineering; sid:6018172; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpotventsnotariars.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.dpotventsnotariars.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018173; classtype:social-engineering; sid:6018173; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (checkpoint--6a47cf36b5aec66b91570fd1--6a47d7150db8e9a48f162dab.base44.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"checkpoint--6a47cf36b5aec66b91570fd1--6a47d7150db8e9a48f162dab.base44.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018174; classtype:social-engineering; sid:6018174; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (text-claims-esl-org.lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"text-claims-esl-org.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018175; classtype:social-engineering; sid:6018175; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web.walletsync-dapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web.walletsync-dapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018176; classtype:social-engineering; sid:6018176; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagramclone-smoky.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagramclone-smoky.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018177; classtype:social-engineering; sid:6018177; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prachi09890.github.io/NETFLIX/)"; flow:established,to_server; http.uri; content:"/NETFLIX/"; startswith; fast_pattern; http.host; content:"prachi09890.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018178; classtype:social-engineering; sid:6018178; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopifysite.cn/themes)"; flow:established,to_server; http.uri; content:"/themes"; startswith; fast_pattern; http.host; content:"shopifysite.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018179; classtype:social-engineering; sid:6018179; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cargosprint.shop/n/general.html)"; flow:established,to_server; http.uri; content:"/n/general.html"; startswith; fast_pattern; http.host; content:"cargosprint.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018180; classtype:social-engineering; sid:6018180; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spectrum-email-services-101043.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spectrum-email-services-101043.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018181; classtype:social-engineering; sid:6018181; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (etisalcmrex.click/ecare/quick-pay/?locale=en)"; flow:established,to_server; http.uri; content:"/ecare/quick-pay/?locale=en"; startswith; fast_pattern; http.host; content:"etisalcmrex.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018182; classtype:social-engineering; sid:6018182; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.codedetrichelattaquedeszombieroblox.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.codedetrichelattaquedeszombieroblox.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018183; classtype:social-engineering; sid:6018183; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (postage-ins-anti-couple.trycloudflare.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"postage-ins-anti-couple.trycloudflare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018184; classtype:social-engineering; sid:6018184; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.70105.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.70105.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018185; classtype:social-engineering; sid:6018185; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (obvious-fairly-coalition-gonna.trycloudflare.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"obvious-fairly-coalition-gonna.trycloudflare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018186; classtype:social-engineering; sid:6018186; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail_clthomas.kmdastur.co/outlookencrpt/mins.html?775&1*1howd4r*_up*MQ..*_gs*MQ..&gclid=CjwKCAjw6s7CBhACEiwAuHQckmMG4jVCQEvK3DNGEDrqDGuST1wMvQ9_63A__PM9DZlTksBhfJzmTBoC28MQAvD_BwE&gbraid=0AAAAAD_qHs_7MG)"; flow:established,to_server; http.uri; content:"/outlookencrpt/mins.html?775&1*1howd4r*_up*MQ..*_gs*MQ..&gclid=CjwKCAjw6s7CBhACEiwAuHQckmMG4jVCQEvK3DNGEDrqDGuST1wMvQ9_63A__PM9DZlTksBhfJzmTBoC28MQAvD_BwE&gbraid=0AAAAAD_qHs_7MG"; startswith; fast_pattern; http.host; content:"mail_clthomas.kmdastur.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018187; classtype:social-engineering; sid:6018187; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adityagit-code.github.io/Facebook-UI/)"; flow:established,to_server; http.uri; content:"/Facebook-UI/"; startswith; fast_pattern; http.host; content:"adityagit-code.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018188; classtype:social-engineering; sid:6018188; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rawandphone122-sys.github.io/instagram-videos-kurdM-hasikokoh87674bvcvxkcxjfcshlbvtufx)"; flow:established,to_server; http.uri; content:"/instagram-videos-kurdM-hasikokoh87674bvcvxkcxjfcshlbvtufx"; startswith; fast_pattern; http.host; content:"rawandphone122-sys.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018189; classtype:social-engineering; sid:6018189; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rajulapatibalaji931-cloud.github.io/task-3)"; flow:established,to_server; http.uri; content:"/task-3"; startswith; fast_pattern; http.host; content:"rajulapatibalaji931-cloud.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018190; classtype:social-engineering; sid:6018190; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17870.xyz/m/)"; flow:established,to_server; http.uri; content:"/m/"; startswith; fast_pattern; http.host; content:"17870.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018191; classtype:social-engineering; sid:6018191; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-purnok-biz-tronka-josmu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-purnok-biz-tronka-josmu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018192; classtype:social-engineering; sid:6018192; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brenox-filda-d5c471-shrr.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"brenox-filda-d5c471-shrr.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018193; classtype:social-engineering; sid:6018193; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-zalqix-biz-klesvo-jidmur.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-zalqix-biz-klesvo-jidmur.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018194; classtype:social-engineering; sid:6018194; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sander-aul-crediapp.azurewebsites.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sander-aul-crediapp.azurewebsites.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018195; classtype:social-engineering; sid:6018195; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktivasiii-pemulihan-bima-mobile.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktivasiii-pemulihan-bima-mobile.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018196; classtype:social-engineering; sid:6018196; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fls-a1eaceca-fdc7-4744-a102-835c501a9e99.laravel.cloud/R-WeTransferdtohg23.html)"; flow:established,to_server; http.uri; content:"/R-WeTransferdtohg23.html"; startswith; fast_pattern; http.host; content:"fls-a1eaceca-fdc7-4744-a102-835c501a9e99.laravel.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018197; classtype:social-engineering; sid:6018197; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (steancommunitly.ru/profiles/7643223459292)"; flow:established,to_server; http.uri; content:"/profiles/7643223459292"; startswith; fast_pattern; http.host; content:"steancommunitly.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018198; classtype:social-engineering; sid:6018198; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (92281935118.fx1.uyohse.icu/h5/)"; flow:established,to_server; http.uri; content:"/h5/"; startswith; fast_pattern; http.host; content:"92281935118.fx1.uyohse.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018199; classtype:social-engineering; sid:6018199; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dukeplamzes.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dukeplamzes.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018200; classtype:social-engineering; sid:6018200; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p3k8z1m6q9v2.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p3k8z1m6q9v2.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018201; classtype:social-engineering; sid:6018201; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mtb-treasurycentr.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mtb-treasurycentr.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018202; classtype:social-engineering; sid:6018202; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-xarnex-biz-krosva-fesmu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-xarnex-biz-krosva-fesmu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018203; classtype:social-engineering; sid:6018203; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-dalqen-biz-trunka-zifqel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-dalqen-biz-trunka-zifqel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018204; classtype:social-engineering; sid:6018204; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j99o.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j99o.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018205; classtype:social-engineering; sid:6018205; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (limpahojeagora.shop/offer/?gad_source=)"; flow:established,to_server; http.uri; content:"/offer/?gad_source="; startswith; fast_pattern; http.host; content:"limpahojeagora.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018206; classtype:social-engineering; sid:6018206; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17875.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17875.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018207; classtype:social-engineering; sid:6018207; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (revisar-netf.bolt.host/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"revisar-netf.bolt.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018208; classtype:social-engineering; sid:6018208; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dancing-froyo-1eba9c.netlify.app/?IDTnFzy=ravik@f94b9987d5d3319ab3c09a698d517729a768.org)"; flow:established,to_server; http.uri; content:"/?IDTnFzy=ravik@f94b9987d5d3319ab3c09a698d517729a768.org"; startswith; fast_pattern; http.host; content:"dancing-froyo-1eba9c.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018209; classtype:social-engineering; sid:6018209; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.h23z.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.h23z.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018210; classtype:social-engineering; sid:6018210; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (etisalmcpex.click/ecare/quick-pay/?locale=en)"; flow:established,to_server; http.uri; content:"/ecare/quick-pay/?locale=en"; startswith; fast_pattern; http.host; content:"etisalmcpex.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018211; classtype:social-engineering; sid:6018211; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ulavor-bintel-3b82fc-mrkt-grendal.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ulavor-bintel-3b82fc-mrkt-grendal.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018212; classtype:social-engineering; sid:6018212; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tricolor-kappa.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.tricolor-kappa.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018213; classtype:social-engineering; sid:6018213; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tt-verification-form.d2g.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.tt-verification-form.d2g.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018214; classtype:social-engineering; sid:6018214; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (h26a.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"h26a.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018215; classtype:social-engineering; sid:6018215; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktivasipemuluhanbimamobile.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktivasipemuluhanbimamobile.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018216; classtype:social-engineering; sid:6018216; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (etisalcpres.click/ecare/quick-pay/?locale=en)"; flow:established,to_server; http.uri; content:"/ecare/quick-pay/?locale=en"; startswith; fast_pattern; http.host; content:"etisalcpres.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018217; classtype:social-engineering; sid:6018217; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-page-editor--ruckerrs54.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-page-editor--ruckerrs54.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018218; classtype:social-engineering; sid:6018218; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-tarnix-biz-prenra-zulfor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-tarnix-biz-prenra-zulfor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018219; classtype:social-engineering; sid:6018219; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.muvbaioeiz.my/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.muvbaioeiz.my"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018220; classtype:social-engineering; sid:6018220; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.88jdcp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.88jdcp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018221; classtype:social-engineering; sid:6018221; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acceso-sander-app-website.azurewebsites.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"acceso-sander-app-website.azurewebsites.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018222; classtype:social-engineering; sid:6018222; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dujaselcmpe.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dujaselcmpe.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018223; classtype:social-engineering; sid:6018223; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (etisalte-b.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"etisalte-b.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018224; classtype:social-engineering; sid:6018224; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (investigation-workspace.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"investigation-workspace.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018225; classtype:social-engineering; sid:6018225; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pagelpa.xin/d-h-l/)"; flow:established,to_server; http.uri; content:"/d-h-l/"; startswith; fast_pattern; http.host; content:"pagelpa.xin"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018226; classtype:social-engineering; sid:6018226; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (checkpoint--6a47cf36b5aec66b91570fd1--6a47dd745b7d34c502cb6360.base44.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"checkpoint--6a47cf36b5aec66b91570fd1--6a47dd745b7d34c502cb6360.base44.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018227; classtype:social-engineering; sid:6018227; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cloud-demolition.jp/Aeroplans/shaw/)"; flow:established,to_server; http.uri; content:"/Aeroplans/shaw/"; startswith; fast_pattern; http.host; content:"www.cloud-demolition.jp"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018228; classtype:social-engineering; sid:6018228; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-ovrnex-biz-krasna-felqi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-ovrnex-biz-krasna-felqi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018229; classtype:social-engineering; sid:6018229; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (k4w7rd.eu.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"k4w7rd.eu.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018230; classtype:social-engineering; sid:6018230; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.j77y.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.j77y.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018231; classtype:social-engineering; sid:6018231; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.teams-re.com/p/fjbd-cbch/ahonners/)"; flow:established,to_server; http.uri; content:"/p/fjbd-cbch/ahonners/"; startswith; fast_pattern; http.host; content:"s.teams-re.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018232; classtype:social-engineering; sid:6018232; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (etisalcpres.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"etisalcpres.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018233; classtype:social-engineering; sid:6018233; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whhaattss.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whhaattss.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018234; classtype:social-engineering; sid:6018234; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pai1nel1client.v6.rocks/565AS5D/692135415965043364220/home.php?hash=17490660946a4b8fd9e51b19.10367848)"; flow:established,to_server; http.uri; content:"/565AS5D/692135415965043364220/home.php?hash=17490660946a4b8fd9e51b19.10367848"; startswith; fast_pattern; http.host; content:"pai1nel1client.v6.rocks"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018235; classtype:social-engineering; sid:6018235; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (outlookvalidardatosmsn-whatsapp.iceiy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"outlookvalidardatosmsn-whatsapp.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018236; classtype:social-engineering; sid:6018236; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (etisalcmpez.click/ecare/quick-pay/?locale=en)"; flow:established,to_server; http.uri; content:"/ecare/quick-pay/?locale=en"; startswith; fast_pattern; http.host; content:"etisalcmpez.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018237; classtype:social-engineering; sid:6018237; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blueconcept.ae/Adobesharefile)"; flow:established,to_server; http.uri; content:"/Adobesharefile"; startswith; fast_pattern; http.host; content:"blueconcept.ae"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018238; classtype:social-engineering; sid:6018238; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (search.app/dTaYq)"; flow:established,to_server; http.uri; content:"/dTaYq"; startswith; fast_pattern; http.host; content:"search.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018239; classtype:social-engineering; sid:6018239; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xk29tswucamm4dblt-whngpmyiy0o9jhazfawiwso.vercel.app/ljwsretje578hfgsw35sdh.html)"; flow:established,to_server; http.uri; content:"/ljwsretje578hfgsw35sdh.html"; startswith; fast_pattern; http.host; content:"xk29tswucamm4dblt-whngpmyiy0o9jhazfawiwso.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018240; classtype:social-engineering; sid:6018240; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (https--www-roblox.cam/users/1179291790/profile)"; flow:established,to_server; http.uri; content:"/users/1179291790/profile"; startswith; fast_pattern; http.host; content:"https--www-roblox.cam"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018241; classtype:social-engineering; sid:6018241; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-belvoq-biz-pralko-zefra.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-belvoq-biz-pralko-zefra.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018242; classtype:social-engineering; sid:6018242; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (21734265559.fx1.uyohse.icu/h5/)"; flow:established,to_server; http.uri; content:"/h5/"; startswith; fast_pattern; http.host; content:"21734265559.fx1.uyohse.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018243; classtype:social-engineering; sid:6018243; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-horvex-biz-klentra-fudkor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-horvex-biz-klentra-fudkor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018244; classtype:social-engineering; sid:6018244; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lcexpo.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lcexpo.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018245; classtype:social-engineering; sid:6018245; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (malix650.github.io/ledgerhustle/)"; flow:established,to_server; http.uri; content:"/ledgerhustle/"; startswith; fast_pattern; http.host; content:"malix650.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018246; classtype:social-engineering; sid:6018246; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.444tigervip.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.444tigervip.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018247; classtype:social-engineering; sid:6018247; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shubhamsinha6244-hue.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"shubhamsinha6244-hue.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018248; classtype:social-engineering; sid:6018248; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ajustevolume.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"ajustevolume.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018249; classtype:social-engineering; sid:6018249; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (server-security-page--redarazoukitv.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"server-security-page--redarazoukitv.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018250; classtype:social-engineering; sid:6018250; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (proztecindia.com/wp-content/sharepoint/sharepoint.html)"; flow:established,to_server; http.uri; content:"/wp-content/sharepoint/sharepoint.html"; startswith; fast_pattern; http.host; content:"proztecindia.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018251; classtype:social-engineering; sid:6018251; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (incrementodelimited.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"incrementodelimited.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018252; classtype:social-engineering; sid:6018252; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (updates.webaccess-alert.com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/"; startswith; fast_pattern; http.host; content:"updates.webaccess-alert.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018253; classtype:social-engineering; sid:6018253; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bima-ativasi-mobile.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bima-ativasi-mobile.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018254; classtype:social-engineering; sid:6018254; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (our-alert-procedure.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"our-alert-procedure.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018255; classtype:social-engineering; sid:6018255; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (centralone.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"centralone.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018256; classtype:social-engineering; sid:6018256; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deeptisingh16.github.io/Netflix-Landing-page-clone)"; flow:established,to_server; http.uri; content:"/Netflix-Landing-page-clone"; startswith; fast_pattern; http.host; content:"deeptisingh16.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018257; classtype:social-engineering; sid:6018257; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (222-ship-it.github.io/Carte-aluminium-France)"; flow:established,to_server; http.uri; content:"/Carte-aluminium-France"; startswith; fast_pattern; http.host; content:"222-ship-it.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018258; classtype:social-engineering; sid:6018258; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bima-ativasi-mobile.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bima-ativasi-mobile.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018259; classtype:social-engineering; sid:6018259; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pl1e-dnbh-est1.phh-hoejlundhviidconsult-dk-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pl1e-dnbh-est1.phh-hoejlundhviidconsult-dk-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018260; classtype:social-engineering; sid:6018260; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hariszahidrana.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"hariszahidrana.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018261; classtype:social-engineering; sid:6018261; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (etisalcmrex.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"etisalcmrex.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018262; classtype:social-engineering; sid:6018262; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (duielapsmer.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"duielapsmer.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018263; classtype:social-engineering; sid:6018263; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (duilapcmrez.click/webapp/en/quick-recharge)"; flow:established,to_server; http.uri; content:"/webapp/en/quick-recharge"; startswith; fast_pattern; http.host; content:"duilapcmrez.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6018264; classtype:social-engineering; sid:6018264; rev:1; metadata: signature_severity Major, created_et 2026_07_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie.1280h34-340129.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.1280h34-340129.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6018265; classtype:social-engineering; sid:6018265; rev:1; metadata: signature_severity Major, created_et 2026_07_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suscribe-prime.info/index.php)"; flow:established,to_server; http.uri; content:"/index.php"; startswith; fast_pattern; http.host; content:"suscribe-prime.info"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6018266; classtype:social-engineering; sid:6018266; rev:1; metadata: signature_severity Major, created_et 2026_07_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie.34h034h34.surf/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.34h034h34.surf"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6018267; classtype:social-engineering; sid:6018267; rev:1; metadata: signature_severity Major, created_et 2026_07_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.0439230j05.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.0439230j05.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6018268; classtype:social-engineering; sid:6018268; rev:1; metadata: signature_severity Major, created_et 2026_07_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comstart-ledgee.framer.ai/comstart)"; flow:established,to_server; http.uri; content:"/comstart"; startswith; fast_pattern; http.host; content:"comstart-ledgee.framer.ai"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6018269; classtype:social-engineering; sid:6018269; rev:1; metadata: signature_severity Major, created_et 2026_07_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.1280h34-340129.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.1280h34-340129.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6018270; classtype:social-engineering; sid:6018270; rev:1; metadata: signature_severity Major, created_et 2026_07_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qorvexa.vu/Irss)"; flow:established,to_server; http.uri; content:"/Irss"; startswith; fast_pattern; http.host; content:"qorvexa.vu"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6018271; classtype:social-engineering; sid:6018271; rev:1; metadata: signature_severity Major, created_et 2026_07_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (diasporayelo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"diasporayelo.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6018272; classtype:social-engineering; sid:6018272; rev:1; metadata: signature_severity Major, created_et 2026_07_07;)